openssh_lpk.yml

---
- name: ✅ Ensure OpenSSH-LPK schema via ldapsm
  vars:
    schema_name: "openssh-lpk"
    attribute_defs:
      - "( 1.3.6.1.4.1.24552.1.1 NAME '{{ LDAP.USER.ATTRIBUTES.SSH_PUBLIC_KEY }}' DESC 'OpenSSH Public Key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
        )"
      - "( 1.3.6.1.4.1.24552.1.2 NAME 'sshFingerprint' DESC 'OpenSSH Public Key Fingerprint' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )"
    objectclass_defs:
      - >-
        ( 1.3.6.1.4.1.24552.2.1
          NAME '{{ LDAP.USER.OBJECTS.AUXILIARY.SSH_PUBLIC_KEY }}'
          DESC 'Auxiliary class for OpenSSH public keys'
          SUP top
          AUXILIARY
          MAY ( {{ LDAP.USER.ATTRIBUTES.SSH_PUBLIC_KEY }} $ sshFingerprint ) )
  command:
    cmd: >
      {{ OPENLDAP_LDAPSM_COMMAND }}
        -s {{ OPENLDAP_SERVER_URI }}
        -D '{{ OPENLDAP_BIND_DN }}'
        -n {{ schema_name }}
        {% for at in attribute_defs %}
        -a "{{ at }}"
        {% endfor %}
        {% for oc in objectclass_defs %}
        -c "{{ oc }}"
        {% endfor %}
    stdin: "{{ OPENLDAP_BIND_PW }}"
  register: opensshlpk_ldapsm
  changed_when: "'Created schema entry' in opensshlpk_ldapsm.stdout"
  check_mode: false

- name: 👁️ Show ldapsm output for openssh-lpk
  debug:
    var: opensshlpk_ldapsm.stdout_lines