261 lines
7.0 KiB
Markdown
261 lines
7.0 KiB
Markdown
# LDAP Client
|
|
|
|
Bash-based SSSD LDAP authentication client for Ubuntu/Debian systems. Integrates with [theta42/sso-manager-node](https://github.com/theta42/sso-manager-node) for centralized user management, group-based access control, and SSH key distribution.
|
|
|
|
## Overview
|
|
|
|
This script automates the configuration of SSSD (System Security Services Daemon) to provide:
|
|
|
|
- LDAP authentication against a central directory
|
|
- Group-based access control (only authorized users can log in)
|
|
- Sudo privileges via LDAP groups
|
|
- SSH public key retrieval from LDAP for key-based authentication
|
|
- Automatic home directory creation for LDAP users
|
|
- Optional registration of host-specific groups via the SSO Manager API
|
|
|
|
## Prerequisites
|
|
|
|
- Ubuntu or Debian system with root access
|
|
- Network connectivity to your LDAP server (LDAPS on port 636)
|
|
- LDAP service account credentials
|
|
- CA certificates for LDAP TLS validation
|
|
- (Optional) SSO Manager instance for group API registration
|
|
|
|
## Installation
|
|
|
|
### 1. Clone the repository
|
|
|
|
```bash
|
|
git clone https://github.com/theta42/ldap-client.git
|
|
cd ldap-client
|
|
```
|
|
|
|
### 2. Create configuration
|
|
|
|
Copy the template configuration file:
|
|
|
|
```bash
|
|
cp ldap.vars.template ldap.vars
|
|
```
|
|
|
|
### 3. Configure variables
|
|
|
|
Edit `ldap.vars` with your environment settings:
|
|
|
|
```bash
|
|
# LDAP server settings
|
|
export ldap_host="ldap.internal.theta42.com"
|
|
export ldap_base_dn="dc=theta42,dc=com"
|
|
|
|
# Service account for LDAP binds
|
|
export ldap_bind_dn="cn=ldapclient service,ou=People,$ldap_base_dn"
|
|
export ldap_bind_password="your-service-account-password"
|
|
|
|
# SSO Manager integration (optional)
|
|
export sso_url="https://sso.theta42.com"
|
|
export sso_token="your-api-token"
|
|
|
|
# Location identifier for group naming (optional)
|
|
export ldap_location="718it"
|
|
```
|
|
|
|
#### Variable descriptions
|
|
|
|
| Variable | Required | Description |
|
|
|----------|----------|-------------|
|
|
| `ldap_host` | Yes | LDAP server hostname |
|
|
| `ldap_base_dn` | Yes | Base DN for LDAP searches |
|
|
| `ldap_bind_dn` | Yes | DN of the service account for LDAP binds |
|
|
| `ldap_bind_password` | Yes | Password for the service account |
|
|
| `sso_url` | No | Base URL of the SSO Manager API |
|
|
| `sso_token` | No | API authentication token for SSO Manager |
|
|
| `ldap_location` | No | Location prefix for group names (e.g., `718it`). If omitted, group-based access control will not be configured |
|
|
|
|
#### Group configuration
|
|
|
|
The script uses two arrays to define which LDAP groups grant access:
|
|
|
|
```bash
|
|
ldap_access_groups=( "${ldap_location}_access" "${ldap_location}_$(hostname)_access" )
|
|
ldap_sudo_groups=( "${ldap_location}_admin" "${ldap_location}_$(hostname)_admin" )
|
|
```
|
|
|
|
This creates both location-wide and host-specific groups:
|
|
- `718it_access` - grants login access to all hosts in this location
|
|
- `718it_host_webserver01_access` - grants login access only to webserver01
|
|
- `718it_admin` - grants sudo privileges on all hosts
|
|
- `718it_host_webserver01_admin` - grants sudo privileges only on webserver01
|
|
|
|
If `ldap_location` is not set, these arrays will be empty and access control will be handled entirely by LDAP-side configuration.
|
|
|
|
### 4. Run the installation script
|
|
|
|
```bash
|
|
sudo ./index.sh
|
|
```
|
|
|
|
The script will:
|
|
|
|
1. Install required packages (sssd, sssd-ldap, libnss-sss, libpam-sss, ldap-utils, libsss-sudo)
|
|
2. Generate and deploy the SSSD configuration
|
|
3. Configure NSS to use SSS for passwd, group, and sudoers lookups
|
|
4. Enable automatic home directory creation via PAM
|
|
5. Deploy the SSH AuthorizedKeysCommand script
|
|
6. Configure SSHD to retrieve keys from LDAP
|
|
7. (Optional) Register host-specific groups with the SSO Manager API
|
|
8. Start and enable the SSSD service
|
|
|
|
## Post-installation verification
|
|
|
|
### Test LDAP user lookup
|
|
|
|
```bash
|
|
getent passwd <ldap-username>
|
|
```
|
|
|
|
### Test group membership
|
|
|
|
```bash
|
|
getent group <group-name>
|
|
```
|
|
|
|
### Test sudo access
|
|
|
|
```bash
|
|
sudo -l -U <ldap-username>
|
|
```
|
|
|
|
### Test SSH key retrieval
|
|
|
|
```bash
|
|
/usr/local/bin/ldap-ssh-key <ldap-username>
|
|
```
|
|
|
|
### Check SSSD status
|
|
|
|
```bash
|
|
systemctl status sssd
|
|
journalctl -u sssd -f
|
|
```
|
|
|
|
### Verify authentication
|
|
|
|
```bash
|
|
su - <ldap-username>
|
|
```
|
|
|
|
## File structure
|
|
|
|
```
|
|
ldap-client/
|
|
index.sh # Main installation script
|
|
ldap.vars.template # Configuration template (copy to ldap.vars)
|
|
ldap.vars.theta42 # Example configuration for theta42
|
|
files/
|
|
sssd.conf.mo # SSSD configuration template (Mustache)
|
|
ldap-ssh-key.sh # SSH AuthorizedKeysCommand script
|
|
sudo-ldap.conf # LDAP sudo configuration template
|
|
lib/
|
|
mo # Mustache template processor
|
|
```
|
|
|
|
## How it works
|
|
|
|
### Authentication flow
|
|
|
|
1. User attempts to log in via SSH or console
|
|
2. PAM/SSSD queries LDAP for user credentials
|
|
3. If user is in an authorized access group, authentication proceeds
|
|
4. Home directory is created automatically on first login (via pam_mkhomedir)
|
|
|
|
### SSH key distribution
|
|
|
|
1. SSHD calls `/usr/local/bin/ldap-ssh-key` with the username
|
|
2. The script queries LDAP for the user's `sshPublicKey` attribute
|
|
3. Keys are returned to SSHD for authentication
|
|
4. This allows SSH key management through the central directory
|
|
|
|
### Sudo integration
|
|
|
|
SSSD is configured with an LDAP sudo provider that:
|
|
- Searches for sudo rules in the LDAP directory
|
|
- Filters rules based on group membership
|
|
- Refreshes rules every 15 minutes (full) or 5 minutes (smart)
|
|
|
|
### SSO Manager integration
|
|
|
|
When `sso_token` is configured, the script automatically creates host-specific groups in the SSO Manager:
|
|
|
|
- `<location>_host_<hostname>_access` - for login access
|
|
- `<location>_host_<hostname>_admin` - for sudo privileges
|
|
|
|
This allows you to manage host-specific access through the SSO Manager web interface.
|
|
|
|
## Troubleshooting
|
|
|
|
### SSSD not starting
|
|
|
|
Check the configuration syntax:
|
|
|
|
```bash
|
|
sssd --genconf-only
|
|
```
|
|
|
|
Review logs:
|
|
|
|
```bash
|
|
journalctl -u sssd -f
|
|
```
|
|
|
|
### Users cannot authenticate
|
|
|
|
1. Verify LDAP connectivity:
|
|
```bash
|
|
ldapsearch -H ldaps://<ldap_host> -b "<ldap_base_dn>" -D "<bind_dn>" -W
|
|
```
|
|
|
|
2. Check group membership in LDAP
|
|
|
|
3. Verify the `ldap_access_filter` in `/etc/sssd/sssd.conf`
|
|
|
|
### SSH keys not working
|
|
|
|
1. Test the key retrieval script directly:
|
|
```bash
|
|
/usr/local/bin/ldap-ssh-key <username>
|
|
```
|
|
|
|
2. Verify `sshPublicKey` attribute exists in LDAP
|
|
|
|
3. Check SSHD configuration:
|
|
```bash
|
|
sshd -T | grep authorizedkeys
|
|
```
|
|
|
|
### Sudo rules not applying
|
|
|
|
1. Check sudo provider configuration in `/etc/sssd/sssd.conf`
|
|
|
|
2. Verify sudo rules exist in LDAP with correct host and group filters
|
|
|
|
3. Force SSSD refresh:
|
|
```bash
|
|
sssctl cache-expire --group
|
|
systemctl restart sssd
|
|
```
|
|
|
|
## Security considerations
|
|
|
|
- The LDAP bind password in `ldap.vars` should have restricted filesystem permissions
|
|
- SSSD configuration (`/etc/sssd/sssd.conf`) is set to mode 600
|
|
- LDAPS (TLS) is required for LDAP connections
|
|
- The SSH key script runs as the `nobody` user for minimal privilege
|
|
|
|
## Related projects
|
|
|
|
- [theta42/sso-manager-node](https://github.com/theta42/sso-manager-node) - Centralized SSO and LDAP management
|
|
|
|
## License
|
|
|
|
This project is provided as-is for internal use.
|