instantlinux/openldap repository overview

⁠openldap

This is OpenLDAP in a tiny alpine container, with simple setup. All features and capabilities are supported.

Why this new image (in 2022), when there are others? The dinkel and osixia images fell out of maintenance, so the only current maintained alternative is the larger / more complex / single-platform bitnami.

⁠Usage

Set environment variables as shown below, and mount a blank storage volume as /var/lib/openldap/openldap-data. Optionally, put your users and groups into ldif format (see example⁠) and mount them as /etc/openldap/prepopulate, and/or add TLS certifates under /etc/ssl/openldap.

Example kubernetes and docker-compose resource definition files are provided here along with a helm chart. This repo has complete instructions for building a kubernetes cluster⁠ where you can launch with helm⁠ using make and customizing Makefile.vars⁠ after cloning this repo:

git clone https://github.com/instantlinux/docker-tools.git
cd docker-tools/k8s
make openldap

⁠Variables

If overriding default root DN, it should be specified in the form cn=admin,dc=example,dc=com.

The root password must be specified in one of three ways:

• SLAPD_ROOTPW - plain text value, only for testing
• SLAPD_ROOTPW_HASH - encrypted value starting with {PBKDF2-SHA512}
• openldap-ro-password secret - most secure place to store the hash

You will want to override values for SLAPD_FQDN and SLAPD_ORGANIZATION. All the other default values will work for many typical use-cases.

User passwords are normally initialized by the administrator using ldappasswd, and from then on updated by the user (through the same tool or protocol). With this image, you can also define user passwords by providing their (hashed) values via a secret. Don't use ldappasswd to update passwords that are provided with the latter method: use it to generate a new hashed value and update the secret.

⁠Volumes

Mount these path names to persistent storage; all are optional.

⁠Secrets

⁠Contributing

If you want to make improvements to this image, see CONTRIBUTING⁠.