Merge branch 'eduardosan-stable' into hotfix-1.2.5
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e0c2a69..e37da0f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,13 @@
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
+## [1.2.5] - Unreleased
+## Added
+ - Support for docker secrets #325. Thanks to @anagno !
+
+### Fixed
+ - Fix of incorrectly positioned 'log-helper debug' command #327. Thanks to @turcan !
+
## [1.2.4] - 2019-03-14
### Fixed
- Excessive RAM usage on 1.2.2, increased 10x from 1.2.1 #242
diff --git a/Makefile b/Makefile
index 340ca13..a4ff102 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
NAME = osixia/openldap
-VERSION = 1.2.4
+VERSION = 1.2.5-dev
.PHONY: build build-nocache test tag-latest push push-latest release git-tag-version
diff --git a/README.md b/README.md
index db27128..71b7afb 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
-Latest release: 1.2.4 - OpenLDAP 2.4.47 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/)
+Latest release: 1.2.5-dev - OpenLDAP 2.4.47 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/)
**A docker image to run OpenLDAP.**
@@ -35,9 +35,10 @@
- [Set your own environment variables](#set-your-own-environment-variables)
- [Use command line argument](#use-command-line-argument)
- [Link environment file](#link-environment-file)
+ - [Docker Secrets](#docker-secrets)
- [Make your own image or extend this image](#make-your-own-image-or-extend-this-image)
- [Advanced User Guide](#advanced-user-guide)
- - [Extend osixia/openldap:1.2.4 image](#extend-osixiaopenldap124-image)
+ - [Extend osixia/openldap:1.2.5-dev image](#extend-osixiaopenldap125-dev-image)
- [Make your own openldap image](#make-your-own-openldap-image)
- [Tests](#tests)
- [Kubernetes](#kubernetes)
@@ -57,11 +58,11 @@
## Quick Start
Run OpenLDAP docker image:
- docker run --name my-openldap-container --detach osixia/openldap:1.2.4
+ docker run --name my-openldap-container --detach osixia/openldap:1.2.5-dev
Do not forget to add the port mapping for both port 389 and 636 if you wish to access the ldap server from another machine.
- docker run -p 389:389 -p 636:636 --name my-openldap-container --detach osixia/openldap:1.2.4
+ docker run -p 389:389 -p 636:636 --name my-openldap-container --detach osixia/openldap:1.2.5-dev
Either command starts a new container with OpenLDAP running inside. Let's make the first search in our LDAP container:
@@ -97,7 +98,7 @@
By default the admin has the password **admin**. All those default settings can be changed at the docker command line, for example:
docker run --env LDAP_ORGANISATION="My Company" --env LDAP_DOMAIN="my-company.com" \
- --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.4
+ --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.5-dev
#### Data persistence
@@ -148,12 +149,12 @@
# single file example:
docker run \
--volume ./bootstrap.ldif:/container/service/slapd/assets/config/bootstrap/ldif/50-bootstrap.ldif \
- osixia/openldap:1.2.4 --copy-service
+ osixia/openldap:1.2.5-dev --copy-service
#directory example:
docker run \
--volume ./ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom \
- osixia/openldap:1.2.4 --copy-service
+ osixia/openldap:1.2.5-dev --copy-service
### Use an existing ldap database
@@ -164,7 +165,7 @@
docker run --volume /data/slapd/database:/var/lib/ldap \
--volume /data/slapd/config:/etc/ldap/slapd.d \
- --detach osixia/openldap:1.2.4
+ --detach osixia/openldap:1.2.5-dev
You can also use data volume containers. Please refer to:
> [https://docs.docker.com/engine/tutorials/dockervolumes/](https://docs.docker.com/engine/tutorials/dockervolumes/)
@@ -184,7 +185,7 @@
#### Use auto-generated certificate
By default, TLS is already configured and enabled, certificate is created using container hostname (it can be set by docker run --hostname option eg: ldap.example.org).
- docker run --hostname ldap.my-company.com --detach osixia/openldap:1.2.4
+ docker run --hostname ldap.my-company.com --detach osixia/openldap:1.2.5-dev
#### Use your own certificate
@@ -194,24 +195,24 @@
--env LDAP_TLS_CRT_FILENAME=my-ldap.crt \
--env LDAP_TLS_KEY_FILENAME=my-ldap.key \
--env LDAP_TLS_CA_CRT_FILENAME=the-ca.crt \
- --detach osixia/openldap:1.2.4
+ --detach osixia/openldap:1.2.5-dev
Other solutions are available please refer to the [Advanced User Guide](#advanced-user-guide)
#### Disable TLS
Add --env LDAP_TLS=false to the run command:
- docker run --env LDAP_TLS=false --detach osixia/openldap:1.2.4
+ docker run --env LDAP_TLS=false --detach osixia/openldap:1.2.5-dev
### Multi master replication
Quick example, with the default config.
#Create the first ldap server, save the container id in LDAP_CID and get its IP:
- LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.4)
+ LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.5-dev)
LDAP_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP_CID)
#Create the second ldap server, save the container id in LDAP2_CID and get its IP:
- LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.4)
+ LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.5-dev)
LDAP2_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP2_CID)
#Add the pair "ip hostname" to /etc/hosts on each containers,
@@ -247,7 +248,7 @@
To fix that run the container with `--copy-service` argument :
- docker run [your options] osixia/openldap:1.2.4 --copy-service
+ docker run [your options] osixia/openldap:1.2.5-dev --copy-service
### Debug
@@ -256,11 +257,11 @@
Example command to run the container in `debug` mode:
- docker run --detach osixia/openldap:1.2.4 --loglevel debug
+ docker run --detach osixia/openldap:1.2.5-dev --loglevel debug
See all command line options:
- docker run osixia/openldap:1.2.4 --help
+ docker run osixia/openldap:1.2.5-dev --help
## Environment Variables
@@ -326,7 +327,7 @@
If you want to set this variable at docker run command add the tag `#PYTHON2BASH:` and convert the yaml in python:
- docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.2.4
+ docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.2.5-dev
To convert yaml to python online: http://yaml-online-parser.appspot.com/
@@ -346,7 +347,7 @@
Environment variables can be set by adding the --env argument in the command line, for example:
docker run --env LDAP_ORGANISATION="My company" --env LDAP_DOMAIN="my-company.com" \
- --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.4
+ --env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.5-dev
Be aware that environment variable added in command line will be available at any time
in the container. In this example if someone manage to open a terminal in this container
@@ -357,14 +358,25 @@
For example if your environment files **my-env.yaml** and **my-env.startup.yaml** are in /data/ldap/environment
docker run --volume /data/ldap/environment:/container/environment/01-custom \
- --detach osixia/openldap:1.2.4
+ --detach osixia/openldap:1.2.5-dev
Take care to link your environment files folder to `/container/environment/XX-somedir` (with XX < 99 so they will be processed before default environment files) and not directly to `/container/environment` because this directory contains predefined baseimage environment files to fix container environment (INITRD, LANG, LANGUAGE and LC_CTYPE).
Note: the container will try to delete the **\*.startup.yaml** file after the end of startup files so the file will also be deleted on the docker host. To prevent that : use --volume /data/ldap/environment:/container/environment/01-custom**:ro** or set all variables in **\*.yaml** file and don't use **\*.startup.yaml**:
docker run --volume /data/ldap/environment/my-env.yaml:/container/environment/01-custom/env.yaml \
- --detach osixia/openldap:1.2.4
+ --detach osixia/openldap:1.2.5-dev
+
+#### Docker Secrets
+
+As an alternative to passing sensitive information via environmental variables, _FILE may be appended to the listed variables, causing
+the startup.sh script to load the values for those values from files presented in the container. This is particular usefull for loading
+passwords using the [Docker secrets](https://docs.docker.com/engine/swarm/secrets/) mechanism. For example:
+
+ docker run --env LDAP_ORGANISATION="My company" --env LDAP_DOMAIN="my-company.com" \
+ --env LDAP_ADMIN_PASSWORD_FILE=/run/secrets/authentication_admin_pw --detach osixia/openldap:1.2.4
+
+Currently this is only supported for LDAP_ADMIN_PASSWORD, LDAP_CONFIG_PASSWORD, LDAP_READONLY_USER_PASSWORD
#### Make your own image or extend this image
@@ -372,13 +384,13 @@
## Advanced User Guide
-### Extend osixia/openldap:1.2.4 image
+### Extend osixia/openldap:1.2.5-dev image
If you need to add your custom TLS certificate, bootstrap config or environment files the easiest way is to extends this image.
Dockerfile example:
- FROM osixia/openldap:1.2.4
+ FROM osixia/openldap:1.2.5-dev
MAINTAINER Your Name <your@name.com>
ADD bootstrap /container/service/slapd/assets/config/bootstrap
diff --git a/example/docker-compose.yml b/example/docker-compose.yml
index ba646e7..9008b55 100644
--- a/example/docker-compose.yml
+++ b/example/docker-compose.yml
@@ -1,7 +1,7 @@
version: '2'
services:
openldap:
- image: osixia/openldap:1.2.4
+ image: osixia/openldap:1.2.5-dev
container_name: openldap
environment:
LDAP_LOG_LEVEL: "256"
diff --git a/example/extend-osixia-openldap/Dockerfile b/example/extend-osixia-openldap/Dockerfile
index 645a8f7..7d08ae6 100644
--- a/example/extend-osixia-openldap/Dockerfile
+++ b/example/extend-osixia-openldap/Dockerfile
@@ -1,4 +1,4 @@
-FROM osixia/openldap:1.2.4
+FROM osixia/openldap:1.2.5-dev
MAINTAINER Your Name <your@name.com>
ADD bootstrap /container/service/slapd/assets/config/bootstrap
diff --git a/example/kubernetes/simple/ldap-deployment.yaml b/example/kubernetes/simple/ldap-deployment.yaml
index 116735e..6405288 100644
--- a/example/kubernetes/simple/ldap-deployment.yaml
+++ b/example/kubernetes/simple/ldap-deployment.yaml
@@ -13,7 +13,7 @@
spec:
containers:
- name: ldap
- image: osixia/openldap:1.2.4
+ image: osixia/openldap:1.2.5-dev
volumeMounts:
- name: ldap-data
mountPath: /var/lib/ldap
diff --git a/example/kubernetes/using-secrets/gce-statefullset.yaml b/example/kubernetes/using-secrets/gce-statefullset.yaml
index 78e43c4..51c66d6 100644
--- a/example/kubernetes/using-secrets/gce-statefullset.yaml
+++ b/example/kubernetes/using-secrets/gce-statefullset.yaml
@@ -12,7 +12,7 @@
spec:
containers:
- name: azaldap
- image: osixia/openldap:1.2.4
+ image: osixia/openldap:1.2.5-dev
imagePullPolicy: IfNotPresent
#command: ["/bin/bash","-c","while [ 1 = 1 ] ; do sleep 1; date; done"]
ports:
diff --git a/example/kubernetes/using-secrets/ldap-deployment.yaml b/example/kubernetes/using-secrets/ldap-deployment.yaml
index 9783b95..8fb58c8 100644
--- a/example/kubernetes/using-secrets/ldap-deployment.yaml
+++ b/example/kubernetes/using-secrets/ldap-deployment.yaml
@@ -13,7 +13,7 @@
spec:
containers:
- name: ldap
- image: osixia/openldap:1.2.4
+ image: osixia/openldap:1.2.5-dev
args: ["--copy-service"]
volumeMounts:
- name: ldap-data
diff --git a/image/service/slapd/startup.sh b/image/service/slapd/startup.sh
index ea255f2..9fde470 100755
--- a/image/service/slapd/startup.sh
+++ b/image/service/slapd/startup.sh
@@ -10,6 +10,34 @@
# see https://github.com/docker/docker/issues/8231
ulimit -n $LDAP_NOFILE
+
+# usage: file_env VAR
+# ie: file_env 'XYZ_DB_PASSWORD'
+# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of
+# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature)
+file_env() {
+ local var="$1"
+ local fileVar="${var}_FILE"
+
+ # The variables are already defined from the docker-light-baseimage
+ # So if the _FILE variable is available we ovewrite them
+ if [ "${!fileVar:-}" ]; then
+ log-helper trace "${fileVar} was defined"
+
+ val="$(< "${!fileVar}")"
+ log-helper debug "${var} was repalced with the contents of ${fileVar} (the value was: ${val})"
+
+ export "$var"="$val"
+ fi
+
+ unset "$fileVar"
+}
+
+
+file_env 'LDAP_ADMIN_PASSWORD'
+file_env 'LDAP_CONFIG_PASSWORD'
+file_env 'LDAP_READONLY_USER_PASSWORD'
+
# create dir if they not already exists
[ -d /var/lib/ldap ] || mkdir -p /var/lib/ldap
[ -d /etc/ldap/slapd.d ] || mkdir -p /etc/ldap/slapd.d
@@ -67,6 +95,7 @@
function ldap_add_or_modify (){
local LDIF_FILE=$1
+
log-helper debug "Processing file ${LDIF_FILE}"
sed -i "s|{{ LDAP_BASE_DN }}|${LDAP_BASE_DN}|g" $LDIF_FILE
sed -i "s|{{ LDAP_BACKEND }}|${LDAP_BACKEND}|g" $LDIF_FILE
@@ -76,9 +105,9 @@
sed -i "s|{{ LDAP_READONLY_USER_PASSWORD_ENCRYPTED }}|${LDAP_READONLY_USER_PASSWORD_ENCRYPTED}|g" $LDIF_FILE
fi
if grep -iq changetype $LDIF_FILE ; then
- ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f $LDIF_FILE 2>&1 | log-helper debug || ldapmodify -h localhost -p 389 -D cn=admin,$LDAP_BASE_DN -w "$LDAP_ADMIN_PASSWORD" -f $LDIF_FILE 2>&1 | log-helper debug
+ ( ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f $LDIF_FILE 2>&1 || ldapmodify -h localhost -p 389 -D cn=admin,$LDAP_BASE_DN -w "$LDAP_ADMIN_PASSWORD" -f $LDIF_FILE 2>&1 ) | log-helper debug
else
- ldapadd -Y EXTERNAL -Q -H ldapi:/// -f $LDIF_FILE |& log-helper debug || ldapadd -h localhost -p 389 -D cn=admin,$LDAP_BASE_DN -w "$LDAP_ADMIN_PASSWORD" -f $LDIF_FILE 2>&1 | log-helper debug
+ ( ldapadd -Y EXTERNAL -Q -H ldapi:/// -f $LDIF_FILE 2>&1 || ldapadd -h localhost -p 389 -D cn=admin,$LDAP_BASE_DN -w "$LDAP_ADMIN_PASSWORD" -f $LDIF_FILE 2>&1 ) | log-helper debug
fi
}
diff --git a/test/test.bats b/test/test.bats
index cf1073b..6640aa6 100644
--- a/test/test.bats
+++ b/test/test.bats
@@ -38,6 +38,21 @@
}
+@test "ldapsearch database with password provided from file" {
+
+ rm $PWD/password.txt && touch $PWD/password.txt
+ echo "strongPassword" >> $PWD/password.txt
+
+ run_image -h ldap.osixia.net -e LDAP_ADMIN_PASSWORD_FILE=/run/secrets/admin_pw.txt --volume $PWD/password.txt:/run/secrets/admin_pw.txt
+ wait_process slapd
+ run docker exec $CONTAINER_ID ldapsearch -x -h ldap.osixia.net -b dc=example,dc=org -ZZ -D "cn=admin,dc=example,dc=org" -w strongPassword
+ clear_container
+ rm $PWD/password.txt
+
+ [ "$status" -eq 0 ]
+}
+
+
@test "ldapsearch new database with strict TLS" {
run_image -h ldap.example.org
