Better groups

files/ldap-ssh-key.sh

@@ -4,6 +4,6 @@ ldapsearch -H "ldap://{{ldap_host}}" \
   -D "{{ldap_bind_dn}}" \
   -w "{{ldap_bind_password}}" \
   -b "ou=People,{{ldap_base_dn}}" \
-  "(&(uid=$1)(|(memberof=cn=host_access,ou=Groups,{{ldap_base_dn}})(memberof=cn=host_{{current_host}}_access,ou=Groups,{{ldap_base_dn}})))" \
+  "(&(uid=$1)(|{{#ldap_access_groups}}(memberof={{.}},ou=Groups,{{ldap_base_dn}}){{/ldap_access_groups}}))" \
   '*' | sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'
   

files/sssd.conf.mo

@@ -21,12 +21,12 @@ ldap_sudo_search_base = {{ldap_base_dn}}
 # Filter for sudo access: global host_admin OR host-specific admin
 ldap_sudo_full_refresh_interval = 900
 ldap_sudo_smart_refresh_interval = 300
-ldap_sudo_search_filter = (|(memberOf=cn=host_admin,ou=groups,dc=theta42,dc=com)(memberOf=cn=host_{hostname}_admin,ou=groups,dc=theta42,dc=com))
+ldap_sudo_search_filter = (|(memberOf=cn={{location}}host_admin,ou=groups,dc=theta42,dc=com)(memberOf=cn={{location}}host_{hostname}_admin,ou=groups,dc=theta42,dc=com))
 
 # Access control: only allow users in host_access or host_{hostname}_access
 access_provider = ldap
 ldap_access_order = filter
-ldap_access_filter = (|(memberof=cn=host_access,ou=groups,{{ldap_base_dn}})(memberof=cn=host_{{current_host}}_access,ou=groups,{{ldap_base_dn}}))
+ldap_access_filter = (|(memberof=cn={{location}}host_access,ou=groups,{{ldap_base_dn}})(memberof=cn={{location}}host_{{current_host}}_access,ou=groups,{{ldap_base_dn}}))
 
 # Mapping
 ldap_user_search_base = ou=people,{{ldap_base_dn}}

files/sudo-ldap.conf

@@ -6,4 +6,4 @@ BINDPW {{ldap_bind_password}}
 
 sudoers_base {{ldap_base_dn}}
 
-SUDOERS_SEARCH_FILTER (|(memberof=cn=host_admin,ou=Groups,{{ldap_base_dn}})(memberof=cn=host_{{current_host}}_admin,ou=Groups,{{ldap_base_dn}}))
+SUDOERS_SEARCH_FILTER (|{{#ldap_sudo_groups}}(memberof={{.}},ou=Groups,{{ldap_base_dn}}){{/ldap_sudo_groups}})

index.sh

@@ -56,12 +56,12 @@ if [[ -v sso_token ]]; then
     curl "${sso_url}/api/group/" \
       -H "auth-token: ${sso_token}" \
       -H "content-type: application/json; charset=UTF-8" \
-      --data-binary "{\"name\":\"host_${current_host}_access\",\"description\":\"Access for $current_host\"}"
+      --data-binary "{\"name\":\"${ldapLocation}_host_${current_host}_access\",\"description\":\"Access for $current_host\"}"
 
     curl "${sso_url}/api/group/" \
       -H "auth-token: ${sso_token}" \
       -H "content-type: application/json; charset=UTF-8" \
-      --data-binary "{\"name\":\"host_${current_host}_admin\",\"description\":\"sudo for $current_host\"}"
+      --data-binary "{\"name\":\"${ldapLocation}_host_${current_host}_admin\",\"description\":\"sudo for $current_host\"}"
 fi
 
 echo "--- SSSD Migration Complete! ---"

ldap.vars.pdp

@@ -0,0 +1,13 @@
+# Set some variables for the test of the file
+export ldap_host="ldap.internal.theta42.com"
+export ldap_base_dn="dc=theta42,dc=com"
+
+export ldap_bind_dn="cn=ldapclient service,ou=People,$ldap_base_dn"
+export ldap_bind_password=""
+
+export sso_url="https://sso.theta42.com"
+export sso_token="" # This is the only optional variable
+
+export ldap_location="pdp" 
+export ldap_access_groups=( $ldap_location_access $ldap_location_$(hostname)_access )
+export ldap_sudo_groups=( $ldap_location_admin $ldap_location_$(hostname)_admin )

ldap.vars.template

@@ -2,9 +2,6 @@
 export ldap_host="10.1.0.55"
 export ldap_base_dn="dc=theta42,dc=com"
 
-export ldap_admin_dn="cn=admin,$ldap_base_dn"
-export ldap_admin_password=""
-
 export ldap_bind_dn="cn=ldapclient service,ou=People,$ldap_base_dn"
 export ldap_bind_password=""