Skip to content

Allow setting arbitary domains for replication #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
F1rst-Unicorn wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Allow setting arbitary domains for replication #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e69b5a9
Allow setting arbitary domains for replication
F1rst-Unicorn Mar 6, 2020
0b45927
document external_domain attributes
F1rst-Unicorn Mar 10, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,10 @@ This role sets up 389ds in multi-master mode.
| `auth_ldap_permissions` | (see defaults/main.yml) | ACIs to set on the directory |
| `auth_kerberos_admin_privs` | `[]` | Kerberos principals to grant administrative permissions to (see defaults/main.yml for format) |
| `auth_ldap_store_pam` | `True` | Whether to actually store the generated 389ds PAM config. Useful if you want to customize it using another role |
|`auth_kerberos_curves` | `edwards25519` | Curves to use for kerberos SPAKE |
| `auth_kerberos_curves` | `edwards25519` | Curves to use for kerberos SPAKE |
| `auth_ldap_use_external_domain` | `False` | Use separate domain for mutual replication connections |
| `auth_ldap_external_domain` | `None` | The domain to use if the setting before is `True` |


Users can be created by putting them into `auth_ldap_users` as a dict with the following format:
```
Expand Down
5 changes: 5 additions & 0 deletions defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ auth_ldap_domain_suffix: None
# If you have subdomains with hosts, you might want to add them here
auth_ldap_domain_subdomains: []

# If your LDAP servers are not mutually reachable via their FQDN, set this for
# replication
auth_ldap_use_external_domain: False
Copy link
Owner

@uubk uubk Mar 7, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add these to the list in the README?

auth_ldap_external_domain: None

# LDAP admin credentials (you need to change these)
auth_ldap_admin_pwd: None
auth_ldap_sync_pwd: None
Expand Down
4 changes: 4 additions & 0 deletions templates/haproxy-dropin.conf.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,11 @@ frontend {{ item }}-ldap-front
backend {{ item }}-ldap-back
mode tcp
option ldap-check
{% if auth_ldap_use_external_domain %}
server remote {{ hostvars[item]['auth_ldap_external_domain'] }}:60389 ssl crt /etc/dirsrv/client.pem ca-file /etc/dirsrv/ca.pem verify required check check-ssl
{% else %}
server remote {{ item }}:60389 ssl crt /etc/dirsrv/client.pem ca-file /etc/dirsrv/ca.pem verify required check check-ssl
{% endif %}

{% endif %}
{% endfor %}
Expand Down