Setup

OpenLDAP

Both Dockerfile.ldap and it's entrypoint script docker/entrypoint.sh automate all of this

Docker

• open .env with your favourite editor and modify to your needs. Especially make sure to replace all passwords. All LDAP passwords are only needed once and can safely be removed after the first run of the container
• start the docker container either:

  • manually:

      docker run -it --env-file .env ldap-sso
    

  • with docker-compose:

      docker compose --profile ldap up 
    

Manual

• install slapd packages

    apt-get update
    apt-get install slapd ldap-utils ldapscripts gettext-base python-dotenv
  

• configure memberOf overlay and rfc2307bis

    wget https://github.com/palw3ey/rfc2307bis/releases/download/latest/rfc2307bis.ldif -O /etc/ldap/schema/rfc2307bis.ldap
  

  • in /usr/share/slapd/slapd.init.ldif replace: include: file:///etc/ldap/schema/nis.ldif with include: file:///etc/ldap/schema/rfc2307bis.ldif

• configure LDAP:

    dpkg-reconfigure slapd
  

• open .env with your favourite editor and modify to your needs. Especially make sure to replace all passwords. All LDAP passwords are only needed once and can safely be removed after the first run

• adjust /etc/ldap/ldap.conf to your needs

• adjust /etc/ldapscripts/ldapscripts.conf to your needs

  • make sure to change GCLASS to groupOfNames and GDUMMYMEMBER to uid=dummy,$LDAP_BASE

• setup /etc/ldapscripts/ldapscripts.passwd

      echo -n $LDAP_ADMIN_PASSWORD > /etc/ldapscripts/ldapscripts.passwd
      chmod 400 /etc/ldapscripts/ldapscripts.passwd
  

• start slapd

    systemctl start slapd
  

• configure slapd

  • Configure memberOf overlay

      ldapmodify -Q -Y EXTERNAL -H ldapi:/// << EOF
      dn: cn=module{0},cn=config
      changetype: modify
      add: olcModuleLoad
      olcModuleLoad: memberof.la
      EOF
    
      ldapadd -Q -Y EXTERNAL -H ldapi:/// <<EOF
      dn: olcOverlay=memberof,olcDatabase={1}mdb,cn=config
      objectClass: olcOverlayConfig
      objectClass: olcMemberOf
      olcOverlay: memberof
      olcMemberOfRefint: TRUE
      EOF
    

  • configure lastbind overlay

      ldapmodify -Q -Y EXTERNAL -H ldapi:/// << EOF
      dn: cn=module{0},cn=config
      changetype: modify
      add: olcModuleLoad
      olcModuleLoad: lastbind.la
      EOF
    
      ldapmodify -Y EXTERNAL -H ldapi:/// -f << EOF
      dn: olcDatabase={1}mdb,cn=config
      changetype: modify
      replace: olcLastBind
      olcLastBind: TRUE
      -
      replace: olcLastBindPrecision
      olcLastBindPrecision: 3600
      EOF
    

    afterwards after a successful bind:

      ldapsearch -D cn=admin,dc=ldap,dc=sso-test,dc=com -w admin -LLL -H ldap:/// -b ou=Users,dc=ldap,dc=sso-test,dc=com pwdLastSuccess
    

  • add ssh-key class

      ldapadd -Q -Y EXTERNAL -H ldapi:/// -f ldif/010-ssh-key.ldif
    

  • add totp base config

      ldapadd -Q -Y EXTERNAL -H ldapi:/// -f ldif/011-totp.ldif
    

  • add totp opverlay config

      ldapadd -Q -Y EXTERNAL -H ldapi:/// -f ldif/012-totp-overlay.ldif
    

  • add user and groups ous

      ldapadd -H ldapi:/// -x -D cn=admin,$LDAP_BASE -w $LDAP_ADMIN_PASSWORD -f ldif/013-users-groups-ou.ldif
    

  • generate totp params from template and apply config:

      envsubst < ldif/014-totp-params.ldif.template > ldif/014-totp-params.ldif
      ldapadd -H ldapi:/// -x -D cn=admin,$LDAP_BASE -w $LDAP_ADMIN_PASSWORD -f ldif/014-totp-params.ldif
    

• Keycloak LDAP User

  • create user

        ldapaddgroup $KEYCLOAK_LDAP_GROUP
        ldapadduser $KEYCLOAK_LDAP_USER $KEYCLOAK_LDAP_GROUP
    
        ldapmodify -H ldapi:/// -x -D cn=admin,$LDAP_BASE -w $LDAP_ADMIN_PASSWORD <<EOF
        dn: uid=$KEYCLOAK_LDAP_USER,ou=Users,$LDAP_BASE
        changetype: modify
        replace: userPassword
        userPassword: $(slappasswd -ns $KEYCLOAK_LDAP_PASS)
        EOF
    

  • grant permissions to user

        ldapmodify -Q -Y EXTERNAL -H ldapi:/// <<EOF
        dn: olcDatabase={1}mdb,cn=config
        changetype: modify
        replace: olcAccess
        olcAccess: {0}to attrs=userPassword by self write by dn.exact="uid=$KEYCLOAK_LDAP_USER,ou=Users,$LDAP_BASE" write by anonymous auth by * none
        olcAccess: {1}to attrs=shadowLastChange by self write by * read
        olcAccess: {2}to attrs=oathSecret by self write by dn="cn=admin,$LDAP_BASE" manage by dn="uid=$OPENVPN_LDAP_USER,ou=Users,$LDAP_BASE" read by * none
        olcAccess: {3}to dn.subtree="ou=Users,$LDAP_BASE" by dn.exact="uid=$KEYCLOAK_LDAP_USER,ou=Users,$LDAP_BASE" write by * read
        olcAccess: {4}to dn.subtree="ou=Groups,$LDAP_BASE" by dn.exact="uid=$KEYCLOAK_LDAP_USER,ou=Users,$LDAP_BASE" write by * read
        olcAccess: {5}to * by * read
        EOF
    

• user local scripts by default

    echo "export PATH=\"$PWD/scripts:\$PATH\"" > /etc/profile.d/20-keycloak-ldap-path.sh \
  

Keycloak

• modify .env Keycloak Parts with your favourite editor to your needs

• start keycloak + postgres

    docker compose --profile keycloak up -d
  

• wait till you can connect to http://127.0.0.1:8080 and login with your .env configured credentials

• Configure Keycloak ldap

  • Choose the realm you want to configure LDAP for and click User Federation
  • Choose Add Ldap Providers and make sure to select Vendor: Other
  • Configure (note: Keycloak can not evaluate the environment vars, you must replace them manually here! Confer .env for the variables):
    • Connection Url: i.e. ldap://ldap or wherever Keycloak can read the LDAP Server
    • Bind DN: $KEYCLOAK_LDAP_USER,ou=Users,$LDAP_BASE, i.e.: uid=keycloak_ldap_admin,ou=Users,dc=ldap,dc=sso-test,dc=com
    • Bind credentials: $KEYCLOAK_LDAP_PASS
    • Edit mode: Writeable
    • Users DN: ou=Users,$LDAP_BASE, i.e. ou=Users,dc=ldap,dc=sso-test,dc=com
    • Username LDAP attribute and RDN LDAP attribute: uid
    • UUID LDAP attribute: uidNumber
    • Enable the LDAPv3 password modify extended operation: Enabled otherwise passwords will be stored in plaintext in the LDAP!

Links

• https://ubuntu.com/server/docs/how-to/openldap/
• https://github.com/palw3ey/rfc2307bis