Add support for LDAP with STARTTLS #11
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Support LDAP with plain LDAP and LDAP with STARTTLS
The creation and signing shell command is quite long and difficult to read so I have split over a number of lines. It is also fairly opinionated i.e. in that the: * Common Name will always be the servers `ansible_hostname` so I have made it a overridable parameter. * The SSL certifate expiry date is forcible set to 10 years
The default ssl keylength is quite low by todays standards.
We may want to provide our own private key rather than have one generated on the first run.
We may want to use a SSL certificate that is not self-signed.
Download an official Certificate Authority certificate chain file.
The current cacert bundle is hardcoded and we may want to download our own version of the cacert bundle.
Adding the following GlobalSign certificates: * [R1 GlobalSign Root Certificate](https://support.globalsign.com/customer/en/portal/articles/1426602-globalsign-root-certificates) * [DomainSSL SHA-256 R1 Intermediate Certificates](https://support.globalsign.com/customer/portal/articles/1464460-domainssl-intermediate-certificates)
This command was quite hard to read/review.
…icates_for_the_apcera_test [#107033028] Add support for LDAP with STARTTLS
This file belongs in the ldap-server-ansible repo, not here.
…wnload_url [#107033028] Parameterising CA Cert download URL
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What
The version of the bennojoy/openldap_server role that we use does not support the following:
This PR intends to fix that
How this PR should be reviewed
This PR has been crafted with the aid of dainty white mice wearing pink slippers to be reviewed with the following narrative:
hostname&expiry dateoverrideableTLSCACertificateFileon my LDAP server, so I can supply a valid CA certificate chain file if I ever want to use a valid SSL certificateHow to test this PR
A vagrant box has been provided for local testing, simply just:
You modify the
site.ymlto test the variables and run: