---
- name: 🔍 Query data backend DN (cn=config)
ansible.builtin.shell: >
container exec {{ OPENLDAP_CONTAINER_ADDRESS }}
ldapsearch -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }} -LLL -b cn=config "(olcDatabase=*)" dn
register: ldap_databases
delegate_to: "{{ STACK_HOST }}"
run_once: true
changed_when: false
retries: 30
delay: 5
until: ldap_databases.rc == 0
- name: 🤔 Determine data backend DN (prefer mdb, fallback hdb)
ansible.builtin.set_fact:
openldap_data_backend_dn: >-
{{
(
ldap_databases.stdout_lines
| select('search', '^dn: olcDatabase=.*mdb,cn=config$')
| map('regex_replace', '^dn: ', '')
| list
| first
| default('')
)
| default(
(
ldap_databases.stdout_lines
| select('search', '^dn: olcDatabase=.*hdb,cn=config$')
| map('regex_replace', '^dn: ', '')
| list
| first
| default('')
)
)
}}
- name: 🛑 Fail if backend DN could not be detected
ansible.builtin.fail:
msg: "Could not detect OpenLDAP data backend DN from cn=config."
when: openldap_data_backend_dn | default('') | length == 0
- name: ⚙️ Generate hash for desired RootPW
ansible.builtin.shell: >
container exec -e OPENLDAP_BIND_PW {{ OPENLDAP_CONTAINER_ADDRESS }}
sh -c 'exec slappasswd -s "$OPENLDAP_BIND_PW"'
environment:
OPENLDAP_BIND_PW: "{{ OPENLDAP_BIND_PW }}"
register: openldap_rootpw_hash
delegate_to: "{{ STACK_HOST }}"
run_once: true
changed_when: false
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
retries: 30
delay: 5
until: openldap_rootpw_hash.rc == 0
- name: 🔧 Set RootDN and RootPW only if bind check failed
ansible.builtin.shell: |
container exec -i {{ OPENLDAP_CONTAINER_ADDRESS }} ldapmodify -Q -Y EXTERNAL -H {{ OPENLDAP_CONFIG_URI }} <<EOF
dn: {{ openldap_data_backend_dn }}
changetype: modify
replace: olcRootDN
olcRootDN: {{ OPENLDAP_BIND_DN }}
-
replace: olcRootPW
olcRootPW: {{ openldap_rootpw_hash.stdout }}
EOF
register: openldap_rootdn_set
delegate_to: "{{ STACK_HOST }}"
run_once: true
changed_when: true
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
retries: 30
delay: 5
until: openldap_rootdn_set.rc == 0
