---
# include-gated: when: OPENBAO_LDAP_ENABLED | bool
- name: "🧩 Enable the LDAP auth method"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
sh -c 'bao auth list -format=json | grep -q "ldap/" ||
{ bao auth enable -plugin-version=latest ldap && echo OPENBAO_CHANGED; }'
register: openbao_ldap_enable
changed_when: "'OPENBAO_CHANGED' in openbao_ldap_enable.stdout"
- name: "🔌 Move an LDAP mount of the removed builtin engine onto the plugin"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec {{ OPENBAO_LOCAL_CID | quote }}
sh -c '[ "$(bao read -field=plugin_version sys/auth/ldap)" = latest ] ||
{ bao auth tune -plugin-version=latest ldap/ &&
bao plugin reload -mounts=auth/ldap/ &&
echo OPENBAO_CHANGED; }'
register: openbao_ldap_plugin
changed_when: "'OPENBAO_CHANGED' in openbao_ldap_plugin.stdout"
- name: "📇 Point the LDAP method at the directory"
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
container exec -i {{ OPENBAO_LOCAL_CID | quote }}
bao write auth/ldap/config
url={{ OPENBAO_LDAP_URL | quote }}
userdn={{ LDAP.DN.OU.USERS | quote }}
userattr={{ OPENBAO_LDAP_USER_ATTR | quote }}
username_as_alias=true
groupdn={{ LDAP.DN.OU.ROLES | quote }}
groupattr=cn
binddn={{ LDAP.DN.ADMINISTRATOR.DATA | quote }}
bindpass=-
insecure_tls=false
starttls=false
args:
stdin: "{{ LDAP.BIND_CREDENTIAL }}"
stdin_add_newline: false
changed_when: false
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
