crans
/
ansible
mirror of http://gitlab.adm.crans.org/nounous/ansible.git
19
0
Fork 0
Code Issues Projects Releases Wiki Activity

[slapd] DNS integration

certbot_on_virtu
_shirenn 2022-01-15 17:48:20 +01:00 committed by pa
parent 7eb6cc52e8
commit 257d233499
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
roles/slapd/templates/ldap/slapd.conf.j2
View File

@ -35,6 +35,8 @@ constraint_attribute description regex {{ slapd.regex }}
restrict=ldap:///ou=hosts,dc=crans,dc=org??one?(objectClass=device) restrict=ldap:///ou=hosts,dc=crans,dc=org??one?(objectClass=device)
constraint_attribute uid regex ^_ constraint_attribute uid regex ^_
restrict=ldap:///ou=passwd,dc=crans,dc=org??one?(objectClass=posixAccount) restrict=ldap:///ou=passwd,dc=crans,dc=org??one?(objectClass=posixAccount)
constraint_attribute description regex ^.*(\ IN)?\ (TXT|DNAME|AAAA|CNAME)\ .*$
restrict=ldap:///ou=dns,dc=crans,dc=org??sub?(objectClass=dNSDomain)
moduleload syncprov moduleload syncprov
{% endif %} {% endif %}
@ -136,6 +138,12 @@ access to attrs=userPassword,shadowLastChange
by anonymous auth by anonymous auth
by * none by * none
access to attrs=loginShell,mail,telephoneNumber
by self write
by set="[cn=_nounou,ou=group,dc=crans,dc=org]/memberUid & user/uid" write
by dn="cn=replicator,dc=crans,dc=org" read
by * read
# Ensure read access to the base for things like # Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may # supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what # have problems with SASL not knowing what
@ -166,6 +174,12 @@ access to attrs=userPassword,shadowLastChange
by dn="cn=replicator,dc=crans,dc=org" read by dn="cn=replicator,dc=crans,dc=org" read
by * none by * none
access to attrs=loginShell,mail,telephoneNumber
by self write
by set="[cn=_nounou,ou=group,dc=crans,dc=org]/memberUid & user/uid" write
by dn="cn=replicator,dc=crans,dc=org" read
by * read
# Ensure read access to the base for things like # Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may # supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what # have problems with SASL not knowing what