crans
/
ansible
mirror of http://gitlab.adm.crans.org/nounous/ansible.git
19
0
Fork 0
Code Issues Projects Releases Wiki Activity

[sssd] Support multiple LDAP uris for resilience 

Signed-off-by: Yohann D'ANELLO <ynerant@crans.org>
certbot_on_virtu
Yohann D'ANELLO 2021-06-21 13:24:14 +02:00
parent 51c77aee0c
commit bdf84760ab
Signed by: _ynerant
GPG Key ID: 3A75C55819C8CF85
2 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
group_vars/sssd.yml
View File

@ -3,16 +3,18 @@ glob_sssd:
domain: tealc.adm.crans.org domain: tealc.adm.crans.org
enumerate: "true" enumerate: "true"
servers: servers:
- "{{ query('ldap','ip','tealc','adm') | ipv4 | first }}" - "ldaps://{{ query('ldap','ip','tealc','adm') | ipv4 | first }}"
- "{{ query('ldap','ip','sam','adm') | ipv4 | first }}" - "ldaps://{{ query('ldap','ip','sam','adm') | ipv4 | first }}"
- "{{ query('ldap','ip','daniel','adm') | ipv4 | first }}" - "ldaps://{{ query('ldap','ip','daniel','adm') | ipv4 | first }}"
- "{{ query('ldap','ip','jack','adm') | ipv4 | first }}" - "ldaps://{{ query('ldap','ip','jack','adm') | ipv4 | first }}"
base: "dc=crans,dc=org" base: "dc=crans,dc=org"
secondary: secondary:
domain: re2o-ldap.adm.crans.org domain: re2o-ldap.adm.crans.org
enumerate: "false" enumerate: "false"
servers:
- "ldaps://{{ query('ldap','ip','re2o-ldap','adm') | ipv4 | first }}"
- "ldaps://{{ query('ldap','ip','terenez','adm') | ipv4 | first }}"
base: "dc=crans,dc=org" base: "dc=crans,dc=org"
bind: bind:
dn: "cn=nslcd,ou=service-users,dc=crans,dc=org" dn: "cn=nslcd,ou=service-users,dc=crans,dc=org"
passwd: "{{ vault.ldap_nslcd_passwd }}" passwd: "{{ vault.ldap_nslcd_passwd }}"

4
roles/sssd/templates/sssd/sssd.conf.j2
View File

@ -9,7 +9,7 @@ ldap_access_filter = (objectClass=posixAccount)
enumerate = {{ sssd.primary.enumerate }} enumerate = {{ sssd.primary.enumerate }}
id_provider = ldap id_provider = ldap
auth_provider = ldap auth_provider = ldap
ldap_uri = ldaps://{{ sssd.primary.domain }} ldap_uri = {{ sssd.primary.servers | join(', ') }}
ldap_search_base = {{ sssd.primary.base }} ldap_search_base = {{ sssd.primary.base }}
{% if sssd.primary.bind is defined -%} {% if sssd.primary.bind is defined -%}
ldap_default_bind_dn = {{ sssd.primary.bind.dn }} ldap_default_bind_dn = {{ sssd.primary.bind.dn }}
@ -22,7 +22,7 @@ ldap_access_filter = (objectClass=posixAccount)
enumerate = {{ sssd.secondary.enumerate }} enumerate = {{ sssd.secondary.enumerate }}
id_provider = ldap id_provider = ldap
auth_provider = ldap auth_provider = ldap
ldap_uri = ldaps://{{ sssd.secondary.domain }} ldap_uri = {{ sssd.secondary.servers | join(', ') }}
ldap_search_base = {{ sssd.secondary.base }} ldap_search_base = {{ sssd.secondary.base }}
{% if sssd.secondary.bind is defined -%} {% if sssd.secondary.bind is defined -%}
ldap_default_bind_dn = {{ sssd.secondary.bind.dn }} ldap_default_bind_dn = {{ sssd.secondary.bind.dn }}