---
# ############################################
# ## LDAP ###
# ############################################
# Developer guide for the LDAP variable tree, DN layout, attribute SPOT, and
# OIDC pairing rules:
# @see docs/contributing/design/iam/ldap.md
# Helper Variables:
# Keep in mind to mapp this variables if there is ever the possibility for the user to define them in the inventory
LDAP_DN_BASE: "{{ DOMAIN_PRIMARY.split('.') | map('regex_replace', '^(.*)$', 'dc=\\1') | join(',') }}"
_ldap_docker_network_enabled: "{{ lookup('config','svc-db-openldap', 'services.openldap.network.compose') }}"
_ldap_protocol: "{{ 'ldap' if _ldap_docker_network_enabled else 'ldaps' }}"
_ldap_server_port: "{{ lookup('config', 'svc-db-openldap', 'services.openldap.ports.local.' ~ _ldap_protocol) if _ldap_docker_network_enabled else lookup('config',
'svc-db-openldap', 'services.openldap.ports.public.' ~ _ldap_protocol) }}"
_ldap_name: "{{ lookup('config','svc-db-openldap', 'services.openldap.name') }}"
_ldap_domain: "{{ DOMAIN_PRIMARY }}" # LDAP is jsut listening to a port not to a dedicated domain, so primary domain should be sufficient
_ldap_user_id: "uid"
_ldap_filters_users_all: "(|(objectclass=inetOrgPerson))"
LDAP:
DN:
ROOT: "{{ LDAP_DN_BASE }}"
ADMINISTRATOR:
DATA: "cn={{ lookup('users', 'administrator').username }},{{ LDAP_DN_BASE }}"
CONFIGURATION: "cn={{ lookup('users', 'administrator').username }},cn=config"
OU:
USERS: "ou=users,{{ LDAP_DN_BASE }}"
GROUPS: "ou=groups,{{ LDAP_DN_BASE }}"
ROLES: "ou=roles,{{ LDAP_DN_BASE }}"
BIND_CREDENTIAL: "{{ lookup('config','svc-db-openldap', 'secrets.credentials.administrator_database_password') }}"
SERVER:
DOMAIN: "{{ _ldap_name if _ldap_docker_network_enabled else _ldap_domain }}" # Mapping for public or locale access
PORT: "{{ _ldap_server_port }}"
URI: "{{ _ldap_protocol }}://{{ _ldap_name if _ldap_docker_network_enabled else _ldap_domain }}:{{ _ldap_server_port }}"
SECURITY: "" # TLS, SSL - Leave empty for none
NETWORK:
LOCAL: "{{ _ldap_docker_network_enabled }}" # Uses the application configuration to define if local network should be available or not
USER:
OBJECTS:
STRUCTURAL:
- person # Structural Classes define the core identity of an entry:
- inetOrgPerson # An extension of person adding internet-related attributes
- posixAccount # Provides UNIX account attributes (uidNumber, gidNumber,
AUXILIARY:
NEXTCLOUD_USER: "nextcloudUser" # Auxiliary Classes attach optional attributes without
SSH_PUBLIC_KEY: "ldapPublicKey" # Allows storing SSH public keys for services like Gitea.
ATTRIBUTES:
ID: "{{ _ldap_user_id }}"
MAIL: "mail"
FULLNAME: "cn"
FIRSTNAME: "givenName"
SURNAME: "sn"
SSH_PUBLIC_KEY: "sshPublicKey"
NEXTCLOUD_QUOTA: "nextcloudQuota"
FILTERS:
USERS:
LOGIN: "(&{{ _ldap_filters_users_all }}({{_ldap_user_id}}=%{{_ldap_user_id}}))"
ALL: "{{ _ldap_filters_users_all }}"
RBAC:
FLAVORS:
- groupOfNames
EMPTY_MEMBER_DN: "cn=__empty__,{{ LDAP.DN.ROOT }}"
