it-team/lmn-client
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Kerberize LDAP access.

Browse source
This commit is contained in:
Andreas B. Mundt 2019-11-28 17:37:19 +01:00
parent 2ff1354fe3
commit 3b3303e96d
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
roles/krb5-kdc-ldap/tasks/main.yml
View file

@ -117,6 +117,15 @@
state: exact state: exact
when: not krb5kdc.stat.exists when: not krb5kdc.stat.exists
- name: add AuthzRegexp to map access via kerberos/GSSAPI
ldap_attr:
dn: "cn=config"
name: olcAuthzRegexp
values:
- "{0}uid=([^,]*),cn=gssapi,cn=auth uid=$1,ou=people,{{ basedn }}"
- "{1}uid=([^,]*),cn=gs2-iakerb,cn=auth uid=$1,ou=people,{{ basedn }}"
state: exact
- name: prepare password for kdc - name: prepare password for kdc
shell: echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_service_pwd }} | xxd -g0 -ps | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile shell: echo "cn=kdc,cn=kerberos,{{ basedn }}#{HEX}$(echo -n {{ kdc_service_pwd }} | xxd -g0 -ps | sed 's/0a$//')" > /etc/krb5kdc/service.keyfile
no_log: true no_log: true
@ -173,6 +182,13 @@
- ldap - ldap
when: not krb5kdc.stat.exists when: not krb5kdc.stat.exists
- name: allow slapd to read the keytab
file:
path: /etc/krb5.keytab
owner: root
group: openldap
mode: '0640'
- name: "make 'kerberos' an alias hostname resolvable from the LAN" - name: "make 'kerberos' an alias hostname resolvable from the LAN"
replace: replace:
path: /etc/hosts path: /etc/hosts