fix: publish plain LDAP (389) to the host so setup.sh can reach the directory (v1.39.0)

docker-compose only published LDAPS (636); plain LDAP (389) was not mapped, so the stack host's own enrollment (ldap://localhost:389) couldn't reach the LDAP server. Now both 389 + 636 are published (bind 0.0.0.0; LDAP_BIND/LDAPS_BIND to lock to host). README updated.
2026-08-05 00:13:49 -04:00
6 changed files with 16 additions and 89 deletions
@@ -8,18 +8,6 @@ orchestration code; see each submodule's own `CHANGELOG.md`
 [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md))
 for what changed inside the apps it composes.

-## [v1.41.0] - 2026-08-05
-
-### Fixed
- **The Local Docker daemon discovery plugin no longer errors** — the sso-manager container had no access to the host docker socket, so the seeded `docker-local` plugin (socketPath `/var/run/docker.sock`) failed with `ENOENT` and showed "Last run: error". `docker-compose.yml` now mounts `/var/run/docker.sock` into the container. Recreate the container (`docker compose up -d sso-manager`) and hit "Run now" on the plugin.
- **theta-agent ships the rebuilt binary with the heartbeat fix** (v1.3.1, gitlink `51750d0`) — the prebuilt `theta-agent-linux-amd64` predated the v1.3.0 `heartbeat_ack` fix, so the installed agent still logged "Unknown command type: heartbeat_ack". Now rebuilt + tested.
-
-## [v1.40.0] - 2026-08-05
-
-### Fixed
- **No more spurious "Invalid Credentials, login failed" during LDAP enrollment** (ldap-client v1.25.0, gitlink `68fcdb5`) — `index.sh` self-registered the host in the Directory when `sso_token` was *declared but empty* (it checked `[[ -v ]]`), POSTing an empty Bearer token and getting a misleading `LDAPLoginFailed`. It now only registers with a real token; the stack host (already seeded by the bootstrap) skips registration.
- **The `cn=ldapclient` service account now shows in the SSO Users UI** — it was created as a bare `organizationalRole` (invisible to the `posixAccount` user filter) and never joined `app_sso_service_account`, so it never appeared as a service account. The bootstrap now creates it as a `posixAccount` (uid 10001, above the regular-user reserved floor) and adds it to `app_sso_service_account`; for an existing account it best-effort adds the `posixAccount` shape (auxiliary, so it can't conflict with the structural `organizationalRole`) + the group membership.
-
 ## [v1.39.0] - 2026-08-05

 ### Fixed
@@ -178,88 +178,31 @@ function ldapModify(ldif) {
 }

 // ── 1. LDAP service account for the proxy ───────────────────────────────────
-// The proxy / ldap-client bind as cn=ldapclient. For it to SHOW in the SSO Users
-// UI as a service account it must (a) match the user filter (posixAccount) and
-// (b) be a member of app_sso_service_account (that membership is what the Users
-// page marks as a non-person/service account). Older bootstraps created it as a
-// bare organizationalRole (invisible to the Users list) and never joined the
-// group, so it never appeared. Both are fixed here; the existing-path shape add
-// is best-effort so a pre-existing account still binds even if the upgrade add
-// fails.
 function ensureServiceAccount() {
 	const pw = hashPasswordSSHA512(SVC_PASS);
-	const uidNum = '10001'; // distinct from the bootstrap admin's 10000; above uidGidReservedFloor so regular-user id allocation ignores it
 	if (entryExists(SVC_DN)) {
-		log(`Service account ${SVC_DN} exists — ensuring service-account shape + password`);
-		// Add the auxiliary posixAccount objectClass + required attrs so the entry
-		// matches the Users list filter. inetOrgPerson is deliberately NOT added:
-		// it is structural and would conflict with the existing organizationalRole.
-		const shape = [
-			`dn: ${SVC_DN}`,
-			'changetype: modify',
-			'add: objectClass',
-			'objectClass: posixAccount',
-			'-',
-			'add: uid',
-			'uid: ldapclient',
-			'-',
-			'add: uidNumber',
-			`uidNumber: ${uidNum}`,
-			'-',
-			'add: gidNumber',
-			`gidNumber: ${uidNum}`,
-			'-',
-			'add: homeDirectory',
-			'homeDirectory: /nonexistent',
-			'-',
-			'add: description',
-			'description: LDAP bind service account (proxy / ldap-client)',
-			'',
-		].join('\n');
-		const rs = ldapModify(shape);
-		if (rs.code !== 0 && !/already exists|Type or value exists/i.test(rs.stderr)) {
-			log('  service-account shape warning (account still binds):', rs.stderr.trim());
-		}
-		const rp = ldapModify([
+		log(`Service account ${SVC_DN} exists — resetting password to ./config`);
+		const r = ldapModify([
 			`dn: ${SVC_DN}`,
 			'changetype: modify',
 			'replace: userPassword',
 			`userPassword: ${pw}`,
 			'',
 		].join('\n'));
-		if (rp.code !== 0) log('  password reset warning:', rp.stderr.trim());
-	} else {
-		log(`Creating service account ${SVC_DN}`);
-		const entry = [
-			`dn: ${SVC_DN}`,
-			'objectClass: inetOrgPerson',
-			'objectClass: posixAccount',
-			'objectClass: top',
-			'cn: ldapclient',
-			'sn: ldapclient',
-			'uid: ldapclient',
-			`uidNumber: ${uidNum}`,
-			`gidNumber: ${uidNum}`,
-			'homeDirectory: /nonexistent',
-			'description: LDAP bind service account (proxy / ldap-client)',
-			`userPassword: ${pw}`,
-			'',
-		].join('\n');
-		const r = ldapAdd(entry);
-		if (r.code !== 0) throw new Error(`ldapadd service account failed: ${r.stderr.trim()}`);
+		if (r.code !== 0) log('  password reset warning:', r.stderr.trim());
+		return;
 	}
-	// Mark it as a service account (the Users UI's service-account signal).
-	const gdn = `cn=app_sso_service_account,ou=groups,${BASE_DN}`;
-	const rm = ldapModify([
-		`dn: ${gdn}`,
-		'changetype: modify',
-		'add: member',
-		`member: ${SVC_DN}`,
+	log(`Creating service account ${SVC_DN}`);
+	const r = ldapAdd([
+		`dn: ${SVC_DN}`,
+		'objectClass: organizationalRole',
+		'objectClass: simpleSecurityObject',
+		'objectClass: top',
+		'cn: ldapclient',
+		`userPassword: ${pw}`,
 		'',
 	].join('\n'));
-	if (rm.code === 0) log(`  marked ${SVC_DN} as a service account`);
-	else if (/already exists|Type or value exists/i.test(rm.stderr)) log(`  ${SVC_DN} already in app_sso_service_account`);
-	else log(`  app_sso_service_account membership warning:`, rm.stderr.trim());
+	if (r.code !== 0) throw new Error(`ldapadd service account failed: ${r.stderr.trim()}`);
 }

 // ── 2. First admin user ─────────────────────────────────────────────────────
@@ -81,10 +81,6 @@ services:
      - HTTPS_PROXY=${CFG_HTTPS_PROXY:-}
      - NO_PROXY=${CFG_NO_PROXY:-}
    volumes:
-      # The host docker socket so the bundled Docker discovery plugin (seeded as
-      # 'docker-local' with socketPath /var/run/docker.sock) can list containers.
-      # Without this the plugin errors with ENOENT and shows 'Last run: error'.
-      - /var/run/docker.sock:/var/run/docker.sock
      # Operator-edited SSO secrets (sso-secrets.js). Read-WRITE so the bootstrap
      # can write the generated OAuth client creds into proxy-secrets.js. The
      # entrypoint points CONF_SECRETS at /config/sso-secrets.js.