OpenLDAP demo container

Table of Contents

• Use case
• Usage
  • Samples
  • Environment variables
• LDAP connection and filters
• Groups and users
  • Default users and groups
• Create your own demo image
• Certificate
• Scripts
• OpenShift

OpenLDAP Docker container for demo purposes.

Based on Bitnami Docker Image for OpenLDAP.

Use case

Occasionally I have a need to have LDAP server with groups and users. That’s why this image exists. No installations, no setup, just run and use.

Usage

• Get Docker image:

podman pull kazhar/openldap-demo

• Run Docker image:

podman run -d -p 389:1389 -p 636:1636 --name openldap-demo kazhar/openldap-demo

• Login to server:

  • Base DN: dc=sirius,dc=com

  • Admin user: cn=admin,dc=sirius,dc=com

  • Password: passw0rd

Or you can download/clone this repo and create and build your own OpenLDAP image.

Samples

• Add group staff and some users.

podman run -it --rm -p 1389:1389 -p 1636:1636 --name openldap -e ADDITIONAL_LDAP_USERS_AND_GROUPS="staff:Ulysses Ser1, Uma Ser2, Uriel Ser3, Ulrich Ser4, Ursula Ser5, Upton Ser6, Uriah Ser7, Uliana Ser8, Ulma Ser9, Ulric Ser10" kazhar/openldap-demo

• Add your own organization, domain and create new self-signed certificates.

podman run -it --rm -p 1389:1389 -p 1636:1636 --name openldap -e LDAP_DOMAIN=wayne.net -e LDAP_ROOT="dc=wayne,dc=net" -e LDAP_ORGANIZATION="Wayne Machines" -e CREATE_CERTS=true kazhar/openldap-demo

• Add your own certificate

podman run -it --rm -p 1389:1389 -p 1636:1636 --name openldap -v /tmp_crt/ldap.crt:/certs/ldap.crt:z -v /tmp_crt/ldap.key:/certs/ldap.key:z -v /tmp/tmp_crt/ca.crt:/certs/ca.crt:z  kazhar/openldap-demo

Environment variables

Name	Default Value	Description
LDAP_DOMAIN	sirius.com	Domain used in certificate and user emails.
LDAP_ROOT	dc=sirius,dc=com	Base DN. Must match domain.
LDAP_ORGANIZATION	Sirius Cybernetics Corporation	Organization name/description. For example, company name.
LDAP_ADMIN_PASSWORD	passw0rd	Administrator password.
DEFAULT_USER_PASSWORD	passw0rd	Default user password.
LDAP_USERS_AND_GROUPS	admin:Kiara Doyle,Zac Fraser,Andre Shaw,Daniella Wells;research:Olivia Berry,Oscar Davis,Amelia Lawson,Jonah Stone;operations:Tom Foster,Cara Hawkins,Natalia Matthews,George Watts;marketing:Hilary Banks=hilary,Mallory Keaton=mkeaton,Ed Norton=pwd,Michael Scott=scott	List of users and groups.
ADDITIONAL_LDAP_USERS_AND_GROUPS		Additional list of users and groups. Added after LDAP_USERS_AND_GROUPS.
CREATE_CERTS		Set to true to generated fresh self-signed certificates.
SANS		Space separated list of hostnames, added to self-signed certificate.
IP_SANS		Space separated list of IP addresses, added to self-signed certificate.

See also Dockerfile for more environment variables.

LDAP connection and filters

Some applications ask for LDAP connection and filters. If using the default OpenLDAP demo image, here are the settings and filters that should work.

Setting	Value
URL	ldap://server.ip:389
Base DN	dc=sirius,dc=com
Bind DN, admin or domain search user	cn=admin,dc=sirius,dc=com
Admin password	passw0rd
User filter	(&(uid=%v)(objectclass=inetOrgPerson))
Group filter	(&(cn=%v)(objectclass=groupOfUniqueNames))
Group membership search filter	(&(uniqueMember={0})(objectclass=groupOfUniqueNames))
Group member ID map	groupOfUniqueNames:uniqueMember
User ID map	*:uid
Group ID map	*:cn
User search base	ou=users,dc=sirius,dc=com
User search field	uid
Group search base	ou=groups,dc=sirius,dc=com
Group search field	cn
First name	givenName
Last name	sn
Email	mail
Group membership (within inetorgPerson)	memberOf
Group member field (within groupOfUniqueNames)	uniqueMember

Groups and users

Groups and users are specified in environment variable LDAP_USERS_AND_GROUPS.

The format of the environment variable is:

<groupname>:<firstname> <lastname>[=<password>],<firstname> <lastname>[=<password>];<groupname>:<firstname> <lastname>[=<password>],<firstname> <lastname>[=<password>]

For example, this is the default value:

admin:Kiara Doyle,Zac Fraser,Andre Shaw,Daniella Wells;research:Olivia Berry,Oscar Davis,Amelia Lawson,Jonah Stone;operations:Tom Foster,Cara Hawkins,Natalia Matthews,George Watts;marketing:Hilary Banks=hilary,Mallory Keaton=mkeaton,Ed Norton=pwd,Michael Scott=scott

One group is:

• cn=admin,ou=groups,dc=sirius,dc=com

And one user in that group is :

• uid=kdoyle,ou=users,dc=sirius,dc=com

The default password for users is set by DEFAULT_USER_PASSWORD environment variable.

Default users and groups

Group: admin

Name	UID	Default password
Kiara Doyle	kdoyle	passw0rd
Zac Fraser	zfraser	passw0rd
Andre Shaw	ashaw	passw0rd
Daniella Wells	dwells	passw0rd

Group: research

Name	UID	Default password
Olivia Berry	oberry	passw0rd
Oscar Davis	odavis	passw0rd
Amelia Lawson	alawson	passw0rd
Jonah Stone	jstone	passw0rd

Group: operations

Name	UID	Default password
Tom Foster	tfoster	passw0rd
Cara Hawkins	chawkins	passw0rd
Natalia Matthews	nmatthews	passw0rd
George Watts	gwatts	passw0rd

Group: marketing

Name	UID	Default password
Hilary Banks	hbanks	hilary
Mallory Keaton	mkeaton	mkeaton
Ed Norton	enorton	pwd
Michael Scott	mscott	scott

Create your own demo image

In order to create your own OpenLDAP image with custom domain and users, edit Dockerfile and then build a new OpenLDAP image.

• Edit Dockerfile.

• Build image:

podman build -t my-openldap .

• Start:

podman run -it --rm -p 389:1389 -p 636:1636 --name my-openldap my-openldap

Certificate

Certificate is created when image is built, using My CA.

SANs in the certificate are:

DNS: openldap.<domain in LDAP_DOMAIN environment variable>
DNS: localhost
IP: 127.0.0.1

When starting the container, set -e CREATE_CERTS=true to create fresh self-signed certificates.

If you have existing certificates (for example, Let’s Encrypt certs), add them as volumes when starting the container:

podman run -it --rm -p 389:1389 -p 636:1636 --name openldap-demo -v /my-certs/privkey1.pem:/certs/ldap.key:z -v /my-certs/cert1.pem:/certs/ldap.crt:z -v /my-certs/ca.crt:/certs/ca.crt:z kazhar/openldap-demo

• -v option maps file to file.

Scripts

scripts-directory includes some scripts that can be used to search LDAP by userid, last name, package files for offline distribution and others.

OpenShift

• Install openldap-demo to OpenShift:

sh ocp-openldap-demo.sh install <namespace>

• Uninstall openldap-demo from OpenShift:

sh ocp-openldap-demo.sh uninstall <namespace>

• See ocp-openldap-demo.sh for details.

• OpenLDAP is accessible within the cluster.

  • For example:

  • ldap://openldap-demo.<namespace>.svc.cluster.local:389

  • ldaps://openldap-demo.<namespace>.svc.cluster.local:636