Skip to content

Commit eb5222a

Browse files
author
Andrew Jackson
committed
ldap
1 parent 7d047c6 commit eb5222a

File tree

13 files changed

+965
-161
lines changed

13 files changed

+965
-161
lines changed

‎.circleci/glauth.cfg

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
#################
2+
# glauth.conf
3+
4+
#################
5+
# General configuration.
6+
debug = true
7+
8+
[ldap]
9+
enabled = true
10+
# run on a non privileged port
11+
listen = "0.0.0.0:3893"
12+
tls = false
13+
14+
[ldaps]
15+
enabled = false
16+
#################
17+
# Tracing section controls the tracer configuration
18+
[tracing]
19+
# if enabled is set to false, a no-op tracer will be used
20+
enabled = true
21+
# if both grpcEndpoint and httpEndpoint are unset, the default stdout provider will be used
22+
# TODO add allowGRPCInsecure: right now grpc otlp is using the WithInsecure flag so traffic
23+
# will always go without verifying server certificates
24+
# grpcEndpoint = "otlp.monitoring.io:4317"
25+
# httpEndpoint = "http://otlp.monitoring.io:4318"
26+
#################
27+
# The backend section controls the data store.
28+
[backend]
29+
datastore = "config"
30+
baseDN = "dc=example,dc=com"
31+
nameformat = "cn"
32+
groupformat = "ou"
33+
34+
# If you are using a client that requires reading the root DSE first
35+
# such as SSSD
36+
# anonymousdse = true
37+
38+
## Configure dn format to use structures like
39+
## "uid=serviceuser,cn=svcaccts,$BASEDN" instead of "cn=serviceuser,ou=svcaccts,$BASEDN"
40+
## to help ease migrations from other LDAP systems
41+
# nameformat = "uid"
42+
# groupformat = "cn"
43+
44+
## Configure ssh-key attribute name, default is 'sshPublicKey'
45+
# sshkeyattr = "ipaSshPubKey"
46+
47+
[behaviors]
48+
# Ignore all capabilities restrictions, for instance allowing every user to perform a search
49+
IgnoreCapabilities = false
50+
# Enable a "fail2ban" type backoff mechanism temporarily banning repeated failed login attempts
51+
LimitFailedBinds = true
52+
# How many failed login attempts are allowed before a ban is imposed
53+
NumberOfFailedBinds = 3
54+
# How long (in seconds) is the window for failed login attempts
55+
PeriodOfFailedBinds = 10
56+
# How long (in seconds) is the ban duration
57+
BlockFailedBindsFor = 60
58+
# Clean learnt IP addresses every N seconds
59+
PruneSourceTableEvery = 600
60+
# Clean learnt IP addresses not seen in N seconds
61+
PruneSourcesOlderThan = 600
62+
63+
#################
64+
# The users section contains a hardcoded list of valid users.
65+
# to create a passSHA256: echo -n "mysecret" | openssl dgst -sha256
66+
[[users]]
67+
name = "admin_user"
68+
uidnumber = 5001
69+
primarygroup = 5501
70+
mail = "admin_user@example.com"
71+
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
72+
[[users.customattributes]]
73+
employeetype = ["Intern", "Temp"]
74+
employeenumber = [12345, 54321]
75+
[[users.capabilities]]
76+
action = "search"
77+
object = "dc=example,dc=com"
78+
79+
# This user record shows all of the possible fields available
80+
[[users]]
81+
name = "sharding_user"
82+
givenname="John"
83+
sn="Doe"
84+
mail = "sharding_user@example.com"
85+
uidnumber = 5002
86+
primarygroup = 5501
87+
loginShell = "/bin/sh"
88+
homeDir = "/root"
89+
passsha256 = "6478579e37aff45f013e14eeb30b3cc56c72ccdc310123bcdf53e0333e3f416a" # dogood
90+
sshkeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEA3UKCEllO2IZXgqNygiVb+dDLJJwVw3AJwV34t2jzR+/tUNVeJ9XddKpYQektNHsFmY93lJw5QDSbeH/mAC4KPoUM47EriINKEelRbyG4hC/ko/e2JWqEclPS9LP7GtqGmscXXo4JFkqnKw4TIRD52XI9n1syYM9Y8rJ88fjC/Lpn+01AB0paLVIfppJU35t0Ho9doHAEfEvcQA6tcm7FLJUvklAxc8WUbdziczbRV40KzDroIkXAZRjX7vXXhh/p7XBYnA0GO8oTa2VY4dTQSeDAUJSUxbzevbL0ll9Gi1uYaTDQyE5gbn2NfJSqq0OYA+3eyGtIVjFYZgi+txSuhw== rsa-key-20160209"]
91+
passappsha256 = [
92+
"c32255dbf6fd6b64883ec8801f793bccfa2a860f2b1ae1315cd95cdac1338efa", # TestAppPw1
93+
"c9853d5f2599e90497e9f8cc671bd2022b0fb5d1bd7cfff92f079e8f8f02b8d3", # TestAppPw2
94+
"4939efa7c87095dacb5e7e8b8cfb3a660fa1f5edcc9108f6d7ec20ea4d6b3a88", # TestAppPw3
95+
]
96+
97+
#################
98+
# The groups section contains a hardcoded list of valid users.
99+
[[groups]]
100+
name = "superheros"
101+
gidnumber = 5501
102+
103+
[[groups]]
104+
name = "svcaccts"
105+
gidnumber = 5502
106+
107+
[[groups]]
108+
name = "vpn"
109+
gidnumber = 5503
110+
includegroups = [ 5501 ]
111+

‎.circleci/pgcat_ldap.toml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
2+
[general]
3+
host = "0.0.0.0"
4+
port = 6432
5+
admin_username = "admin_user"
6+
admin_password = ""
7+
admin_auth_type = "ldap"
8+
admin_auth_ldapurl = "ldap://127.0.0.1:3893"
9+
admin_auth_ldapsuffix = "@example.com"
10+
11+
[pools.sharded_db.users.0]
12+
username = "sharding_user"
13+
password = "sharding_user"
14+
auth_type = "ldap"
15+
auth_ldapurl = "ldap://127.0.0.1:3893"
16+
auth_ldapsuffix = "@example.com"
17+
pool_size = 10
18+
min_pool_size = 1
19+
pool_mode = "transaction"
20+
21+
[pools.sharded_db.shards.0]
22+
servers = [
23+
[ "127.0.0.1", 5432, "primary" ],
24+
]
25+
database = "shard0"

‎.circleci/pgcat_trust.toml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
2+
[general]
3+
host = "0.0.0.0"
4+
port = 6432
5+
admin_username = "admin_user"
6+
admin_password = ""
7+
admin_auth_type = "trust"
8+
9+
[pools.sharded_db.users.0]
10+
username = "sharding_user"
11+
password = "sharding_user"
12+
auth_type = "trust"
13+
pool_size = 10
14+
min_pool_size = 1
15+
pool_mode = "transaction"
16+
17+
[pools.sharded_db.shards.0]
18+
servers = [
19+
[ "127.0.0.1", 5432, "primary" ],
20+
]
21+
database = "shard0"

0 commit comments

Comments
 (0)