Skip to content

Commit 33ae0dd

Browse files
rajan-misrajan-mis
authored
Merge pull request #841 from Anand-Reddy7/anand-sssd-19nov
Adding OpenLDAP SSSD support
2 parents 6692787 + 580073b commit 33ae0dd

File tree

11 files changed

+373
-102
lines changed

11 files changed

+373
-102
lines changed

‎roles/auth_configure/tasks/ldap_prerequisites.yml

+6-19
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,21 @@
11
---
22
# Installing required ldap client packages for the integration.
33

4-
- name: LDAP | Installing Packages
4+
- name: LDAP | Check OS version for OpenLDAP package installation
55
ansible.builtin.shell: "grep -oE 'release [0-9]+' /etc/redhat-release | awk '{print $2}'"
66
register: rhel_version
77
changed_when: false
88

9-
- name: LDAP | Install Packages for RHEL 7
10-
ansible.builtin.yum:
11-
name:
12-
- openldap-clients
13-
- nss-pam-ldapd
14-
- sssd
15-
- oddjob
16-
- oddjob-mkhomedir
17-
state: present
18-
when: rhel_version.stdout == "7"
19-
register: install_ldap_client
20-
21-
- name: LDAP | Install Packages for RHEL 8
9+
- name: LDAP | Install Required OpenLDAP Packages
2210
ansible.builtin.dnf:
2311
name:
2412
- libnsl
2513
- libnsl2
2614
- openldap-clients
27-
- nss-pam-ldapd
28-
- authselect
2915
- sssd
30-
- oddjob
16+
- sssd-ldap
3117
- oddjob-mkhomedir
18+
- openssl-perl
19+
- authselect
3220
state: present
33-
when: rhel_version.stdout == "8"
34-
register: install_ldap_client
21+
when: rhel_version.stdout in ["8", "9"]

‎roles/auth_configure/tasks/ldap_user_integration.yml

+47-57
Original file line numberDiff line numberDiff line change
@@ -1,79 +1,69 @@
11
---
2-
# Installing required LDAP client packages for the integration.
32

4-
- name: LDAP | OS version check
3+
- name: LDAP | Check OS version
54
ansible.builtin.shell: "grep -oE 'release [0-9]+' /etc/redhat-release | awk '{print $2}'"
65
register: rhel_version
76
changed_when: false
87

98
- block:
10-
- name: LDAP | Enable LDAP authentication
11-
ansible.builtin.command:
12-
cmd: authconfig --enableldap --enableldapauth --ldapserver=ldap://{{ LDAP_SERVER_IP }} --ldapbasedn="dc={{ BASE_DN.split('.')[0] }},dc={{ BASE_DN.split('.')[1] }}" --enablemkhomedir --update
13-
register: enable_authconfig
14-
15-
- debug:
16-
var: enable_authconfig.stdout_lines
9+
- name: LDAP | Check for existing ldap_cacert.pem
10+
ansible.builtin.stat:
11+
path: "{{ LDAP_CERT_FILES_DIR }}/ldap_cacert.pem"
12+
register: ldap_cert_stat
1713

18-
- name: Update nsswitch.conf
19-
ansible.builtin.lineinfile:
20-
path: /etc/nsswitch.conf
21-
regexp: "{{ item.regexp }}"
22-
line: "{{ item.line }}"
23-
loop:
24-
- { regexp: '^passwd:', line: 'passwd: files ldap' }
25-
- { regexp: '^shadow:', line: 'shadow: files ldap' }
26-
- { regexp: '^group:', line: 'group: files ldap' }
27-
28-
- name: Remove 'auth' lines from password-auth PAM configuration
29-
ansible.builtin.lineinfile:
30-
path: "{{ item }}"
31-
state: absent
32-
regexp: '^auth.*'
33-
loop:
34-
- /etc/pam.d/password-auth
35-
- /etc/pam.d/system-auth
14+
- name: LDAP | Copy ldap_cacert.pem to remote servers if not present
15+
ansible.builtin.copy:
16+
src: "{{ LDAP_CERT_FILES_DIR }}/ldap_cacert.pem"
17+
dest: /etc/openldap/certs/ldap_cacert.pem
18+
owner: root
19+
group: root
20+
mode: '0600'
21+
when: not ldap_cert_stat.stat.exists
22+
register: ldap_cert_result
3623

37-
- name: Add custom auth lines to PAM configuration files
24+
- name: LDAP | Update LDAP configuration with server details
3825
ansible.builtin.blockinfile:
39-
path: "{{ item }}"
26+
path: /etc/openldap/ldap.conf
4027
block: |
41-
auth required pam_env.so
42-
auth sufficient pam_unix.so nullok try_first_pass
43-
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
44-
auth sufficient pam_ldap.so use_first_pass
45-
auth required pam_deny.so
28+
BASE dc={{ BASE_DN.split('.')[0] }},dc={{ BASE_DN.split('.')[1] }}
29+
URI ldap://{{ LDAP_SERVER_IP }}/
30+
TLS_CACERT /etc/openldap/certs/ldap_cacert.pem
31+
TLS_CACERTDIR /etc/openldap/certs
4632
create: yes
47-
loop:
48-
- /etc/pam.d/password-auth
49-
- /etc/pam.d/system-auth
50-
- /etc/pam.d/sshd
5133

52-
- name: Remove nslcd.conf file
34+
- name: LDAP | Rehash certificates in OpenLDAP directory
35+
ansible.builtin.command:
36+
cmd: openssl rehash /etc/openldap/certs
37+
38+
- name: LDAP | Configure SSSD with mkhomedir
39+
ansible.builtin.command:
40+
cmd: authselect select sssd with-mkhomedir --force
41+
42+
- name: LDAP | Remove existing SSSD configuration file if present
5343
ansible.builtin.file:
54-
path: /etc/nslcd.conf
44+
path: /etc/sssd/sssd.conf
5545
state: absent
5646

57-
- name: LDAP | Update LDAP Configuration with LDAP_SERVER and BASE_DN
58-
ansible.builtin.blockinfile:
59-
path: /etc/nslcd.conf
60-
block: |
61-
uid nslcd
62-
gid ldap
63-
uri ldap://{{ LDAP_SERVER_IP }}/
64-
base dc={{ BASE_DN.split('.')[0] }},dc={{ BASE_DN.split('.')[1] }}
65-
create: yes
66-
67-
- name: Allow SSH authentication
68-
ansible.builtin.command: sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/' /etc/ssh/sshd_config
69-
notify: Restart SSH Service
47+
- name: LDAP | Create new SSSD configuration file
48+
ansible.builtin.template:
49+
src: sssd.conf.j2
50+
dest: /etc/sssd/sssd.conf
51+
mode: '0600'
52+
owner: root
53+
group: root
7054

71-
- name: Restart and enable the services
55+
- name: LDAP | Restart and enable SSSD and oddjobd services
7256
ansible.builtin.systemd:
7357
name: "{{ item }}"
7458
state: restarted
7559
enabled: yes
7660
loop:
77-
- nslcd
78-
- nscd
79-
when: rhel_version.stdout in ["7", "8"]
61+
- sssd
62+
- oddjobd
63+
64+
- name: LDAP | Allow SSH password authentication
65+
ansible.builtin.command:
66+
cmd: sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/' /etc/ssh/sshd_config
67+
notify: Restart SSH Service
68+
69+
when: rhel_version.stdout in ["8", "9"]

‎roles/auth_configure/tasks/user_auth_ldap.yml

+38-6
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,45 @@
11
---
22
# Authenticating LDAP to the cluster
33

4-
- name: LDAP | Authenticate Cluster
4+
- name: LDAP | CES - Check if LDAP authentication is already configured
5+
shell: mmuserauth service list
6+
register: ldap_config_check
7+
changed_when: false
8+
run_once: true
9+
10+
- name: LDAP | CES - Authenticate Cluster with LDAP
511
shell: |
6-
echo -e "{{ ldap_admin_password }}" | mmuserauth service create --type ldap --data-access-method file --servers {{ ldap_server }} --base-dn dc={{ BASE_DN.split('.')[0] }},dc={{ BASE_DN.split('.')[1] }} --user-name cn=admin,dc={{ BASE_DN.split('.')[0] }},dc={{ BASE_DN.split('.')[1] }} --netbios-name ces
7-
when: service_result.rc is defined and service_result.rc != 0
12+
echo -e "{{ ldap_admin_password }}" | mmuserauth service create \
13+
--type ldap \
14+
--data-access-method file \
15+
--servers {{ ldap_server }} \
16+
--base-dn "dc={{ BASE_DN.split('.')[0] }},dc={{ BASE_DN.split('.')[1] }}" \
17+
--user-name "cn=admin,dc={{ BASE_DN.split('.')[0] }},dc={{ BASE_DN.split('.')[1] }}" \
18+
--netbios-name ces
19+
when: "'LDAP' not in ldap_config_check.stdout"
820
register: ldap_authenticate_cluster
9-
ignore_errors: yes
1021
run_once: true
1122

12-
- debug:
13-
var: ldap_authenticate_cluster.stdout_lines
23+
# Following tasks have been added to prevent updates to the sssd.conf file after "CES - Authenticate Cluster with LDAP."
24+
- name: LDAP | CES - Ensure SSSD Configuration File is Absent
25+
ansible.builtin.file:
26+
path: /etc/sssd/sssd.conf
27+
state: absent
28+
force: yes
29+
when: ldap_authenticate_cluster.changed
30+
31+
- name: LDAP | CES - Deploy SSSD Configuration File
32+
ansible.builtin.template:
33+
src: sssd.conf.j2
34+
dest: /etc/sssd/sssd.conf
35+
mode: '0600'
36+
owner: root
37+
group: root
38+
when: ldap_authenticate_cluster.changed
39+
40+
- name: LDAP | CES - Restart SSSD Service
41+
ansible.builtin.systemd:
42+
name: sssd
43+
state: restarted
44+
enabled: yes
45+
when: ldap_authenticate_cluster.changed

‎roles/auth_configure/templates/sssd.conf.j2

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
[sssd]
2+
config_file_version = 2
3+
services = nss, pam, autofs
4+
domains = default
5+
6+
[nss]
7+
homedir_substring = /home
8+
9+
[pam]
10+
11+
[domain/default]
12+
id_provider = ldap
13+
autofs_provider = ldap
14+
auth_provider = ldap
15+
chpass_provider = ldap
16+
ldap_uri = ldap://{{ LDAP_SERVER_IP }}
17+
ldap_search_base = dc={{ BASE_DN | regex_replace('\\..*', '') }},dc={{ BASE_DN | regex_replace('^[^.]+\\.', '') }}
18+
ldap_id_use_start_tls = True
19+
ldap_tls_cacertdir = /etc/openldap/certs
20+
cache_credentials = True
21+
ldap_tls_reqcert = allow

‎roles/auth_configure/vars/main.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
LDAP_ADMIN_PASSWORD: "{{ ldap_admin_password }}"
22
BASE_DN: "{{ ldap_basedns }}"
3-
LDAP_SERVER_IP: "{{ ldap_server }}"
3+
LDAP_SERVER_IP: "{{ ldap_server }}"
4+
LDAP_CERT_FILES_DIR: "/opt/IBM/ibm-spectrumscale-cloud-deploy/ldap_key"

‎roles/auth_ldap_server_prepare/tasks/get_ldap_certs.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
# Getting OpenLDAP SSL cert
3+
4+
- name: LDAP | Check if ldap_cacert.pem exists on remote
5+
stat:
6+
path: /usr/local/share/ca-certificates/ldap_cacert.pem
7+
register: remote_cert_status
8+
9+
- name: LDAP | Check if ldap_cacert.pem exists locally
10+
stat:
11+
path: "{{ LDAP_CERT_FILES_DIR }}/ldap_cacert.pem"
12+
register: ldap_cert_status
13+
14+
- name: LDAP | Copy ldap_cacert.pem to Bootstrap
15+
fetch:
16+
src: /usr/local/share/ca-certificates/ldap_cacert.pem
17+
dest: "{{ LDAP_CERT_FILES_DIR }}/ldap_cacert.pem"
18+
flat: yes
19+
when: remote_cert_status.stat.exists and not ldap_cert_status.stat.exists

0 commit comments

Comments
 (0)