Skip to content

Latest commit

 

History

History
62 lines (36 loc) · 1.71 KB

ldap-dit.rst

File metadata and controls

62 lines (36 loc) · 1.71 KB
Raw

LDAP Directory Information Tree

This document describes how the debops.icinga_web Ansible role fits in the ldap__ref_dit.

Directory structure

  • cn=host.example.org <ldap__ref_ldap_dit> -> debops.ldap
    • uid=icingaweb <icinga_web__ldap_self_rdn>

Object Classes and Attributes

  • uid=icingaweb <icinga_web__ldap_self_rdn>
    • debops.icinga_web: Object Classes <icinga_web__ldap_self_object_classes>, Attributes <icinga_web__ldap_self_attributes>

Access Control

DebOps LDAP environment includes the 'ldapns' schema <slapd__ref_ldapns> which can be used to define access control rules to services. The lists below define the attribute values which will grant access to the service managed by the debops.icinga_web role, and specifies other roles with the same access control rules:

  • objectClass authorizedServiceObject, attribute authorizedService:
    • all (all services)
    • icingaweb

LDAP filter definition: icinga_web__ldap_user_filter

Parent nodes

  • debops.ldap <ldap__ref_ldap_dit>
    • ansible_local.ldap.base_dn <ldap__base_dn> -> gitlab__ldap_base_dn
    • ansible_local.ldap.device_dn <ldap__device_dn> -> gitlab__ldap_device_dn

Child nodes

There are no child nodes defined for the debops.icinga_web Ansible role.