Add ldap testing image with active directory schema #166

eformat · 2023-05-19T22:30:43Z

add a testing image for open ldap server with active directory schema from openldap. see:

https://git.openldap.org/openldap/openldap/-/blob/master/servers/slapd/schema/msuser.ldif

this is linked to tests coming in this PR - "Ldap Group Provider" - trinodb/trino#17518

there are some slight tweaks to the msuser schema to make it load correctly e.g whitespace (tab for spaces) and rename a couple of clashing attributes.

for testing, the memberOf attribute is intentionally made a String. for RDN based memberOf, we can use the existing openldap image OK.

# 1.3.6.1.4.1.1466.115.121.1.12 - Distinguished Name syntax
# 1.3.6.1.4.1.1466.115.121.1.15 - Directory String syntax
# NO-USER-MODIFICATION
olcAttributeTypes: ( MSADat2:102
  NAME 'memberOf'
  SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )
#

cla-bot · 2023-05-19T22:30:45Z

Thank you for your pull request and welcome to the Trino community. We require contributors to sign our Contributor License Agreement, and we don't seem to have you on file. Continue to work with us on the review and improvements in this PR, and submit the signed CLA to cla@trino.io. Photos, scans, or digitally-signed PDF files are all suitable. Processing may take a few days. The CLA needs to be on file before we merge your changes. For more information, see https://github.com/trinodb/cla

eformat · 2023-05-23T04:27:39Z

i have signed the cla and returned on 16/5/23. cheers

eformat · 2023-06-12T08:40:37Z

cc: @Praveen2112 .. this will need to merge as well .. for tests.

eformat · 2023-06-12T08:40:56Z

cc: trinodb/trino#17518

testing/centos7-oj17-openldap-active-directory/Dockerfile

Praveen2112 · 2023-06-19T10:08:13Z

testing/centos7-oj17-openldap-active-directory/Dockerfile

+# limitations under the License.
+
+ARG ARCH
+FROM testing/centos7-oj17:unlabelled$ARCH


Is it possible to have an unlabelled image which could be shared both by OpenLDAP and AD configuration - Most of the statements are similar to OpenLDAP and it would be nice if we could extract them.

yes, its possible. would involve refactoring both images of course. the code + tests for LDAP authentication are not impacted at the moment - but would be if we do this

OK @Praveen2112 - refactored into a common base now. PTAL.

...os7-oj17-openldap-active-directory/files/etc/openldap/certs/active-directory-certificate.crt

eformat · 2023-06-21T03:18:43Z

@Praveen2112 - i may need some help around order of these builds to make this pass testing ? can you advise best way to achieve it (base will need to be built + pushed i think)

testing/centos7-oj17-openldap-base
               \
                 \     --  testing/centos7-oj17-openldap-active-directory
                   \
                     \   --  testing/centos7-oj17-openldap
                                       |
                                testing/centos7-oj17-openldap-referrals

eformat · 2023-06-27T07:05:47Z

@Praveen2112 i have fixed up the ldap test now - looks like a random other image test build failed which is unrelated.

What else is holding this one up from being merged ?

Praveen2112 · 2023-06-27T13:37:05Z

Thanks for fixing it. Can we squash and rearrange the commit - first commit would be the refactor one and AD can added in the next commit.

eformat · 2023-06-28T00:04:15Z

@Praveen2112 - done. thx.

Praveen2112 · 2023-06-28T13:17:17Z

The failure is not related to the changes - it is a blocker for releasing this image - I'll try to fix the failure in a different PR.

Praveen2112 · 2023-07-03T09:00:15Z

Can you rebase the PR to the recent changes in the master ?

eformat · 2023-07-03T22:01:35Z

Done

Praveen2112

Can we remove the merge commit (last commit) and instead do a rebase - so the history could be a bit clear

.github/workflows/ci.yml

.github/workflows/release.yml

etc/compose/openldap-active-directory/docker-compose.yml

testing/centos7-oj17-openldap-base/Dockerfile

Praveen2112 · 2023-07-04T06:08:08Z

testing/centos7-oj17-openldap-base/files/etc/openldap/setup/msuser.ldif

@@ -0,0 +1,4298 @@
+# $OpenLDAP$


This should be in the next commit right ?

Is it possible to wget or download them from a specific url ?

as documented in the Dockerfile its from here

active dictory schema from https://git.openldap.org/openldap/openldap/-/raw/master/servers/slapd/schema/msuser.ldif

you cant easily wget it, as there are some minor modifications required to make sure it loads properly.
its pretty old, so wont load as-is without commenting out a couple of duplicate definitions that were clearly loaded ok at some time in the distant past.

This should be in the next commit, and it should be in directory relative to AD

Praveen2112 · 2023-07-04T07:55:52Z

Let me know if you need any help on moving the changes across commits. Happy to help

eformat · 2023-07-04T10:09:41Z

changes moved commits as requested. cheers.

Praveen2112 · 2023-07-06T09:32:32Z

testing/centos7-oj17-openldap-base/files/etc/openldap/setup/msuser.ldif

@@ -0,0 +1,4298 @@
+# $OpenLDAP$


This should be in the next commit, and it should be in directory relative to AD

testing/cdh5.15-hive-kerberized-kms/files/usr/bin/extract_rpms.sh

testing/centos7-oj17-openldap-base/Dockerfile

testing/centos7-oj17-openldap-base/files/etc/openldap/setup/msuser.ldif

testing/centos7-oj17-openldap-base/files/etc/openldap/setup/refint.ldif

testing/centos7-oj17-openldap-base/files/etc/openldap/setup/createOU.ldif

eformat · 2023-07-06T22:25:02Z

@Praveen2112 - can we get this merged please ? i dont have a tonne of time to keep making small changes in commit ordering. Those are cosmetic changes really to the functionality. I am happy to squash it all in one commit if that is easier for you to review.

Praveen2112 · 2023-07-10T06:17:59Z

Thanks for working on this.

eformat changed the title ~~add ldap testing image with active directory schema~~ Add ldap testing image with active directory schema May 19, 2023

eformat mentioned this pull request May 19, 2023

Ldap Group Provider trinodb/trino#17518

Closed

ebyhr requested a review from Praveen2112 May 25, 2023 23:00

Praveen2112 reviewed Jun 12, 2023

View reviewed changes

testing/centos7-oj17-openldap-active-directory/Dockerfile Outdated Show resolved Hide resolved

Praveen2112 reviewed Jun 19, 2023

View reviewed changes

cla-bot bot added the cla-signed label Jun 20, 2023

eformat force-pushed the add-centos7-oj17-openldap-active-directory branch 6 times, most recently from 30624d6 to 4502c44 Compare June 27, 2023 23:48

Praveen2112 reviewed Jul 4, 2023

View reviewed changes

eformat force-pushed the add-centos7-oj17-openldap-active-directory branch 3 times, most recently from dae0079 to 2ad1117 Compare July 4, 2023 06:53

eformat force-pushed the add-centos7-oj17-openldap-active-directory branch 2 times, most recently from c254981 to 6155136 Compare July 4, 2023 09:58

eformat force-pushed the add-centos7-oj17-openldap-active-directory branch 4 times, most recently from f145488 to e13cded Compare July 4, 2023 10:08

Praveen2112 reviewed Jul 6, 2023

View reviewed changes

eformat force-pushed the add-centos7-oj17-openldap-active-directory branch from 77f8830 to f08e5e6 Compare July 6, 2023 22:17

eformat added 2 commits July 7, 2023 13:04

Extract open-ldap base image

3096bee

Add ldap testing image with active directory schema

7110a2f

Praveen2112 force-pushed the add-centos7-oj17-openldap-active-directory branch from f08e5e6 to 7110a2f Compare July 7, 2023 08:24

Praveen2112 approved these changes Jul 7, 2023

View reviewed changes

Praveen2112 merged commit 3427d29 into trinodb:master Jul 10, 2023
35 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ldap testing image with active directory schema #166

Add ldap testing image with active directory schema #166

eformat commented May 19, 2023

cla-bot bot commented May 19, 2023

eformat commented May 23, 2023

eformat commented Jun 12, 2023

eformat commented Jun 12, 2023

Praveen2112 Jun 19, 2023

eformat Jun 19, 2023

eformat Jun 20, 2023

eformat commented Jun 21, 2023 •

edited

Loading

eformat commented Jun 27, 2023

Praveen2112 commented Jun 27, 2023

eformat commented Jun 28, 2023

Praveen2112 commented Jun 28, 2023

Praveen2112 commented Jul 3, 2023

eformat commented Jul 3, 2023

Praveen2112 left a comment

Praveen2112 Jul 4, 2023

Praveen2112 Jul 4, 2023

eformat Jul 4, 2023 •

edited

Loading

Praveen2112 Jul 6, 2023

Praveen2112 commented Jul 4, 2023

eformat commented Jul 4, 2023

Praveen2112 Jul 6, 2023

eformat commented Jul 6, 2023

Praveen2112 commented Jul 10, 2023

Add ldap testing image with active directory schema #166

Add ldap testing image with active directory schema #166

Conversation

eformat commented May 19, 2023

cla-bot bot commented May 19, 2023

eformat commented May 23, 2023

eformat commented Jun 12, 2023

eformat commented Jun 12, 2023

Praveen2112 Jun 19, 2023

Choose a reason for hiding this comment

eformat Jun 19, 2023

Choose a reason for hiding this comment

eformat Jun 20, 2023

Choose a reason for hiding this comment

eformat commented Jun 21, 2023 • edited Loading

eformat commented Jun 27, 2023

Praveen2112 commented Jun 27, 2023

eformat commented Jun 28, 2023

Praveen2112 commented Jun 28, 2023

Praveen2112 commented Jul 3, 2023

eformat commented Jul 3, 2023

Praveen2112 left a comment

Choose a reason for hiding this comment

Praveen2112 Jul 4, 2023

Choose a reason for hiding this comment

Praveen2112 Jul 4, 2023

Choose a reason for hiding this comment

eformat Jul 4, 2023 • edited Loading

Choose a reason for hiding this comment

Praveen2112 Jul 6, 2023

Choose a reason for hiding this comment

Praveen2112 commented Jul 4, 2023

eformat commented Jul 4, 2023

Praveen2112 Jul 6, 2023

Choose a reason for hiding this comment

eformat commented Jul 6, 2023

Praveen2112 commented Jul 10, 2023

eformat commented Jun 21, 2023 •

edited

Loading

eformat Jul 4, 2023 •

edited

Loading