wmantly
665a41cfde
The SSO app (nodejs/models/user_ldap.js addPosixAccount) tags every new user
with objectClasses [inetOrgPerson, sudoRole, ldapPublicKey, posixAccount, top,
theta42Person] and writes sudoHost/sudoCommand/sudoUser + sshPublicKey. The
all-in-one image's slapd.conf only included core/cosine/inetorgperson/nis +
theta42, so creating a user failed: sudoRole and ldapPublicKey were unknown
objectClasses (LDAP objectClassViolation 65) and sudoHost/sudoCommand/sudoUser
and sshPublicKey were unknown attributes.
Ship the two missing schemas and include them in slapd.conf:
- ops/schema/sudo.schema (sudoRole + sudo* attributes)
- ops/schema/openssh-lpk.schema (sshPublicKey + ldapPublicKey)
sudoRole is AUXILIARY here, not STRUCTURAL as in upstream sudo. The app
attaches sudoRole directly onto the user entry, which is already inetOrgPerson
(STRUCTURAL); two unrelated structural classes violate RFC 4512 and OpenLDAP
rejects with 65. AUXILIARY lets it coexist with inetOrgPerson — the app's
per-user-sudoers model. sudo's LDAP backend still finds entries via
(objectClass=sudoRole) regardless. ldapPublicKey is AUXILIARY as in upstream
openssh-lpk.
Also fix the build error from the previous theta42 schema PR: .dockerignore
excluded all of ops/, so 'COPY ops/schema/theta42.schema' failed at build
time ('not found' — file is git-tracked but stripped from the context). Re-
include ops/schema/*.schema with !exceptions, matching the existing
README.md/tos.md pattern.
Co-Authored-By: Claude <noreply@anthropic.com>
20 lines
790 B
Plaintext
20 lines
790 B
Plaintext
# OpenSSH LDAP Public Key (openssh-lpk) schema, the widely-used Buchan
|
|
# openssh-lpk definition (OIDs under 1.3.6.1.4.1.24552.500.1).
|
|
#
|
|
# The SSO app (nodejs/models/user_ldap.js) stores each user's SSH public key in
|
|
# the `sshPublicKey` attribute and tags the user entry with the `ldapPublicKey`
|
|
# auxiliary objectClass, so the directory must know both for user create/update
|
|
# to succeed. ldapPublicKey is AUXILIARY (as in upstream openssh-lpk), so it
|
|
# attaches cleanly onto the inetOrgPerson user entry.
|
|
|
|
attributetype ( 1.3.6.1.4.1.24552.500.1.1
|
|
NAME 'sshPublicKey'
|
|
DESC 'SSH public key'
|
|
EQUALITY octetStringMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
|
|
|
|
objectclass ( 1.3.6.1.4.1.24552.500.1.2
|
|
NAME 'ldapPublicKey'
|
|
DESC 'SSH public key user'
|
|
SUP top AUXILIARY
|
|
MAY sshPublicKey ) |