theta42/sso-manager-node
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Load sudo + openssh-lpk schemas in the all-in-one image; fix schema COPY

Browse Source 
The SSO app (nodejs/models/user_ldap.js addPosixAccount) tags every new user
with objectClasses [inetOrgPerson, sudoRole, ldapPublicKey, posixAccount, top,
theta42Person] and writes sudoHost/sudoCommand/sudoUser + sshPublicKey. The
all-in-one image's slapd.conf only included core/cosine/inetorgperson/nis +
theta42, so creating a user failed: sudoRole and ldapPublicKey were unknown
objectClasses (LDAP objectClassViolation 65) and sudoHost/sudoCommand/sudoUser
and sshPublicKey were unknown attributes.

Ship the two missing schemas and include them in slapd.conf:
  - ops/schema/sudo.schema       (sudoRole + sudo* attributes)
  - ops/schema/openssh-lpk.schema (sshPublicKey + ldapPublicKey)

sudoRole is AUXILIARY here, not STRUCTURAL as in upstream sudo. The app
attaches sudoRole directly onto the user entry, which is already inetOrgPerson
(STRUCTURAL); two unrelated structural classes violate RFC 4512 and OpenLDAP
rejects with 65. AUXILIARY lets it coexist with inetOrgPerson — the app's
per-user-sudoers model. sudo's LDAP backend still finds entries via
(objectClass=sudoRole) regardless. ldapPublicKey is AUXILIARY as in upstream
openssh-lpk.

Also fix the build error from the previous theta42 schema PR: .dockerignore
excluded all of ops/, so 'COPY ops/schema/theta42.schema' failed at build
time ('not found' — file is git-tracked but stripped from the context). Re-
include ops/schema/*.schema with !exceptions, matching the existing
README.md/tos.md pattern.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
William Mantly
2026-07-11 22:24:12 -04:00
parent 84e5358e08
commit 665a41cfde
5 changed files with 125 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile.openldap
+13 -6
View File
@@ -68,12 +68,19 @@ COPY tos.md /tos.md
COPY docker-entrypoint.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
# theta42 custom schema (dateOfBirth + theta42Person). The app adds
# objectClass theta42Person when a user has a dateOfBirth, so the directory
# must know it or user create/update fails with LDAP 0x15. Mirrors the
# cn=config LDIF ops/ldap-setup.sh loads on bare metal, in .schema form so
# docker-entrypoint.sh can `include` it in the static slapd.conf.
COPY ops/schema/theta42.schema /etc/openldap/schema/theta42.schema
# Custom LDAP schemas the app's user model depends on. addPosixAccount
# (nodejs/models/user_ldap.js) tags every user entry with objectClasses
# theta42Person, sudoRole, and ldapPublicKey and writes dateOfBirth /
# sudoHost,sudoCommand,sudoUser / sshPublicKey — so the directory must know
# all three or user create/update fails (theta42Person: LDAP 0x15; sudoRole /
# ldapPublicKey: objectClassViolation 65). .dockerignore excludes ops/ from
# the build context except ops/schema/*.schema, which is why these COPYs work.
# theta42.schema : dateOfBirth + theta42Person (mirrors ldap-setup.sh §5)
# sudo.schema : sudoRole (AUXILIARY — see file header) + sudo* attributes
# openssh-lpk.schema : sshPublicKey + ldapPublicKey (AUXILIARY)
COPY ops/schema/theta42.schema /etc/openldap/schema/theta42.schema
COPY ops/schema/sudo.schema /etc/openldap/schema/sudo.schema
COPY ops/schema/openssh-lpk.schema /etc/openldap/schema/openssh-lpk.schema
# Expose ports
# 3001: SSO Manager web interface (HTTP — terminate TLS at the front proxy)