forked from ungleich-public/ungleich-user
Sajeyks
b9c043dcd4
Production and the client's test server use ldaps://, so the dev server now offers TLS as well: ldaps on 636 (localhost:3636) and StartTLS on 389, with both ports also published on [::1]. A throwaway CA and server certificate are generated on every start, with the full CA extensions that Python 3.13+ strict verification requires. The CA certificate is copied to dev/ldap/export/ca.crt (gitignored). The server certificate covers localhost, the service names and ::1, but not 127.0.0.1, so tests can show that hostname mismatches are rejected.
57 lines
1.4 KiB
Text
57 lines
1.4 KiB
Text
dn: cn=config
|
|
objectClass: olcGlobal
|
|
cn: config
|
|
olcArgsFile: /run/openldap/slapd.args
|
|
olcPidFile: /run/openldap/slapd.pid
|
|
olcTLSCACertificateFile: /etc/openldap/tls/ca.crt
|
|
olcTLSCertificateFile: /etc/openldap/tls/server.crt
|
|
olcTLSCertificateKeyFile: /etc/openldap/tls/server.key
|
|
olcTLSProtocolMin: 3.3
|
|
|
|
dn: cn=module,cn=config
|
|
objectClass: olcModuleList
|
|
cn: module
|
|
olcModulepath: /usr/lib/openldap
|
|
olcModuleload: back_mdb.so
|
|
|
|
dn: cn=schema,cn=config
|
|
objectClass: olcSchemaConfig
|
|
cn: schema
|
|
|
|
include: file:///etc/openldap/schema/core.ldif
|
|
include: file:///etc/openldap/schema/cosine.ldif
|
|
include: file:///etc/openldap/schema/inetorgperson.ldif
|
|
include: file:///etc/openldap/schema/nis.ldif
|
|
|
|
dn: olcDatabase={-1}frontend,cn=config
|
|
objectClass: olcDatabaseConfig
|
|
objectClass: olcFrontendConfig
|
|
olcDatabase: {-1}frontend
|
|
olcPasswordHash: {SSHA}
|
|
|
|
dn: olcDatabase={0}config,cn=config
|
|
objectClass: olcDatabaseConfig
|
|
olcDatabase: {0}config
|
|
olcAccess: {0}to * by * none
|
|
|
|
dn: olcDatabase={1}mdb,cn=config
|
|
objectClass: olcDatabaseConfig
|
|
objectClass: olcMdbConfig
|
|
olcDatabase: {1}mdb
|
|
olcSuffix: dc=ungleich,dc=ch
|
|
olcRootDN: cn=admin,dc=ungleich,dc=ch
|
|
olcRootPW: @ADMIN_PW_HASH@
|
|
olcDbDirectory: /var/lib/openldap/openldap-data
|
|
olcDbMaxSize: 1073741824
|
|
olcDbIndex: objectClass eq
|
|
olcDbIndex: uid eq
|
|
olcDbIndex: uidNumber eq
|
|
olcDbIndex: mail eq
|
|
olcAccess: {0}to attrs=userPassword
|
|
by self write
|
|
by anonymous auth
|
|
by * none
|
|
olcAccess: {1}to *
|
|
by self write
|
|
by users read
|
|
by * none
|