MariaDB with PAM authentication via LDAP against an ActiveDirectory server

This image directly derives from the official mariadb image from docker hub, (https://hub.docker.com/_/mariadb).

It is built via a CI/CD pipeline on Gitlab from the repository https://gitlab.com/wolutator/mariadb-with-ldap-pam.

It can be pulled either using docker pull registry.gitlab.com/wolutator/mariadb-with-ldap-pam or from Docker Hub using docker pull wollud1969/mariadb-with-ldap-pam.

The libpam_ldap package is installed and configured. Final values for the LDAP configuration are loaded at start time of the container from environment variables given on the command line.

These variables are

• LDAPURI: LDAP URI, like ldap://dc.yourdomain.com:389
• LDAPBASE: Search base, like DC=YOURDOMAIN, DC=com
• LDAPBINDDN: DN of a user to read on the ActiveDirectory server
• LDAPBINDPW: Password of that user

Start the container after creating the required volumes (see documentation of the original mariadb image) with something like this:

docker run --rm --name mariadb \
  -e LDAPURI="ldap://dc.yourdomain.com:389" \
  -e LDAPBASE="dc=YOURDOMAIN,dc=com" \
  -e LDAPBINDDN="ldapbinddn" \
  -e LDAPBINDPW="ldapbindpw" \
  -e MYSQL_ROOT_PASSWORD=test123 \
  wollud1969/mariadb-with-ldap-pam:latest

Since one important scenario in my environment is access from dotnet applications, where the client plugin dialog is not available (https://mariadb.com/kb/en/library/authentication-plugin-pam/#using-the-plugin-with-mysqlconnector-for-net), I've add the configuration line

pam_use_cleartext_plugin = ON

to the default configuration. This in turn requires SSL/TLS connections to the database server so I added the SSL configuration to the default config file.

To enable users to access the database server with PAM/LDAP authentication, you still need to create those users in the database:

CREATE USER username@hostname IDENTIFIED VIA pam USING 'mariadb';

For details see https://mariadb.com/kb/en/library/authentication-plugin-pam/