From 084c8fdfb32a36f9fdecf0e735a9d101aff20aa6 Mon Sep 17 00:00:00 2001
From: William Mantly <wmantly@gmail.com>
Date: Thu, 30 Jul 2026 09:47:54 -0400
Subject: [PATCH] Add ldap-test-host: a real LDAP-joined downstream host for
 testing jump-host

New optional service (jump-host compose profile) built from the new
theta42/ldap-client submodule: a genuinely SSSD + AuthorizedKeysCommand
LDAP-joined host, not a container with a manually-dropped public key in
authorized_keys. Lets jump-host's actual key-injection -> upstream-connect
flow be exercised end-to-end against the local dev stack's own LDAP.

Verified: real SSH login through jump-host's uid_-_target grammar, live key
injection into LDAP, and ldap-test-host serving that key via
AuthorizedKeysCommand -- both via the SSH CLI and WinSCP.

config.example/ldap-test-host.vars.example documents the one field an
operator fills in (the ldapclient service account's bind password, already
generated by bootstrap.js as serviceAccountPass) -- the rest points at this
stack's own local LDAP by default.
---
 .gitmodules                                |  3 +++
 config.example/ldap-test-host.vars.example | 26 ++++++++++++++++++++++
 docker-compose.yml                         | 25 +++++++++++++++++++++
 ldap-client                                |  1 +
 4 files changed, 55 insertions(+)
 create mode 100644 config.example/ldap-test-host.vars.example
 create mode 160000 ldap-client

diff --git a/.gitmodules b/.gitmodules
index fa9fa7a..fa85c07 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -8,3 +8,6 @@
 	path = jump-host
 	url = https://github.com/theta42/jump-host.git
 	branch = master
+[submodule "ldap-client"]
+	path = ldap-client
+	url = https://github.com/theta42/ldap-client.git
diff --git a/config.example/ldap-test-host.vars.example b/config.example/ldap-test-host.vars.example
new file mode 100644
index 0000000..5b2be3b
--- /dev/null
+++ b/config.example/ldap-test-host.vars.example
@@ -0,0 +1,26 @@
+# ldap-client config for the optional local jump-host test fixture
+# (ldap-test-host service in docker-compose.yml, jump-host compose profile).
+# Copy to ./config/ldap-test-host.vars and fill in the bind password from
+# your own ./config/sso-secrets.js's `serviceAccountPass` (the
+# cn=ldapclient,ou=people,<base> service account bootstrap/bootstrap.js
+# creates specifically for this kind of 3rd-party/container LDAP bind).
+#
+# This is what lets ldap-test-host be a REAL SSSD+AuthorizedKeysCommand-joined
+# downstream host, so jump-host's key-injection -> upstream-connect flow can
+# be exercised end-to-end against something more than a container with a
+# manually-dropped public key in authorized_keys.
+export ldap_host="sso-manager"
+export ldap_base_dn="dc=localtest,dc=me"
+
+export ldap_bind_dn="cn=ldapclient,ou=People,$ldap_base_dn"
+export ldap_bind_password="REPLACE_WITH_serviceAccountPass_FROM_sso-secrets.js"
+
+# sso_url/sso_token deliberately left unset -- register the host + access
+# group manually via the Directory admin API instead (index.sh's optional
+# auto-registration also wants a parent site Resource to exist first).
+# index.sh gates that block on `[[ -v sso_token ]]`, which is true even for
+# an empty string, so leave these genuinely absent, not "".
+
+export ldap_location="jumptest"
+
+ldap_access_groups=( "${ldap_location}_access" "${ldap_location}_host_$(hostname)_access" )
diff --git a/docker-compose.yml b/docker-compose.yml
index e7b6621..e376c5b 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -189,6 +189,31 @@ services:
       - jump-data:/var/lib/jump-host  # generated host keys persist here
       - jump-redis-data:/data         # Redis (sessions, OAuth state, API tokens) persists here
 
+  # A real, LDAP-joined (SSSD + AuthorizedKeysCommand) downstream host for
+  # testing jump-host's actual key-injection -> upstream-connect flow --
+  # a container with a manually-dropped public key in authorized_keys never
+  # exercises the LDAP-key-serving path a real production host does. Built
+  # from the theta42/ldap-client submodule -- see ./config/ldap-test-host.vars
+  # for setup notes. Same jump-host profile, so
+  # `docker compose --profile jump-host up` brings up jump-host and a host it
+  # can actually reach together.
+  ldap-test-host:
+    profiles: ["jump-host"]
+    build:
+      context: ./ldap-client
+      dockerfile: Dockerfile
+    container_name: ldap-test-host
+    hostname: ldap-test-host
+    restart: unless-stopped
+    networks: [theta-net]
+    depends_on:
+      sso-manager:
+        condition: service_healthy
+    privileged: false
+    volumes:
+      - ./config/ldap-test-host.vars:/config/ldap.vars:ro
+      - ./config/ldap-ca.crt:/config/ldap-ca.crt:ro
+
 networks:
   theta-net:
     driver: bridge
diff --git a/ldap-client b/ldap-client
new file mode 160000
index 0000000..f6cf923
--- /dev/null
+++ b/ldap-client
@@ -0,0 +1 @@
+Subproject commit f6cf92397431bb0dd0ea7d8e439f73cc83a510c2