OpenLDAP

OpenLDAP server in a container

In some cases where you need to spin up a small LDAP server for testing or 'temporary production' environments, the following docker-compose stack should fit the bill. This stack will utilize a bootstrap.ldif file to populate the LDAP directory. It also includes an instance of PHPLdapAdmin which you can remove if unnecessary.

Create the following docker-compose.yml file:

version: '3.3'
services:
  ldap:
    image: osixia/openldap
    restart: always
    volumes:
      - ./config:/container/service/slapd/assets/config/bootstrap/ldif/custom
     # For persistent states, you may also want tot add these volumes
     # - ./data:/var/lib/ldap
     # - ./config:/etc/ldap/slapd.d
    environment:
      - "TZ=MST7MDT,M3.2.0,M11.1.0"
      - LDAP_ORGANISATION=Home
      - LDAP_DOMAIN=home.steamr.com
      - LDAP_ADMIN_PASSWORD=super-secret-password
      - LDAP_TLS="false"
      - LDAP_RFC2307BIS_SCHEMA="true"
    expose:
      - "389"
    ports:
      - "10.1.1.1:389:389"
    networks:
      - internal
    command: --copy-service

  phpldapadmin:
    image: osixia/phpldapadmin:latest
    container_name: phpldapadmin
    environment:
      PHPLDAPADMIN_LDAP_HOSTS: "ldap"
      PHPLDAPADMIN_HTTPS: "false"
    # If you are using traefik as a reverse proxy service...
    #labels:
    #  - traefik.enable=true ... etc
    #expose:
    #  - "80"
    # Otherwise, expose port 80.
    ports:
      - "10.1.1.1:80:80"
    depends_on:
      - ldap
    networks:
      - internal

networks:
  internal:

Your bootstrap.ldif file should contain all your groups and users. Here's an example.

dn: cn=leo,dc=home,dc=steamr,dc=com
changetype: add
objectclass: inetOrgPerson
cn: Leo
givenname: leo
sn: Leung
displayname: Leo Leung
mail: leo@steamr.com
userpassword: pass

dn: cn=downloaders,ou=Groups,dc=home,dc=steamr,dc=com
changetype: add
cn: Downloaders
objectclass: groupOfUniqueNames
uniqueMember: cn=leo,dc=home,dc=steamr,dc=com

Bring everything up with docker-compose up -d.

You can login to phpldapadmin by authenticating as user 'cn=admin,dc=home,dc=steamr,dc=com' using the password that you passed via the environment variables.

Samba

Edit smb.conf. Under [global], add

1. 1. LDAP Settings

       ldap suffix = dc=domain,dc=tld
       ldap admin dn = cn=Manager,dc=domain,dc=tld

1. ldap ssl = no

       passdb backend = ldapsam:ldaps://dit.domain.tld

https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication