wmantly
665a41cfde
The SSO app (nodejs/models/user_ldap.js addPosixAccount) tags every new user
with objectClasses [inetOrgPerson, sudoRole, ldapPublicKey, posixAccount, top,
theta42Person] and writes sudoHost/sudoCommand/sudoUser + sshPublicKey. The
all-in-one image's slapd.conf only included core/cosine/inetorgperson/nis +
theta42, so creating a user failed: sudoRole and ldapPublicKey were unknown
objectClasses (LDAP objectClassViolation 65) and sudoHost/sudoCommand/sudoUser
and sshPublicKey were unknown attributes.
Ship the two missing schemas and include them in slapd.conf:
- ops/schema/sudo.schema (sudoRole + sudo* attributes)
- ops/schema/openssh-lpk.schema (sshPublicKey + ldapPublicKey)
sudoRole is AUXILIARY here, not STRUCTURAL as in upstream sudo. The app
attaches sudoRole directly onto the user entry, which is already inetOrgPerson
(STRUCTURAL); two unrelated structural classes violate RFC 4512 and OpenLDAP
rejects with 65. AUXILIARY lets it coexist with inetOrgPerson — the app's
per-user-sudoers model. sudo's LDAP backend still finds entries via
(objectClass=sudoRole) regardless. ldapPublicKey is AUXILIARY as in upstream
openssh-lpk.
Also fix the build error from the previous theta42 schema PR: .dockerignore
excluded all of ops/, so 'COPY ops/schema/theta42.schema' failed at build
time ('not found' — file is git-tracked but stripped from the context). Re-
include ops/schema/*.schema with !exceptions, matching the existing
README.md/tos.md pattern.
Co-Authored-By: Claude <noreply@anthropic.com>
49 lines
843 B
Plaintext
49 lines
843 B
Plaintext
# Git
|
|
.git
|
|
.gitignore
|
|
|
|
# Development
|
|
.claude
|
|
*.md
|
|
# README.md and tos.md are both read at runtime (tos.md is loaded by
|
|
# routes/index.js at boot), so they must stay in the build context.
|
|
!README.md
|
|
!tos.md
|
|
|
|
# Tests
|
|
nodejs/tests/
|
|
nodejs/*.test.js
|
|
|
|
# Host dependency tree — let the image run a clean `npm ci`. Also avoids
|
|
# copying platform-wrong native modules (e.g. bcrypt built for the host OS).
|
|
nodejs/node_modules
|
|
|
|
# IDE
|
|
.vscode
|
|
.idea
|
|
*.swp
|
|
*.swo
|
|
|
|
# Logs
|
|
*.log
|
|
logs/
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# Docker (prevent recursive copy)
|
|
Dockerfile*
|
|
docker-compose.yml
|
|
.dockerignore
|
|
|
|
# Ops scripts (not needed in container) — except the custom LDAP schema files,
|
|
# which Dockerfile.openldap COPYs into the image for the bundled slapd.
|
|
ops/
|
|
!ops/schema/
|
|
!ops/schema/*.schema
|
|
|
|
# Secrets (mount at runtime instead)
|
|
nodejs/conf/secrets.js
|
|
secrets.js
|