Added OpenLDAP 2.4.41 image #6

stevekuznetsov · 2015-08-03T17:43:12Z

Also added a testenv image that adds test data for use in Origin integration testing.

Future TODO:

configurable base ldif for organization object
SSL Enable LDAPS #2
blind-population of config / data ~~Enable blind-mount of config #3~~ (pulled into this PR now)
RHEL Support RHEL7-based images #4
Image testing ~~Add testing for images #5~~ (pulled into this PR now)

stevekuznetsov · 2015-08-03T18:20:18Z

stevekuznetsov · 2015-08-04T20:00:30Z

@bparees PTAL as well! This image will only be used for our testing (for now). I am of the opinion that as long as we label it as such we can get away with keeping the future TODO list as future TODOs.

bparees · 2015-08-04T20:25:27Z

2.4.41/Dockerfile

+VOLUME ["/var/lib/ldap", "/etc/openldap"]
+
+# Expose default ports for ldap and ldaps
+EXPOSE 389 636


you're going to be running as non-root, presumably...can you listen on these ports?

Seemed to work perfectly fine in testing

I was able to chmod the slapd binary in such a way that it does indeed have the permissions to listen on these ports. I think this is preferable to mapping them to something with a router.

you chmod'd it to setuid root? no that is bad.

@smarterclayton selinux is going to prevent this sort of thing at some point, right?

@bparees @smarterclayton would it be valid to setcap 'cap_net_bind_service=+ep' the slapd binary?

that sounds like a better approach..

You know what they say, why use a brush when you have a bulldozer?

@deads2k is the only person i know who likely has bulldozer driving experience.

stevekuznetsov · 2015-08-07T13:26:15Z

@bparees Updated, everything works fine with UID == 0 and UID != 0

stevekuznetsov · 2015-08-07T19:38:30Z

@bparees updated Dockerfile to grant low-port bind access to binary instead of creating large security hole

bparees · 2015-08-07T19:57:51Z

2.4.41/Dockerfile

+    mkdir -p /etc/openldap && \
+    chmod a+rwx -R /etc/openldap && \
+    mkdir -p /var/run/openldap && \
+    chmod a+rwx -R /var/run/openldap 


combine these RUNs

stevekuznetsov · 2015-08-07T20:21:28Z

@bparees Unfortunately I have not been able to find a way in the last two weeks to get this to run as non-root other than to bulldoze my way through the config and data directories, overwriting it all from a default-configured setup. I would also prefer not to put the binaries in the repository, but that is the only way this works at all.

bparees · 2015-08-07T20:31:10Z

i'm going to need a better understanding of why that is........ it's going to be a pain to maintain that as binary files, nevermind the general horribleness of having binary content in git in terms of what it does to repo size.

stevekuznetsov · 2015-08-11T14:17:43Z

@bparees PTAL - added HACKING.md to address your concerns. Will merge if it LGTY.

stevekuznetsov · 2015-08-11T17:31:05Z

@bparees Moved test data out of this repo

bparees · 2015-08-11T18:45:37Z

HACKING.md

+The default out-of-the-box installation of OpenLDAP contains a `olcRootDN` manager for the `cn=config` database but does not list a password, which is problematic as it does not allow you to use the full authentication (`-x -D <managerCN> -w <password>`) and therefore does not allow for the user to use this set-up to add or remove records unless they are `UID 0`.
+
+### OpenLDAP Configuration Dump
+OpenLDAP exposes administrative tools like [`slapadd`](http://www.openldap.org/software/man.cgi?query=slapadd&apropos=0&sektion=0&manpath=OpenLDAP+2.4-Release&format=html) and [`slpacat`](http://www.openldap.org/software/man.cgi?query=slapcat&apropos=0&sektion=0&manpath=OpenLDAP+2.4-Release&format=html) which operate on OpenLDAP installations with the daemon not running. These tools are a promising work-around to the authentication nightmare above. The gist of this approach is as such: first, install OpenLDAP on a machine or container where you have `root` privileges (`UID 0` and `GID 0` are required due to how OpenLDAP generates authentication identities), create an OpenLDAP installation to your liking, stop the daemon (`slapd`), dump all of the OpenLDAP installation to `ldif` using `slapcat -n0`, then import all of the data using `slapadd -n0` on another installation. This approach does not seem to work as if there are no vestiges of the new `cn=config` configuration schema in the `etc/openldap` directory, the `slapadd` command looks for the old `slapd.conf` configuration schema and fails because it is deprecated. `slapadd` also cannot be used while the daemon is off to insert the records we want to `olcDatabase{0}config` as it is only capable of adding object, not editing or amending current objects. Editing the files by hand will trigger checksum errors and cause a corrupt installation. Therefore, this option was abandoned.


work on the tone a little... "nightmare" is probably not how we want to describe this.

Little to much heart in that one?

bparees · 2015-08-11T18:46:56Z

one final comment and lgtm.

bparees · 2015-08-11T21:46:36Z

@stevekuznetsov failed testing: https://ci.openshift.redhat.com/jenkins/view/Image%20Verification/job/openldap/3/console

looks like it might just be this rmdir that failed, though i'm not clear why that would be...maybe the dir couldn't be rm'd because your container didn't stop so the cidfile wasn't removed?

rmdir /tmp/tmp.jjean7DZk1openldap_test_cidfiles
make: *** [test] Error 1

echo 'ERROR: openldap-rhel7 failed testing.'
exit 1

stevekuznetsov · 2015-08-12T12:09:59Z

I can't reproduce this with TARGET=rhel7 make test locally. The logs look like they show the container stopping with a 0 exit code, as well:

+ CONTAINER=7bd0c9fdebadeff2fcbe657e67d8c76bb7f4e9fffaa929f1e3d0c76cf431ea90
+ echo 'Stopping and removing container 7bd0c9fdebadeff2fcbe657e67d8c76bb7f4e9fffaa929f1e3d0c76cf431ea90...'
+ docker stop 7bd0c9fdebadeff2fcbe657e67d8c76bb7f4e9fffaa929f1e3d0c76cf431ea90
++ docker inspect -f '{{.State.ExitCode}}' 7bd0c9fdebadeff2fcbe657e67d8c76bb7f4e9fffaa929f1e3d0c76cf431ea90
+ exit_status=0
+ '[' 0 '!=' 0 ']'
+ docker rm 7bd0c9fdebadeff2fcbe657e67d8c76bb7f4e9fffaa929f1e3d0c76cf431ea90
+ rm /tmp/tmp.jjean7DZk1openldap_test_cidfiles/test_container_root
+ echo Done.

stevekuznetsov · 2015-08-12T12:37:03Z

@bparees I use ldapsearch in order to test the image, and the Jenkins server doesn't have this installed. Thoughts?

bparees · 2015-08-12T12:44:57Z

can you curl/wget ldapsearch as part of the test script?

stevekuznetsov · 2015-08-12T12:45:23Z

I'll look into it. I think it should be possible.

stevekuznetsov · 2015-08-12T13:23:08Z

@bparees Great Success

bparees · 2015-08-12T14:22:14Z

@stevekuznetsov i actually just meant use curl to download ldapsearch and then use it..but i guess that works too.

Added OpenLDAP 2.4.41 image

stevekuznetsov force-pushed the skuznets/openldap branch from ee5d657 to 17d007d Compare August 3, 2015 18:01

liggitt self-assigned this Aug 3, 2015

stevekuznetsov force-pushed the skuznets/openldap branch from 17d007d to c606ee0 Compare August 3, 2015 18:58

This was referenced Aug 4, 2015

Add blind mount support #7

Closed

[WIP] Added LDAPS support #8

Closed

bparees reviewed Aug 4, 2015
View reviewed changes

stevekuznetsov mentioned this pull request Aug 5, 2015

Added LDAP Group Sync for Single LDAP Schema openshift/origin#3996

Closed

stevekuznetsov force-pushed the skuznets/openldap branch 6 times, most recently from b5a3290 to 761425b Compare August 7, 2015 12:50

stevekuznetsov force-pushed the skuznets/openldap branch 5 times, most recently from 77b5a23 to b6b35e6 Compare August 7, 2015 19:37

bparees reviewed Aug 7, 2015
View reviewed changes

stevekuznetsov force-pushed the skuznets/openldap branch 4 times, most recently from 518df58 to 21ad5d6 Compare August 11, 2015 14:17

stevekuznetsov force-pushed the skuznets/openldap branch 2 times, most recently from d28fd28 to 9d0c888 Compare August 11, 2015 17:30

bparees reviewed Aug 11, 2015
View reviewed changes

stevekuznetsov force-pushed the skuznets/openldap branch from 9d0c888 to 1223112 Compare August 11, 2015 20:29

stevekuznetsov mentioned this pull request Aug 11, 2015

Add testing for images #5

Closed

stevekuznetsov force-pushed the skuznets/openldap branch 2 times, most recently from 1b64bdc to ea5ffd9 Compare August 11, 2015 20:44

Added OpenLDAP 2.4.41 image

2a70977

stevekuznetsov force-pushed the skuznets/openldap branch from ea5ffd9 to 2a70977 Compare August 12, 2015 13:01

bparees added a commit that referenced this pull request Aug 12, 2015

Merge pull request #6 from stevekuznetsov/skuznets/openldap

b72261e

Added OpenLDAP 2.4.41 image

bparees merged commit b72261e into openshift:master Aug 12, 2015

stevekuznetsov mentioned this pull request Aug 18, 2015

Enable blind-mount of config #3

Closed

stevekuznetsov pushed a commit to stevekuznetsov/openldap that referenced this pull request Oct 6, 2015

Merge pull request openshift#6 from stevekuznetsov/skuznets/openldap

4cfedce

Added OpenLDAP 2.4.41 image

stevekuznetsov pushed a commit to stevekuznetsov/openldap that referenced this pull request Oct 6, 2015

Merge pull request openshift#6 from stevekuznetsov/skuznets/openldap

4c55c61

Added OpenLDAP 2.4.41 image

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added OpenLDAP 2.4.41 image #6

Added OpenLDAP 2.4.41 image #6

stevekuznetsov commented Aug 3, 2015

stevekuznetsov commented Aug 3, 2015

stevekuznetsov commented Aug 4, 2015

bparees Aug 4, 2015

stevekuznetsov Aug 5, 2015

stevekuznetsov Aug 7, 2015

bparees Aug 7, 2015

bparees Aug 7, 2015

stevekuznetsov Aug 7, 2015

bparees Aug 7, 2015

stevekuznetsov Aug 7, 2015

bparees Aug 7, 2015

stevekuznetsov commented Aug 7, 2015

stevekuznetsov commented Aug 7, 2015

bparees Aug 7, 2015

stevekuznetsov commented Aug 7, 2015

bparees commented Aug 7, 2015

stevekuznetsov commented Aug 11, 2015

stevekuznetsov commented Aug 11, 2015

bparees Aug 11, 2015

stevekuznetsov Aug 11, 2015

bparees commented Aug 11, 2015

bparees commented Aug 11, 2015

stevekuznetsov commented Aug 12, 2015

stevekuznetsov commented Aug 12, 2015

bparees commented Aug 12, 2015

stevekuznetsov commented Aug 12, 2015

stevekuznetsov commented Aug 12, 2015

bparees commented Aug 12, 2015

Added OpenLDAP 2.4.41 image #6

Added OpenLDAP 2.4.41 image #6

Conversation

stevekuznetsov commented Aug 3, 2015

stevekuznetsov commented Aug 3, 2015

stevekuznetsov commented Aug 4, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stevekuznetsov commented Aug 7, 2015

stevekuznetsov commented Aug 7, 2015

Choose a reason for hiding this comment

stevekuznetsov commented Aug 7, 2015

bparees commented Aug 7, 2015

stevekuznetsov commented Aug 11, 2015

stevekuznetsov commented Aug 11, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bparees commented Aug 11, 2015

bparees commented Aug 11, 2015

stevekuznetsov commented Aug 12, 2015

stevekuznetsov commented Aug 12, 2015

bparees commented Aug 12, 2015

stevekuznetsov commented Aug 12, 2015

stevekuznetsov commented Aug 12, 2015

bparees commented Aug 12, 2015