LDAP_DOMAIN and LDAP_BASE_DN discrepancy

[dolanor]

Hello,
Running containers from scratch with 2 settings would result in different results.

• LDAP_DOMAIN=domain.com would create cn=admin,dc=domain,dc=com
• LDAP_BASE_DN=dc=domain,dc=com would create cn=admin,dc=example,dc=org

It seems if we set the LDAP_BASE_DN ourselves, it doesn't generate the LDAP base correctly.
I tried to investigate and the max I could see is that on that step in startup script the 02-security.ldif is well provisioned with the good LDAP_BASE_DN value. So I don't know what make the system create the default example.org admin account, but it must be around there…

[BertrandGouny]

Interesting, maybe related to #161

[dolanor]

Yes, I forgot about this.
Maybe if we create a full admin of the LDAP, maybe we don't need a per org admin. This stone would kill 2 birds :).

Anyway, thanks for that image. It's this one who made me dive into LDAP as I'm trying to have 1 LDAP to kill them all (identification system).

[anthony-o]

Like said here, in order for LDAP_BASE_DN to work, I must do the following.

If I use the following compose-file:

version: '2'
services:
  my-ldap:
    image: osixia/openldap:1.2.4
    volumes:
      - ./ldap/custom:/container/service/slapd/assets/config/bootstrap/ldif/custom:ro
    command: --loglevel trace --copy-service
    environment:
      - LDAP_ORGANISATION=gouv
      - LDAP_DOMAIN=gouv.fr
      - LDAP_BASE_DN=ou=myou,o=gouv,c=fr
      #- LDAP_LOG_LEVEL=32 # http://www.openldap.org/doc/admin24/slapdconf2.html#olcLogLevel:%20%3Clevel%3E
    ports:
      - 8389:389
      - 8636:636

then I must write those 2 files into ./ldap/custom folder:

• 01-olcRootDN.ldif

dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: ou=myou,o=gouv,c=fr
-
replace: olcRootDN
olcRootDN: cn=admin,ou=myou,o=gouv,c=fr

• 02-createRootDN.ldif

dn: ou=myou,o=gouv,c=fr
changetype: add
objectClass: organizationalUnit
ou: myou

[j-maas]

Just to have all options in one place, I also commented on a similar issue where snapd is configured to set the domain. #307 (comment)

Basically, this line makes snapd derive the base dn from the domain, and I couldn't find a way to tell slapd to create a base dn that is different from the domain.