osixia/docker-openldap

OpenLDAP container image 🐳🌴

docker-openldap's Issues

Docker VOLUME is not needed to be able to stop a container without losing data

In README.md, I can read:

The directories /var/lib/ldap (LDAP database files) and /etc/ldap/slapd.d (LDAP config files) has been declared as volumes, so your ldap files are saved outside the container in data volumes.

This mean that you can stop, and restart the container and get back your ldap without losing any data.

From https://docs.docker.com/reference/builder/#volume, I learn that having a folder declared as a volume just means that Docker will create a mount point for it. Therefore, it won't be part of any of my container's layers.

It will also persist through a stop-start cycle, but so will other data:

> docker run -ti debian:jessie /bin/bash
root@c1e0e7fecb8c:/# echo Hello World > myfile
root@c1e0e7fecb8c:/# exit
> docker ps -a
CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                     PORTS               NAMES
c1e0e7fecb8c        debian:jessie       "/bin/bash"         25 seconds ago      Exited (0) 3 seconds ago                       clever_engelbart    
> docker start clever_engelbart
clever_engelbart
> docker attach clever_engelbart
root@c1e0e7fecb8c:/# 
root@c1e0e7fecb8c:/# cat myfile 
Hello World

OpenLdap container won't start when dhparam.pem is missing in bound volume

Docker output:

Creating docker_openldap_1...
Attaching to docker_openldap_1
openldap_1 | Execute /container/tool/py_tool/my_init --single-process
openldap_1 | *** Running /etc/my_init.d/slapd...
openldap_1 | Files /container/service/slapd/assets/ssl/ldap.foobar.com.crt.pem and /container/service/slapd/assets/ssl/ldap.foobar.com.key.pem already exists
openldap_1 | /etc/my_init.d/slapd: line 50: openssl: command not found
openldap_1 | *** /etc/my_init.d/slapd failed with status 127
openldap_1 | 
docker_openldap_1 exited with code 1
Gracefully stopping... (press Ctrl+C again to force)

Sample config:

openldap:
    image: osixia/openldap
    hostname: ldap
    domainname: ldap.foobar.com
    environment:
        - LDAP_ORGANISATION=foobar
        - LDAP_DOMAIN=ldap.foobar.com
        - LDAP_ADMIN_PASSWORD=admin
        - LDAP_CONFIG_PASSWORD=config
        - USE_TLS=true
        - SSL_CRT_FILENAME=ldap.foobar.com.crt.pem
        - SSL_KEY_FILENAME=ldap.foobar.com.key.pem
        - SSL_CA_CRT_FILENAME=ca_foobar.com.crt.pem
    ports:
        - "389:389"
        - "636:636"
    volumes:
        - /data/slapd/database:/var/lib/ldap
        - /data/slapd/config:/etc/ldap/slapd.d
        - /data/slapd/ssl:/osixia/slapd/ssl
        - /data/slapd/ssl:/container/service/slapd/assets/ssl

I see that you check for openssl in https://github.com/osixia/docker-light-baseimage/blob/stable/image/service-available/ssl-helper/assets/tool/ssl-helper.sh

  # OPENSSL
  if [ "$USE_OPENSSL" = true ] ; then
    echo "-> Using openssl"

Perhaps similar check is needed in https://github.com/osixia/docker-openldap/blob/stable/image/service/slapd/container-start.sh

    ### check for openssl ###

    # create DHParamFile if not found
    [ -f /container/service/slapd/assets/ssl/dhparam.pem ] || openssl dhparam -out /container/service/slapd/assets/ssl/dhparam.pem 2048

P.S. thanks for this very useful container!

Permission error (docker-compose)

If I try to mount volume i will have error.

docker-compose.yml

ldap:
  image: osixia/openldap:1.0.8
  volumes:
    - ./.ldap/var/lib/ldap:/var/lib/ldap
    - ./.ldap/etc/ldap/slapd.d:/etc/ldap/slapd.d
  ports:
    - "389:389"

Error:

Execute /container/tool/my_init --skip-runit bash /etc/service/slapd/run
| *** Running /etc/my_init.d/slapd...
| Starting openldap...
| *** /etc/my_init.d/slapd failed with status 1
|
| *** Killing all processes...
ldap exited with code 1

Env:

OS X El Capitan 10.11
docker-machine version 0.5.2 ( 0456b9f )
docker-compose version 1.5.2, build 7240ff3
Docker version 1.9.1, build a34a1d5
VirtualBox 5.0.0.10

more info

a) There are lots of info about this issue google->"docker data volume permissions"
b) For MySql I fixed it by running mysqld from root user (in my.cnf)
FROM mysql:latest
RUN sed -i 's/user.=./user=root/' /etc/mysql/my.cnf
c) For php-fpm by added "RUN usermod -u 1000 www-data".

MemberOf doesn't work.

Hi everyone,
I've started to configure LDAP server with MemberOf Attributes but is not working.
I initialize my LDAP server with this LDIF file :

# Entry 6: ou=people,dc=exemple,dc=org
dn: ou=people,dc=exemple,dc=org
objectclass: organizationalUnit
objectclass: top
ou: people

# Entry 7: cn=Brice Broussolle,ou=people,dc=exemple,dc=org
dn: cn=Brice Broussolle,ou=people,dc=exemple,dc=org
cn: Brice Broussolle
displayname: Brice Broussolle
givenname: Brice
mail: [email protected]
objectclass: inetOrgPerson
objectclass: top
objectclass: person
sn: Broussolle
uid: bbroussolle
userpassword: {MD5}R3+Ui19AtM/5OGv6haBhkA==

# Entry 8: cn=Christophe Robert,ou=people,dc=exemple,dc=org
dn: cn=Christophe Robert,ou=people,dc=exemple,dc=org
cn: Christophe Robert
displayname: Christophe Robert
givenname: Christophe
mail: [email protected]
objectclass: inetOrgPerson
objectclass: top
objectclass: person
sn: Robert
uid: cRobert
userpassword: {MD5}R3+Ui19AtM/5OGv6haBhkA==

# Entry 3: ou=groups,dc=exemple,dc=org
dn: ou=groups,dc=exemple,dc=org
objectclass: organizationalUnit
objectclass: top
ou: groups

# Entry 4: cn=Application Admins,ou=groups,dc=exemple,dc=org
dn: cn=Application Admins,ou=groups,dc=exemple,dc=org
cn: Application Admins
objectclass: groupOfNames
objectclass: top
member: cn=Brice Broussolle,ou=people,dc=exemple,dc=org

# Entry 5: cn=Application Users,ou=groups,dc=exemple,dc=org
dn: cn=Application Users,ou=groups,dc=exemple,dc=org
cn: Application Users
objectclass: groupOfNames
objectclass: top
member: cn=Brice Broussolle,ou=people,dc=exemple,dc=org
member: cn=Christophe Campan,ou=people,dc=exemple,dc=org

After that, when I search for users, the "MemberOf" attribute never appeared.

Anyone could me to explain where i've made a mistake or what is happening.

Thank you all.

Can't setup TLS

** ld 0x7fca188ceae0 Connections:
* host: ldap.example.com  port: 636  (default)
  refcnt: 2  status: Connected
  last used: Sat Mar 19 12:34:44 2016


** ld 0x7fca188ceae0 Outstanding Requests:
 * msgid 1,  origid 1, status InProgress
   outstanding referrals 0, parent count 0
  ld 0x7fca188ceae0 request count 1 (abandoned 0)
** ld 0x7fca188ceae0 Response Queue:
   Empty
  ld 0x7fca188ceae0 response count 0
ldap_chkResponseList ld 0x7fca188ceae0 msgid 1 all 1
ldap_chkResponseList returns ld 0x7fca188ceae0 NULL
ldap_int_select
read1msg: ld 0x7fca188ceae0 msgid 1 all 1
ber_get_next
ldap_msgfree
ldap_err2string
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
ldap_free_request (origid 1, msgid 1)

ldap config:

dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/slapd/slapd.args
olcLogLevel: none
olcPidFile: /var/run/slapd/slapd.pid
olcToolThreads: 1
structuralObjectClass: olcGlobal
entryUUID: a1412b7e-8216-1035-85f2-39058bb36102
creatorsName: cn=config
createTimestamp: 20160319120534Z
olcTLSCipherSuite: NORMAL
olcTLSProtocolMin: 3.1
olcTLSCACertificateFile: /container/service/slapd/assets/certs/ca-chain.pem
olcTLSCertificateFile:: L2NvbnRhaW5lci9zZXJ2aWNlL3NsYXBkL2Fzc2V0cy9jZXJ0cy9y
 ZWNvbWJlZV9uZXRfYnVuZGxlLmNydCA=
olcTLSCertificateKeyFile: /container/service/slapd/assets/certs/cert.key
olcTLSDHParamFile: /container/service/slapd/assets/certs/dhparam.pem
olcTLSVerifyClient: never
entryCSN: 20160319120537.432234Z#000000#000#000000
modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifyTimestamp: 20160319120537Z

When I compare this to a working instance I found a bit strange, that olcTLSCertificateFile is replaced by : L2NvbnRhaW5lci9zZXJ2aWNlL3NsYXBkL2Fzc2V0cy9jZXJ0cy9y ZWNvbWJlZV9uZXRfYnVuZGxlLmNydCA= is this valid syntax?

no permission error in container logs

Hi,
I try to run the container using

 docker run -d osixia/openldap

But got below error instead (from docker logs)

[root@docker01 ~]# docker logs naughty_nobel
Execute /container/tool/my_init --skip-runit bash /etc/service/slapd/run
*** Running /etc/my_init.d/slapd...
database and config directory are empty
-> set bootstrap config
invoke-rc.d: policy-rc.d denied execution of stop.
slappasswd: error while loading shared libraries: cannot restore segment prot after reloc: Permission denied
  Creating initial configuration... Loading the initial configuration from the ldif file () failed with
the following error while running slapadd:
    slapadd: error while loading shared libraries: cannot restore segment prot after reloc: Permission denied
*** /etc/my_init.d/slapd failed with status 1

*** Killing all processes...

Re-running container with volumes won't start

If I re run the container with exposed volumes it never starts up. In the log for the container I get this
*** Running /etc/my_init.d/slapd...
Starting openldap...
*** /etc/my_init.d/slapd failed with status 1

*** Killing all processes..

Cannot rerun with customized certificate at 1.1.1

Hi,

After moving to 1.1.1, I cannot rerun a container with my own certificate as I did on 1.1.0. I've also tried this on a newly created container (empty, with default settings) and it failed. There's no problem rerunning one with the default certificate though.

Start stop the slapd service from the image ?

Hi,

I test the connection to my ldap with :

root@e8fe2bd50c3a:~# ldapsearch -x -h localhost -b dc=comnmodel,dc=org -D "cn=admin,dc=comnmodel,dc=org" -W admin -Z

and it works.

Now i want to configure the slapd.conf with correct information, so i change info into this file, and after that i'm connect into the docker image to reload the slapd.conf. When i run a service stop on slapd, i see that the stop command doesn't stop the daemon.

Is it normal ?

TLS setup: do not chown if certificates have been not generated

Could you think about not chown-ing / fix permissions of certificates, if you did not generate them?
This could help using services like letsencrypt and others, when the certificates are shared to the host filesystem

How to configure a master multi-slave?

Here is my script:

`#!/bin/bash
LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --env LDAP_REPLICATION_HOSTS="['ldap://ldap.example.com','ldap://ldap1.example.com
', 'ldap://ldap2.example.com']" --detach osixia/openldap:1.1.2)
LDAP_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP_CID)

LDAP1_CID=$(docker run --hostname ldap1.example.org --detach osixia/openldap:1.1.2)
LDAP1_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP1_CID)

LDAP2_CID=$(docker run --hostname ldap2.example.org --detach osixia/openldap:1.1.2)
LDAP2_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP2_CID)

LDAP_CID MASTER

docker exec $LDAP_CID bash -c "echo $LDAP_IP ldap.example.org >> /etc/hosts"
docker exec $LDAP_CID bash -c "echo $LDAP1_IP ldap1.example.org >> /etc/hosts"
docker exec $LDAP_CID bash -c "echo $LDAP2_IP ldap2.example.org >> /etc/hosts"

LDAP1_CID SLAVE

docker exec $LDAP1_CID bash -c "echo $LDAP_IP ldap.example.org >> /etc/hosts"

LDAP2_CID SLAVE

docker exec $LDAP2_CID bash -c "echo $LDAP_IP ldap.example.org >> /etc/hosts"`

When I execute the following command such a mistake, I ask where the configuration is not correct?

docker exec $LDAP_CID ldapsearch -x -h ldap.example.org -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin -ZZ ldap_start_tls: Can't contact LDAP server (-1)

@ofreax @osixia
Please help me to write, thank you very much

Dockerfile ?

Hi,

I would like to use your image but I like to inspect what I'm about to use in production.

Where to find it ?

Regards,

Cyril

How to allow users in an OU bind access?

If readonly user is enabled, readonly has bind access with the following ACL applied during bootstrap:

dn: olcDatabase={1}hdb,cn=config
changetype: modify
delete: olcAccess
-
add: olcAccess
olcAccess: to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by anonymous auth by * none
olcAccess: to * by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by dn="cn={{ LDAP_READONLY_USER_USERNAME }},{{ LDAP_BASE_DN }}" read by * none

But how do I allow users within an OU bind access also? Right now when binding with a user inside an OU it returns error 32 and cannot find any objects.

 ldapsearch -H ldap://ldapserver -D "uid=testuser,ou=myou,dc=mydom,dc=tld" -W -b "dc=mydom,dc=tld"

# search result
search: 2
result: 32 No such object

Will something like this work?

dn: olcDatabase={1}hdb,cn=config
changetype: modify
delete: olcAccess
-
add: olcAccess
olcAccess: to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by anonymous auth by * none
olcAccess: to * by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by dn="cn={{ LDAP_READONLY_USER_USERNAME }},{{ LDAP_BASE_DN }}" read by dn=“ou=myou,{{ LDAP_BASE_DN }}” read by * none

Switch for enforcing TLS

In my use-case I want to force any connection to the ldap-container to use encryption. It's possible, see this hint: http://www.openldap.org/lists/openldap-technical/201212/msg00189.html

You think it's easy to add this as a new switch to this image?

ldap networking?

Hello, I am currently trying to use openldap with kaiwa-server (https://github.com/digicoop/kaiwa-server)
It uses prosody xmpp server and trying to use ldap to improve scalability (if I got it right). My problem is when I try to add user from the server using command prosodyctl it shows an error

lua5.1: /usr/lib/prosody/modules/ldap.lib.lua:217: attempt to index local 'ld' (a nil value)
stack traceback:
    /usr/lib/prosody/modules/ldap.lib.lua:217: in function </usr/lib/prosody/modules/ldap.lib.lua:211>
    (tail call): ?
    (tail call): ?
    (tail call): ?
    /usr/bin/prosodyctl:305: in function '?'
    /usr/bin/prosodyctl:1247: in main chunk
    [C]: ?

after I inspect the file /usr/lib/prosody/modules/ldap.lib.lua
ld is a connection to ldap server but it doesn't get any connection. I don't know which part is wrong whether it's my docker or the ldap server.

And another thing when I tried to figure out ldap server ip address using ifconfig inside the docker container it return unknown command :( and also no editor i could use inside it. Is this bug or meant to be like this?

Thank you and sorry for the long post :)

PS:
I create the docker container using this command:

docker run -d \
     --name ldap \
     -p 389:389 -p 636:636\
     -v /home/fendy/kaiwa-server-master:/home \
     -e LDAP_DOMAIN=localhost \
     -e LDAP_ORGANISATION=MyOrganisation \
     -e LDAP_ROOTPASS=mypassword \
     osixia/openldap

Environnement variable LDAP_CONFIG_PASSWORD don't work ?

Hi,
I run the latest docker file using these environment variable :

sudo docker run --name openLdap -v /data/slapd/database:/var/lib/ldap -v /data/slapd/config:/etc/ldap/slapd.d -e USE_TLS=false -e VIRTUAL_HOST=ldap.comnmodel.org -e  LDAP_ORGANISATION="comnmodel" -e LDAP_DOMAIN="comnmodel.org" -e LDAP_ADMIN_PASSWORD="mypassword" -e LDAP_CONFIG_PASSWORD="mypassword"  -p 389:389 -d osixia/openldap 

A simple test, without TLS, with cn=admin, it work :

ldapsearch -x -H ldap://localhost:389 -D "cn=admin,dc=comnmodel,dc=org" -W

Next, i try with cn=config, password asked are same, but that don't work :

ldapsearch -x -H ldap://localhost:389 -D "cn=config,dc=comnmodel,dc=org" -W

As you can see bottom cn=config exist in my volume /data/slapd/ , perhaps the config password is not correctly set ? I try with password = config, but also, not working

├── cn=config
│   ├── cn=module{0}.ldif
│   ├── cn=schema
│   │   ├── cn={0}core.ldif
│   │   ├── cn={10}openssh-lpk.ldif
│   │   ├── cn={11}quota.ldif
│   │   ├── cn={12}mmc.ldif
│   │   ├── cn={13}mail.ldif
│   │   ├── cn={1}cosine.ldif
│   │   ├── cn={2}nis.ldif
│   │   ├── cn={3}inetorgperson.ldif
│   │   ├── cn={4}ppolicy.ldif
│   │   ├── cn={5}dnszone.ldif
│   │   ├── cn={6}radius.ldif
│   │   ├── cn={7}samba.ldif
│   │   ├── cn={8}dhcp.ldif
│   │   └── cn={9}zarafa.ldif
│   ├── cn=schema.ldif
│   ├── olcBackend={0}hdb.ldif
│   ├── olcDatabase={0}config.ldif
│   ├── olcDatabase={-1}frontend.ldif
│   └── olcDatabase={1}hdb.ldif
├── cn=config.ldif
└── docker-openldap-was-started-with-tls

Configure master/slave specifying what parameters?

Configure master/slave specifying what parameters?

Below are the main configuration parameters, and how to specify the parameters of the master-slave start? Thank you, please help me

ldap + kerberos integration

I need to achieve ldap + kerberos integration.
Currently I'm following: https://help.ubuntu.com/lts/serverguide/kerberos-ldap.html
however I'm stuck, there seems to be missing file: /usr/share/doc/krb5-kdc-ldap/kerberos.schema.gz.

Running:

apt-get update && apt-get upgrade -yy && apt-get install -yy  krb5-kdc-ldap && ls -l /usr/share/doc/krb5-kdc-ldap/kerberos.schema.gz

Inside the container: osixia/openldap:1.1.2 there is no such file. Any idea why it is so?

however if I ran:

apt-get update && apt-get install -yy apt-file && apt-file update && apt-file list krb5-kdc-ldap

I see:

krb5-kdc-ldap: /etc/insserv/overrides/krb5-kdc
krb5-kdc-ldap: /lib/systemd/system/krb5-admin-server.service.d/slapd-before-kdc.conf
krb5-kdc-ldap: /lib/systemd/system/krb5-kdc.service.d/slapd-before-kdc.conf
krb5-kdc-ldap: /usr/lib/x86_64-linux-gnu/krb5/libkdb_ldap.so.1
krb5-kdc-ldap: /usr/lib/x86_64-linux-gnu/krb5/libkdb_ldap.so.1.0
krb5-kdc-ldap: /usr/lib/x86_64-linux-gnu/krb5/plugins/kdb/kldap.so
krb5-kdc-ldap: /usr/sbin/kdb5_ldap_util
krb5-kdc-ldap: /usr/share/doc/krb5-kdc-ldap/NEWS.Debian.gz
krb5-kdc-ldap: /usr/share/doc/krb5-kdc-ldap/changelog.Debian.gz
krb5-kdc-ldap: /usr/share/doc/krb5-kdc-ldap/copyright
krb5-kdc-ldap: /usr/share/doc/krb5-kdc-ldap/kerberos.ldif.gz
krb5-kdc-ldap: /usr/share/doc/krb5-kdc-ldap/kerberos.schema.gz
krb5-kdc-ldap: /usr/share/man/man8/kdb5_ldap_util.8.gz

moreover, if I ran the command inside the debian:jessie docker container:

   apt-get update && apt-get upgrade -yy && apt-get install -yy  krb5-kdc-ldap && ls -l /usr/share/doc/krb5-kdc-ldap/kerberos.schema.gz

I can see the file present.

Why is it so?

Repeat run image - problem

Hello,
This image work not correct if his to use again. (run -> stop/rm -> run). He again adjust Ldap Server. I had seemed this not need.

May be need to make:

• FIRST_START_DONE="/etc/ldap/slapd.d/slapd-first-start-done"
• or checking on exist file "cn=config.ldif"

Problem:
I create instance with:

• own TLS settings
• external volumes: /var/lib/ldap and /etc/ldap/slapd.d and /container/environment/01-custom
  Then I stop and remove his.

Then I create second instance (run), he:

• generate certificate again
• reset TLS settings on default

ldap_modify: error (80)

I got ldap_modify: Other (e.g., implementation specific) error (80) error during startup with godaddy certificate
I start the container by

docker run -d -v $HOME/certs:/container/service/slapd/assets/certs \
    -h ldap.mycompany.com \
    --name=ldap \
    -e LDAP_TLS_CRT_FILENAME=425ddb461b040d25.crt \
    -e LDAP_TLS_KEY_FILENAME=mycompany_com.key \
    -e LDAP_TLS_CA_CRT_FILENAME=gd_bundle-g2-g1.crt \
    -e LDAP_ORGANISATION="My Company Inc." \
    -e LDAP_DOMAIN="mycompany.com" \
    osixia/openldap:1.0.9

but it exited with status 80. Here are the logs where it fails:

Use TLS
Files /container/service/slapd/assets/certs/425ddb461b040d25.crt and /container/service/slapd/assets/certs/planetmeican_com.key already exists
ldap_modify: Other (e.g., implementation specific) error (80)
modifying entry "cn=config"

*** /etc/my_init.d/slapd failed with status 80

*** Killing all processes...

At first i tried to use a self-signed certificate generated by openssl, but it seems that this image uses gnu-tls, and they're incompatible, so it doesn't work. After that i used certificate generated by this image, that works.
but when i changed to godaddy certificate, i got this error. I even tried to replace gnutls with openssl in dockerfile and container-start.sh and rebuild the image, but got the same error

Huge log

The container seems to generate huge amount of logs!
/var/lib/docker/containers/<container_id>/<container_id>-json.log
And since docker has problems with logging / memory usage it takes it(docker) all down.
Is there a way to log to syslog rather than to stdout/stderr?

Memberof not configured on first boot

I see a LDIF file that configures the memberof overlay on first boot, but the overlay does not seem to actually be working when groups and users are created. Is this a bug or have I missed something in the configuration? I've never configured the overlay myself before so please forgive me if I am misunderstanding.

Docker Compose compilation of options

This project looks promising! I'm thinking it will work as part of another project I'm working on.

I'm suggesting the project create and commit a docker-compose.yml with image references to automated Docker Hub builds providing examples of environment variables and container name for users wishing to both deploy the pre-built images or build them locally.

Instead of providing one-off examples of docker run commands, provide your suggested "defined infrastructure" setup by way of a docker-compose.yml file.

I'm thinking something link this might be an example?

default server not listening on port 636

Not sure if this is a bug or if I'm just misunderstanding you, or misunderstanding openldap - sorry if this is noise...

I start this container like this:

$ sudo docker run -d osixia/openldap
73f55020614de923bce196d5dc02259fabd4f8c88b978db939c129cdb2b9970a

and I see this:

$ sudo docker ps
CONTAINER ID IMAGE                  COMMAND         CREATED      STATUS        PORTS                   NAMES
73f55020614d osixia/openldap:0.10.1 "/sbin/my_init" 3 seconds ago Up 2 seconds 389/tcp      prickly_albattani

Shouldn't it be listening on 636?

Update light-baseimage version to 0.2.3 in Dockerfile

Update light-baseimage version to 0.2.3 in Dockerfile as it is already available in the light-baseimage repo.

kudos!

Kudos for this image, very rarely seen an image being that well designed!

Should SSL certs be copied on load?

It's somewhat bad behavior for the container to be chown'ing certificates which are bind mounted into it and doesn't work if read-only binds are used and is worse if the certificates are symlinks (i.e. from Let's Encrypt containers).

It would be better behavior for the container to copy the certificates on boot up and then chown them.

Create a new user in example.org with objectClass user and objectCategory person

I am using osixia/openldap 1.1.2 as my ldap server. I need to add a new user entry with the following attributes-
objectClass: user
objectCategory: person

What are the steps to create this new entry?

specify base_dn without domain

I want to specify LDAP_BASE_DN without LDAP_DOMAIN.

Now, this startup script set LDAP_BASE_DN using get_ldap_base_dn(ref: https://github.com/osixia/docker-openldap/blob/stable/image/service/slapd/startup.sh#L164).

This function convert LDAP_DOMAIN to LDAP_BASE_DN. This is useful, but, I want to specify LDAP_BASE_DN and LDAP_DOMAIN separately.

I think LDAP_BASE_DN should be added in public environment values, and if the env has no value, be set converted LDAP_DOMAIN.

What about it?

Mounting volumes via docker-compose

Dear all,

I'm currently on version 1.1.2 of this awesome docker image.

Here is my problem: With docker (tested versions 1.10.0 and 1.11.0) and docker-compose (tested versions 0.6.2 and 0.7.0) I try to mount the volumes like this:

volumes:
    - /root/docker_data/openldap/ldap /var/lib/ldap
    - /root/docker_data/openldap/slapd.d /etc/ldap/slapd.d

However the directories are not created when I bring up your openldap image via docker-compose.

When I start the image via docker run like i.e.

docker run --volume /root/docker_data/openldap/ldap:/var/lib/ldap \
--volume /root/docker_data/openldap/slapd.d:/etc/ldap/slapd.d
--detach osixia/openldap:1.1.2

The volumes are created just fine in /root/docker_data/openldap/.
Any ideas what might be wrong? I did several mountings now already via docker-compose with other images, however it always worked just as expected. Not sure why with this image it would not work.

thanks!

pwdPolicy not enabled

Does ppolicy work with this? Im having trouble including an ldif that includes

objectClass: pwdPolicy

Error:
ldap_add: Invalid syntax (21)
additional info: pwdAttribute: value #0 invalid per syntax

Image does not set slapd command correctly

For whatever reason, the start command in /etc/service/slapd/run is the one that takes effect, not the ones the image build process tries to set

Restarting container with new environment

I have problem with restarting container with new environment variables. As I understand during first run, some initialization is done which is not repeated in next runs. This makes me wonder how to normally restart container with new variables like log level? Right now I have to remove container and create it again due to the fact that slapd.d config files are persisted in volume which is reused during restarts.

Beacuse config files are persisted, when I change ie log level it results in error:

openldap_1 | Start OpenLDAP...
openldap_1 | Waiting for OpenLDAP to start...
openldap_1 | 570e7088 @(#) $OpenLDAP: slapd (Jan 16 2016 23:00:08) $
openldap_1 | root@chimera:/tmp/buildd/openldap-2.4.40+dfsg/debian/build/servers/slapd
openldap_1 | 570e7088 ldif_read_file: checksum error on "/etc/ldap/slapd.d/cn=config.ldif"
openldap_1 | 570e7088 <= str2entry NULL (smr_normalize createTimestamp 21)
openldap_1 | 570e7088 slapd stopped.
openldap_1 | 570e7088 connections_destroy: nothing to destroy.

I'm running 1.1.2 version and to be clear I've never modified config files manually but added my custom ldifs to /container/service/slapd/assets/config/bootstrap/ldif

Btw, big thanks for great image!

Unable to start container with the following invocation.

docker run --name container-ldap -p 389:389 -p 636:636 -e LDAP_ORGANISATION=ORG -e LDAP_DOMAIN=ldap.REDACTED -e LDAP_ADMIN_PASSWORD=REDACTED -v /root/docker-ldap/database:/var/lib/ldap -v /root/docker-ldap/config:/etc/ldap/slapd.d -d osixia/openldap

root@ubuntu:~/docker-ldap# docker logs nixius-ldap
*** Running /etc/my_init.d/00_regen_ssh_host_keys.sh...
*** Running /etc/my_init.d/slapd...
*** /etc/my_init.d/slapd failed with status 1

*** Killing all processes...
*** Running /etc/my_init.d/00_regen_ssh_host_keys.sh...
*** Running /etc/my_init.d/slapd...
*** /etc/my_init.d/slapd failed with status 1

*** Killing all processes...

group search filters not working

I have created user entries, created entries with object class - groupOfNames, groupOfUniqueNames and added users under it.

But ldapsearch filters are not working which makes group entries futile.
For example i have,
uid=testuser,ou=allusers,dc=example,dc=com
ou=admin,ou=allusers,dc=example,dc=com - groupOfUniqueNames entry
uniqueMember - uid=testuser,ou=allusers,dc=example,dc=com

ldapsearch -D "cn=admin,dc=example,dc=com" -b "ou=admin,ou=allusers,dc=example,dc=com" uniqueMember=test

Don't disable network access from outside

Currently, the install.sh script disables network access from outside:

# Enable access only from docker default network and localhost
echo "slapd: 172.17.0.0/255.255.0.0 127.0.0.1 : ALLOW" >> /etc/hosts.allow
echo "slapd: ALL : DENY" >> /etc/hosts.allow

However, it should be up to the user if he wants to make the LDAP port publicly accessible (by executing "docker run" with "-p" or "-P") or just internally (by using container linking).

Therefore, I would suggest removing this script, or at least running it optionally on container start and not hardcoded on container build.

repetition of script

greetings,

first thanks for the work, I wanted to indicate that constant repetition slapd.sh is a problem, fills the log service starts and consumes machine.

solve the problem by placing "exec / usr / sbin / slapd -h" ldap: /// "-u openldap openldap -g -d -1" is that this in debug but not cosome more resources than necessary.

thanks and regards

Getting server-side TLS logs

Hi there,

First things first: thanks a lot for a great docker project. Saved me tons of time and really easy to use (especially with the phpldapadmin project counterpart !).

I'm struggling with connecting over ldaps from a Java client (works better with openssl s_client) and would like to get the detailed handshake trace on the ldap side. Any recommendation on how I can achieve that ? (I'm stuck at getting any log from the container itself)

Thanks a lot,
Nicolas

P.S.: my Java client is failing during handshake, server is closing the connection for some reason (any ideas are welcome)

localhost-startStop-1, received EOFException: error
localhost-startStop-1, handling exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake

LDAP_TLS=false but replication still requires TLS?

After v1.0.9, replication is failing.

I've start a new container and a new database, and passed LDAP_TLS=false on the docker run line.

ldap1 log:

56b73cf9 slap_client_connect: URI=ldap://ldap2 Error, ldap_start_tls failed (2)
56b73cf9 slap_client_connect: URI=ldap://ldap2 Error, ldap_start_tls failed (2)
56b73cf9 do_syncrepl: rid=002 rc 2 retrying
56b73cf9 do_syncrepl: rid=102 rc 2 retrying

ldap2 log:

56b73cf9 conn=1054 fd=21 ACCEPT from IP=10.2.92.201:58790 (IP=172.17.0.30:389)
56b73cf9 conn=1054 op=0 EXT oid=1.3.6.1.4.1.1466.20037
56b73cf9 conn=1054 op=0 do_extended: unsupported operation "1.3.6.1.4.1.1466.20037"
56b73cf9 conn=1054 op=0 RESULT tag=120 err=2 text=unsupported extended operation
56b73cf9 conn=1053 fd=22 ACCEPT from IP=10.2.92.201:58792 (IP=172.17.0.30:389)
56b73cf9 conn=1053 op=0 EXT oid=1.3.6.1.4.1.1466.20037
56b73cf9 conn=1053 op=0 do_extended: unsupported operation "1.3.6.1.4.1.1466.20037"
56b73cf9 conn=1053 op=0 RESULT tag=120 err=2 text=unsupported extended operation
56b73cf9 conn=1054 op=1 UNBIND
56b73cf9 conn=1054 fd=21 closed
56b73cf9 conn=1053 op=1 UNBIND
56b73cf9 conn=1053 fd=22 closed

/container/service/slapd/assets/config/replication/replication-enable.ldif:

# Add sync replication on config
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcSyncRepl
olcSyncRepl: rid=001 provider=ldap://ldap1 binddn="cn=admin,cn=config" bindmethod=simple credentials=XXXXXXXXXX searchbase="cn=config" type=refreshAndPersist retry="60 +" timeout=1 starttls=critical
olcSyncRepl: rid=002 provider=ldap://ldap2 binddn="cn=admin,cn=config" bindmethod=simple credentials=XXXXXXXXXX searchbase="cn=config" type=refreshAndPersist retry="60 +" timeout=1 starttls=critical

starting from old data

Hi there,

I am starting a container using the following docker run command.

docker run --name openldap -d --restart always -p 389:389 -v /opt/data/ldap/db:/var/lib/ldap -v /opt/data/ldap/config:/etc/ldap/slapd.d -v /opt/data/ldap/ssl/:/osixia/slapd/ssl/ -e LDAP_DOMAIN=example.com -e LDAP_ORGANISATION="example" -e SERVER_NAME="example.com" -e SSL_CRT_FILENAME=ldap.crt -e SSL_KEY_FILENAME=ldap.key -e SSL_CA_CRT_FILENAME=ca.crt osixia/openldap

This command works fine, however if I remove the container. using docker rm -f and try to the same docker run command above. The following issue occurs.

{code}
*** Killing all processes...
*** Running /etc/my_init.d/00_regen_ssh_host_keys.sh...
*** Running /etc/my_init.d/slapd...
Files /osixia/slapd/ssl/ldap.crt and /osixia/slapd/ssl/ldap.key already exists
ldap_modify: Inappropriate matching (18)
additional info: modify/add: olcTLSCipherSuite: no equality matching rule
modifying entry "cn=config"

*** /etc/my_init.d/slapd failed with status 18

*** Killing all processes...
*** Running /etc/my_init.d/00_regen_ssh_host_keys.sh...
*** Running /etc/my_init.d/slapd...
Files /osixia/slapd/ssl/ldap.crt and /osixia/slapd/ssl/ldap.key already exists
ldap_modify: Inappropriate matching (18)
additional info: modify/add: olcTLSCipherSuite: no equality matching rule
modifying entry "cn=config"
{code}

this suggest mounting out the config causes issue during the rebuild of a server using the same configuration on another server,

This seems to differ from the implementation in 0.9.1 where is was possible to simply move a server from one docker server to another as long as you had the data files.

Regards

John

slapd tcp bind is network not interface, and so does not respond on overlay networks

I am using an rancher for docker orchestration. It adds an overlay network... an alias IP on the docker network interface. http://docs.rancher.com/rancher/concepts/#networking

The issue is that the service startup binds to specific IP addresses, and is not listening on the overlay IP address

the process is started:

exec /usr/sbin/slapd -h "ldap://$HOSTNAME ldaps://$HOSTNAME ldap://localhost ldaps://localhost ldapi:///" -u openldap -g openldap -d $LDAP_LOG_LEVEL

which gives me:

root@ldap_1:/# netstat -nlp                                           
Active Internet connections (only servers)                                      
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
PID/Program name                                                                
tcp        0      0 127.0.0.1:636           0.0.0.0:*               LISTEN      
tcp        0      0 172.17.0.5:636          0.0.0.0:*               LISTEN      
tcp        0      0 127.0.0.1:389           0.0.0.0:*               LISTEN      
tcp        0      0 172.17.0.5:389          0.0.0.0:*               LISTEN      
tcp6       0      0 ::1:636                 :::*                    LISTEN      
tcp6       0      0 ::1:389                 :::*                    LISTEN      

I have the following addresses on the docker interface:

root@ldap_1:/# ip addr show dev eth0                                  
40: eth0@if41: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
 group default                                                                  
    link/ether 02:95:3f:7b:35:1c brd ff:ff:ff:ff:ff:ff                          
    inet 172.17.0.5/16 scope global eth0                                        
       valid_lft forever preferred_lft forever                                  
    inet 10.42.144.192/16 scope global eth0                                     
       valid_lft forever preferred_lft forever                                  
    inet6 fe80::95:3fff:fe7b:351c/64 scope link                                 
       valid_lft forever preferred_lft forever

The LDAP service does not respond on 10.42.144.192, but it does respond on 172.17.0.5.

TLS Issue: Could not negotiate a supported cipher suite..

When I run the latest image with:

docker pull osixia/openldap
docker run -d -p 390:389 -p 636:636 -h ldap.***.com --name="ldaps" osixia/openldap

And i try to search on the directory over LDAPS with:

ldapsearch -x -h ldap.***.com -p 390 -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin -Z

I get to following log output and TLS negotiation failure:

55ddb430 @(#) $OpenLDAP: slapd  (Apr 12 2015 14:28:03) $
    root@chimera:/tmp/buildd/openldap-2.4.40+dfsg/debian/build/servers/slapd
TLS: warning: ignoring dhfile
55ddb431 slapd starting
55ddb43a conn=1000 fd=20 ACCEPT from IP=84.253.47.226:59879 (IP=172.17.0.185:389)
55ddb43a conn=1000 op=0 EXT oid=1.3.6.1.4.1.1466.20037
55ddb43a conn=1000 op=0 STARTTLS
55ddb43a conn=1000 op=0 RESULT oid= err=0 text=
TLS: can't accept: Could not negotiate a supported cipher suite..
55ddb43a conn=1000 fd=20 closed (TLS negotiation failure)

I also tried to connect over ldaps:// with:

ldapsearch -x -H ldaps://ldap.***.com -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin

But I got the same "Could not negotiate a supported cipher suite.." exception.
Is there anything I've done wrong or is there an issue with the image?

Quick howto is wrong?

Hi,

I am testing this image right now and I found one error (maybe I am doing something wrong), but when I run ldapsearch, I get this error:

# docker exec -it openldap ldapsearch -x -h localhost -b dc=example,dc=net -D "cn=admin,dc=example,dc=net" -w admin ldap_bind: Invalid credentials (49)

But when I run it as this, it works (from host to container):
ldapsearch -x -h 172.17.0.8 -b dc=example,dc=net -D "cn=admin,dc=example,dc=net" -W admin

So I think command in howto should looks like this:
docker exec -it openldap ldapsearch -x -h localhost -b dc=example,dc=net -D "cn=admin,dc=example,dc=net" -W admin

TLS negotiation failure after disabling TLS

I am trying to connect an application with the ldap server based on image oxisia/docker-openldap 1.1.2 . My application uses SSL 3.0, and the ldap server is TLS. So it was giving me TLS Issue: Could not negotiate a supported cipher suite. However, I disabled the TLS with the steps you mentioned in #17
But now when I run my application with the server, it complains (TLS negotiation failure).

logs.txt

Kindly help

Does not work with docker-compose

This image does not work with the docker-compose tool. This is easily validated.

Install docker-compose:

curl -L https://github.com/docker/compose/releases/download/1.3.3/docker-compose-`uname -s`-`uname -m` > /usr/local/bin/docker-compose
chmod +x /usr/local/bin/docker-compose

Create a docker-compose.yml file:

ldap:
  image: osixia/openldap

Start the container with docker-compose run ldap and the logs will show that "slapd starting" was reached, but queries cannot be run against the service.

Starting the container with docker with docker run osixia/openldap works as expected.

On further investigating, this is because the FIRST_START_DONE file is never created. docker-compose seems to die at your sleep 3. I am not sure why this is the case. However, removing that line and rebuilding the container allows me to use the container as expected with docker-compose.

A pull request was not submitted since I am not sure why the sleep was originally added (ead3be2 offers no explanation).

readonly user acl can not come info effect

I can not login by user _readonly_ from phpldapadmin.

Login DN: cn=readonly,dc=example,dc=com
Password: readonly

Then I build custom image after change the file _readonly-user-acl.ldif_. Anonymous login also can not read anything

--- a/image/service/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user-acl.ldif
+++ b/image/service/slapd/assets/config/bootstrap/ldif/readonly-user/readonly-user-acl.ldif
@@ -4,4 +4,4 @@ delete: olcAccess
 -
 add: olcAccess
 olcAccess: to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by anonymous auth by * none
-olcAccess: to * by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by dn="cn={{ LDAP_READONLY_USER_USERNAME }},{{ LDAP_BASE_DN }}" read by * none
+olcAccess: to * by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by dn="cn={{ LDAP_READONLY_USER_USERNAME }},{{ LDAP_BASE_DN }}" read by * read

schema update

I am tryign to update the schema via running the following command inside the container.

ldapadd -Y EXTERNAL -H ldapi:/// -f temp/cn=config/cn=schema/cn={0}pwm.ldif -d1
{code}
output -
ldap_url_parse_ext(ldapi:///)
ldap_create
ldap_url_parse_ext(ldapi:///??base)
ldap_sasl_interactive_bind: user selected: EXTERNAL
ldap_int_sasl_bind: EXTERNAL
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_path
ldap_new_socket: 4
ldap_connect_to_path: Trying /var/run/slapd/ldapi
ldap_connect_timeout: fd: 4 tm: -1 async: 0
ldap_ndelay_on: 4
ldap_close_socket: 4
ldap_msgfree
ldap_err2string
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
{code}

This is as instructed from - From the doc /usr/share/doc/slapd/README.Debian.gz used for the apt-get install of slapd service.

I tracked this down with the help of others to the fact that the service is being started without the ldapi:/// value

{code}

ps aux | grep slapd
root 13 0.0 0.0 168 40 ? Ss 17:16 0:00 runsv slapd
openldap 22 0.0 4.8 566188 370320 ? Ssl 17:16 0:00 /usr/sbin/slapd -h ldap:/// -u openldap -g openldap
root 1640 0.0 0.0 8748 200 ? R+ 17:43 0:00 grep --color=auto slapd
{code}

further tracking down shows that the servcie is started using the following script.

https://github.com/osixia/docker-baseimage/blob/stable/image/bin/my_init

Which then triggers

https://github.com/osixia/docker-openldap/blob/stable/image/service/slapd/daemon.sh

Created a pull request for minor change
#5

Was hoping you would be willing to make this live so I can update schema of the database.
think I might need to hack the container as I am using an older image because of another ticket.

how to create Initilizations scripts

I want to run a bash script for create new entries on docker-compose build, is it possible to do ?

Performance optimisation

Force resync after 1 Container was down

Hello,

i built the Master-Master replication with this guide. Works so far.
My problem is. When i stop and restart one of the container they will not sync anymore.
I tried deploying a new container. Does not work
I tried deleting the database and deploying new container. Does not work.

in the restartet one i get errors like

56b0536d slap_client_connect: URI=ldap://ldap2.pxr.de Error, ldap_start_tls failed (52)
56b0536d do_syncrepl: rid=102 rc 52 retrying

The still running one says:

56b056e7 null_callback : error code 0x50
56b056e7 syncrepl_entry: rid=001 be_modify failed (80)
56b056e7 do_syncrepl: rid=001 rc 80 retrying
56b05700 conn=1055 fd=21 ACCEPT from IP=xx.xx.xx.xx:48892 (IP=172.17.0.2:389)
56b05700 conn=1055 op=0 EXT oid=1.3.6.1.4.1.1466.20037
56b05700 conn=1055 op=0 STARTTLS
56b05700 conn=1055 op=0 RESULT oid= err=52 text=Could not initialize TLS
56b05700 conn=1056 fd=23 ACCEPT from IP=xx.xx.xx.xx:48893 (IP=172.17.0.2:389)
56b05700 conn=1056 op=0 EXT oid=1.3.6.1.4.1.1466.20037
56b05700 conn=1056 op=0 STARTTLS
56b05700 conn=1056 op=0 RESULT oid= err=52 text=Could not initialize TLS
56b05700 conn=1055 op=1 UNBIND
56b05700 conn=1055 fd=21 closed
56b05700 conn=1056 op=1 UNBIND
56b05700 conn=1056 fd=23 close

The only way to get replication working again, is to completly delete both container and databases and start new ones.

There must be a way to get them sync again without desstroying the entire database.

I found something like. "start slapd with -c and the rid" But how do i restart the slapd process when i am in the container?

Any help would be nice.