4 Commits

16 changed files with 240 additions and 30 deletions

View File

@ -5,7 +5,6 @@ stages:
variables:
IMAGE_NAME: registry.gitlab.com/wolutator/mariadb-with-ldap-pam
HUB_IMAGE_NAME: wollud1969/mariadb-with-ldap-pam
build:
stage: build
@ -15,11 +14,7 @@ build:
- docker
script:
- VERSION=`cat VERSION`
- docker build --tag $IMAGE_NAME:latest --tag $IMAGE_NAME:$VERSION --tag $HUB_IMAGE_NAME:$VERSION --tag $HUB_IMAGE_NAME:latest .
- docker build --tag $IMAGE_NAME:$VERSION .
- docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
- docker push $IMAGE_NAME:latest
- docker push $IMAGE_NAME:$VERSION
- docker login -u $DOCKER_HUB_LOGIN -p $DOCKER_HUB_PASSWORD
- docker push $HUB_IMAGE_NAME:latest
- docker push $HUB_IMAGE_NAME:$VERSION

View File

@ -4,10 +4,10 @@ LABEL Maintainer="Wolfgang Hottgenroth <wolfgang.hottgenroth@icloud.com>"
LABEL ImageName="registry.gitlab.com/wolutator/mariadb-with-ldap-pam"
LABEL AlternativeImageName="wollud1969/mariadb-with-ldap-pam"
ENV LDAPBASE "DC=hottis,DC=de"
ENV LDAPURI "ldap://ldap.hottis.de:389"
ENV LDAPBINDDB ""
ENV LDAPBINDPW ""
ENV LDAPBASE "dc=example,dc=org"
ENV LDAPURI "ldap://ldapserver:389"
ENV LDAPBINDDN "cn=admin,dc=example,dc=org"
ENV LDAPBINDPW "admin"
RUN \
apt-get update && \
@ -19,6 +19,12 @@ COPY pam.conf-tail /etc
COPY ldap.conf-tmpl /etc
COPY load_pam_plugin.cnf /etc/mysql/conf.d
RUN mkdir /etc/mysql/conf.d/ssl
COPY test/ca.pem /etc/mysql/conf.d/ssl/
COPY test/server-cert.pem /etc/mysql/conf.d/ssl/
COPY test/server-key.pem /etc/mysql/conf.d/ssl/
RUN \
cd /usr/local/bin && \
tail -n +2 docker-entrypoint.sh > docker-entrypoint.sh-tail && \

View File

@ -1 +1 @@
0.2-10.4
TEST-0.2-10.4

View File

@ -1,18 +1,8 @@
base %LDAPBASE%
uri %LDAPURI%
binddn %LDAPBINDDN%
bindpw %LDAPBINDPW%
base dc=example,dc=org
uri ldap://ldapserver
binddn cn=admin,dc=example,dc=org
bindpw admin
ldap_version 3
referrals off
pam_login_attribute samaccountname
pam_member_attribute member
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute shadowLastChange pwdLastSet
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad
pam_login_attribute cn
pam_filter objectclass=Person

View File

@ -5,9 +5,9 @@ pam_use_cleartext_plugin = ON
# create these stuff and enable the following configuration
# otherwise the pam_use_cleartext_plugin won't work which
# is required for dotnet connections
# ssl_cert = /etc/mysql/conf.d/ssl/server-cert.pem
# ssl_key = /etc/mysql/conf.d/ssl/server-key.pem
# ssl_ca = /etc/mysql/conf.d/ssl/ca.pem
ssl_cert = /etc/mysql/conf.d/ssl/server-cert.pem
ssl_key = /etc/mysql/conf.d/ssl/server-key.pem
ssl_ca = /etc/mysql/conf.d/ssl/ca.pem

6
test/bs.ldif Normal file
View File

@ -0,0 +1,6 @@
dn: cn=testuser, dc=example, dc=org
cn: testuser
sn: x
objectclass: person
userPassword: {SSHA}s6r452wLeTdlWqCsU6hkEwmJT2MbJ9Ex

13
test/bs.sql Normal file
View File

@ -0,0 +1,13 @@
create user 'testuser'@'%' identified via pam using 'mariadb';
create database testdb;
grant all privileges on testdb.* to 'testuser'@'%';
flush privileges;
use testdb;
create table testtable (
id int primary key auto_increment,
bla varchar(32)
);
insert into testtable (bla) values('bla1');
insert into testtable (bla) values('bla2');
insert into testtable (bla) values('bla3');

27
test/ca-key.pem Normal file
View File

@ -0,0 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAv8IWzqW76BgP3jz0kh6+bBZhGsLHCAB5VUrYXQggO8KKD+Px
GlBAKxmDo5iFxWSKa3tdjLs/xm3H8W20V12xUUOYTiD8p1KdxoC0mfx5Zg/8Um2y
vg5qjekhzltVYnZYz33lkTHojWYIGpp+kc24eupK7asU8XEjC+ZY9EuBnqftGlOo
hNlPQ7Gw3Xb+yjbdsMa724XszWrx1N1a5idRgKt/OSrVlrB56/x32DpSr6AJlobj
RhB1/Q4dXf+S4g9E/noFH+1fnI59jxRR3cOjokEfqJrax48g072xU2noS2NzhMFB
5nvhbkfIWysyBTh1HDUGHxUCL4PLMdwUFwVvowIDAQABAoIBAB2szZbBMykhwCLm
T/rk4xcbB3/6sI5edGhsorsS7NoSqwb2gXNPA/8nfaWtjtYTTxB/EOUcfSwaBR0p
mwUCLNSkn0dH95F1SZFUjZ5e4fKXerbO3yBmXrsDXwXuQHJyWiASHZqwnIp1Rb/I
NNofefMbmujY1u7eUUwgI5f6r1573a3L/KGs2ZD05hy/vUkuYpA4QeFQ9WnN9PEJ
PXOH55snDo9b5PXqF6k8qf3tT5bYRcTZaJSfRusXMTC1lJBjj55j7YYGxZsWaieD
7PTVBMBecV8wDUDYsMq3eTGG1664A+TZxXIYStyrVNHnzwEimhb73nj80159gFqk
cqW8SoECgYEA45MsaQSC4EaIBGA9EsJh6Pt4Ql7sSy9DtHyJe1gQuIwC3aImj44p
aB8bkpsElvbuMPn683ja7YCPozUhTyOAaoiZYdNEtdrh01wQDspg6lKWPDPLDpc0
q+mQeLbmeciTazHTb95xF9hHNUTxU+Tj9e4Dznz8oSaBxeESvJoVw2ECgYEA17Wo
HuXSY4i8p1lJN658KZlrTEO8JLQHQ9URH0u4HWWSoLiggsT0YFGKPEHSSzDMLs7z
FpJmXKhcccgsbk1sEf4+cA9qU2Io7EiSKIChvMJvoLoW0PZMlT0qCv/22ylqJF7m
5ZJfX38g5YuIcmwDpHKMJrMgMea1Nu/Wr+4LlYMCgYEAmIDxy9Z4Fe9uCvCrPL0C
e+y45FFUK/YaewLR5tRXMDSzXu7gxGbSHLJr+czkQH5tlGiQ4UPmAi6bExXxomT6
E2pCzymS7AMoPkl9gUvhsmVxxBo5QyfU5jd410xKGuZs0/Lp7Be21fHbljkDN+M1
WIMODfv4F84EPSTdN4JSf0ECgYBrErXQGH5Vf+M9InnQlOD2+TukkJ7MjTxp9FJa
eYh7txaQhvTN1JwFT5RRks6jGibQOVO66ZK7/apdpGJBola5m708fLpnh3sOxnse
dbNS8iTc4GJA+XFMRx8edK4BXc5dHWp5nC2RRpZ6usdRHMK2F1HwR8v8WSusiGLF
02CWpwKBgDuuGghGo0JS/ItzbGnyX3/Uqk8oq7+j0075l87QxJKAgn41bW3tVl6D
bC0pkhykAOZWtHpM30fOvJvXMb8Zd8UXuttcNM0eF2kWZZezh0GUZM4ja1d6+bUf
P8iOmy7JJuusUJA/YJhGmW0QIsLTy2wW6YcW/XB1w9fbv9d6gKtd
-----END RSA PRIVATE KEY-----

23
test/ca.pem Normal file
View File

@ -0,0 +1,23 @@
-----BEGIN CERTIFICATE-----
MIID6jCCAtKgAwIBAgIJAPXMf17zQKpzMA0GCSqGSIb3DQEBCwUAMIGIMQswCQYD
VQQGEwJERTEMMAoGA1UECAwDTlJXMQ4wDAYDVQQHDAVFc3NlbjESMBAGA1UECgwJ
aG90dGlzLmRlMQ4wDAYDVQQLDAV0ZXN0czEYMBYGA1UEAwwPdGVzdHMuaG90dGlz
LmRlMR0wGwYJKoZIhvcNAQkBFg53b2hvQGhvdHRpcy5kZTAgFw0xOTA5MjMxNTM5
MjVaGA8zMDE5MDEyNDE1MzkyNVowgYgxCzAJBgNVBAYTAkRFMQwwCgYDVQQIDANO
UlcxDjAMBgNVBAcMBUVzc2VuMRIwEAYDVQQKDAlob3R0aXMuZGUxDjAMBgNVBAsM
BXRlc3RzMRgwFgYDVQQDDA90ZXN0cy5ob3R0aXMuZGUxHTAbBgkqhkiG9w0BCQEW
DndvaG9AaG90dGlzLmRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
v8IWzqW76BgP3jz0kh6+bBZhGsLHCAB5VUrYXQggO8KKD+PxGlBAKxmDo5iFxWSK
a3tdjLs/xm3H8W20V12xUUOYTiD8p1KdxoC0mfx5Zg/8Um2yvg5qjekhzltVYnZY
z33lkTHojWYIGpp+kc24eupK7asU8XEjC+ZY9EuBnqftGlOohNlPQ7Gw3Xb+yjbd
sMa724XszWrx1N1a5idRgKt/OSrVlrB56/x32DpSr6AJlobjRhB1/Q4dXf+S4g9E
/noFH+1fnI59jxRR3cOjokEfqJrax48g072xU2noS2NzhMFB5nvhbkfIWysyBTh1
HDUGHxUCL4PLMdwUFwVvowIDAQABo1MwUTAdBgNVHQ4EFgQUEifdfbOvExrBFu9h
igyZs/G9wL8wHwYDVR0jBBgwFoAUEifdfbOvExrBFu9higyZs/G9wL8wDwYDVR0T
AQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAtIAJsNEeN85ghbKrA3Ti0nou
lhK1igQ+xjqupt4uNSbxXRHWoib5gEVzApD4suO0IkqHmDhdLCNXB+FE5KfVhc3h
TWOuVjvuJkijSZAtSV494pnyQ62w5MboaQw31NUKQwj5uSZVxYEDDyoarNBWBR7O
w16uhRfiird5iWj5XpSFVLnX2ePlobZhhsEKbo8FODWLv+oin9v7KNSEZ+F/6gGv
strM0lHx28pe7Y7cFNTc+0a32lFvm1QJk773Aia7SZlTZF/cKpqznffEYG7r/MoK
yfxb7j/DTTyoR9+YYTjCuBKPgH4/TOCD3tcvUnvGCCq0M+YzpIUE0J7XIIh5Dg==
-----END CERTIFICATE-----

View File

@ -0,0 +1,14 @@
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>netcoreapp2.2</TargetFramework>
<ApplicationIcon />
<StartupObject>DatabaseTest.Program</StartupObject>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="MySqlConnector" Version="0.56" />
</ItemGroup>
</Project>

46
test/dotnet/Program.cs Normal file
View File

@ -0,0 +1,46 @@
using MySql.Data.MySqlClient;
using System;
using System.Data;
namespace DatabaseTest
{
class Program
{
private const string SERVER_ADDRESS = "127.0.0.1";
private const string SERVER_PORT = "3306";
private const string DATABASE_NAME = "testdb";
private const string USERNAME = "testuser";
private const string PASSWORD = "test123";
static void Main(string[] args)
{
string connectionStr = $"Server={SERVER_ADDRESS};Port={SERVER_PORT};Database={DATABASE_NAME};Uid={USERNAME};Pwd={PASSWORD}";
MySqlConnection con = new MySqlConnection();
con.ConnectionString = connectionStr;
try
{
con.Open();
MySqlCommand cmd = con.CreateCommand();
cmd.CommandText = "SELECT * FROM testtable";
var reader = cmd.ExecuteReader();
DataTable dt = new DataTable();
dt.Load(reader);
con.Close();
}
catch (MySqlException sqlEx)
{
Console.WriteLine(sqlEx.Message);
Console.WriteLine();
Console.WriteLine(sqlEx.InnerException?.Message);
}
Console.WriteLine("Press any key to close.");
Console.ReadKey();
}
}
}

2
test/readme.md Normal file
View File

@ -0,0 +1,2 @@
Certificate creation: https://mariadb.com/kb/en/library/certificate-creation-with-openssl/

22
test/server-cert.pem Normal file
View File

@ -0,0 +1,22 @@
-----BEGIN CERTIFICATE-----
MIIDkjCCAnoCAQEwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYTAkRFMQwwCgYD
VQQIDANOUlcxDjAMBgNVBAcMBUVzc2VuMRIwEAYDVQQKDAlob3R0aXMuZGUxDjAM
BgNVBAsMBXRlc3RzMRgwFgYDVQQDDA90ZXN0cy5ob3R0aXMuZGUxHTAbBgkqhkiG
9w0BCQEWDndvaG9AaG90dGlzLmRlMCAXDTE5MDkyMzE1NDAyN1oYDzMwMTkwMTI0
MTU0MDI3WjCBkjELMAkGA1UEBhMCREUxDDAKBgNVBAgMA05SVzEOMAwGA1UEBwwF
RXNzZW4xEjAQBgNVBAoMCWhvdHRpcy5kZTEYMBYGA1UECwwPdGVzdHMuaG90dGlz
LmRlMRgwFgYDVQQDDA90ZXN0cy5ob3R0aXMuZGUxHTAbBgkqhkiG9w0BCQEWDndv
aG9AaG90dGlzLmRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsY2G
xA3gic/0oRhxGSKqA0WOV4eb/GvUjl1X2S8SXtqKcTt4vNJgHpOp4cQh+NdBEJ/p
COrSyGMgwwge0OBNFMU+Koqz/+oMpO1b8pyZIBnGr859US4iMt88wZuyse52RhW8
405JbX/AH4GyOx9xJ98T0Qe2+incUzL3Y2d0fw4GQohGkFcznOhXovEtULPAm0ib
v/o788Q2iohKYfPGi0q4TLt/RnEFPjiccjW0+Vz8Px6iG5qzLBmPu+Liv3UCWCtZ
+GrHO5f0or88CyJIQSWaY4WYgNeAGetJCXjUJWpzhRlYblWucX6FsGHpfmckyCKi
W8DapnlWGtX78YTF4wIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBRplmI+luBRUMz
Z0/r0FlyutkshbGgglG4vWRTZJUhd5xEXDbD4tObBLH7tAzK5VHff+xG/Zdv9mwV
e4Lgxx7ph9qrxmwI95Pv2n70hYlfXZzJEc1YOTRsnkwo7fhtA99/mV6KeRmotviu
yZh8hVZ6yiW78/FYCIlcDKEeyUT8zNKhEJR0fXlVRCISz+bL0LMggp0Kd9EdeaRb
mwWeGsTxFSS2+JCU5JfuQF/HvQ3PFhzxVuAURSQ93yKX1VP1Lqxgb5dVPSdiFslN
jFfr8VoFGvyNjGPiRtdUlAVJ+3Ccpi1XRGlOww8Koy3xskSTpSt1JXpWEHUqyegK
hpo+q8a1
-----END CERTIFICATE-----

27
test/server-key.pem Normal file
View File

@ -0,0 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEAsY2GxA3gic/0oRhxGSKqA0WOV4eb/GvUjl1X2S8SXtqKcTt4
vNJgHpOp4cQh+NdBEJ/pCOrSyGMgwwge0OBNFMU+Koqz/+oMpO1b8pyZIBnGr859
US4iMt88wZuyse52RhW8405JbX/AH4GyOx9xJ98T0Qe2+incUzL3Y2d0fw4GQohG
kFcznOhXovEtULPAm0ibv/o788Q2iohKYfPGi0q4TLt/RnEFPjiccjW0+Vz8Px6i
G5qzLBmPu+Liv3UCWCtZ+GrHO5f0or88CyJIQSWaY4WYgNeAGetJCXjUJWpzhRlY
blWucX6FsGHpfmckyCKiW8DapnlWGtX78YTF4wIDAQABAoIBAQClGI9GgAzYuGik
3wBTOftSXXv1AeDWf0G/OyZziaSQVK/EiGNFWG0OIYompuRb6XPTzI24v/lNYXdW
Qpe868Rg2uNqVVz4Sp6FQTxtRJXR1oX8dYnrUXV1TkTFVkx7zNtnYdEon2QBkHeK
FGQxO5RRWcmoZX8L8J6xMkP8x3b4p/mVPfhszREKT940wfRGIz5YbPNrJwUR8ILa
FeAtzKmHN06/LbjhuEdJNhFlJMViVTyLDif4lIsoVDj3cdrOkXpkvBxc8aNWk04G
qOIWP28CpYL8NJZFpOkrtdPoz4SNmNV/2iEh7wyt/1LCe13g02kppS71cNcn2GHb
AxGQzVxRAoGBAOI19t8p0XvCcKCiqI3xRWCYvnD0fzmEDlSWLTT6k3KwoV+WYTlm
sBu3Gx6OJzslZWjKO6SlLdKajAbByZave9xDsXvcymalov2aTjUJu0nKtfpB7M0L
nEJhT10yMVODe7LfVXAqbpjnBPzEfQHqURoB3rZP1KhTicdIIMjG/slZAoGBAMjv
M4Kvub0mL3k+s0eV8cCtwWW4gvGyJDQ0wLyFphdE2mWLSXkj5nbYQjwUDBRDCXBY
E/kE5b0lnN8ThPP+E3wHq2Vk6VvVaLxUVfQXpfGYSgDr8txLVKUVC9GQ0MDjrfyL
q7KLKG9wwbZADyF5igz0WzwRO8OEfvl1J1HXfyWbAoGAPpecBcf2dP4qV+hqJ0x5
W+8n0u10Pp/xryoWvDARmIyTOnXL1Sw60pBp6px+8ni4hLRgqIAkG8AzurLoas+H
wDzi4VkIkDqIzQ9jUH2u2w5CKEsRkPMDe8KdSTZYO7mIAsiVRYIYNCrIUIC17k+9
vSqDS4LvXtwupXupxqR5X5ECgYEAtr2tGDbe8qKO3HLks78v7a9Yyz1CgbQk7wHn
I81c3560DVPfD3hR+lX17xPAZJEPPYgtKfWFRz+06sCi0xCJAe0ruPxMq0NsjJMa
1PLI7e81pp7v8d/k7Ho2lHJjGHo42wzfq3KZ5LgkxK5/1E7n+Z4md3uo4clXfWJJ
z0nwje8CgYEAutOz6Nnvovy1kijwBXoE8W8OxqcyolHIPWxFM8m6WYK2B/r4RpPv
aOT2YMXODV75X1OQghG+GHO+qj0YQSLNcA9U0roWyIDrj6ritNdGv7rjZ8Egl5Y7
ajCB4antirDw2QkzfCOThP1m0SkXqOx73biXI1gPi6iRPweYCqvw4RU=
-----END RSA PRIVATE KEY-----

18
test/server-req.pem Normal file
View File

@ -0,0 +1,18 @@
-----BEGIN CERTIFICATE REQUEST-----
MIIC2DCCAcACAQAwgZIxCzAJBgNVBAYTAkRFMQwwCgYDVQQIDANOUlcxDjAMBgNV
BAcMBUVzc2VuMRIwEAYDVQQKDAlob3R0aXMuZGUxGDAWBgNVBAsMD3Rlc3RzLmhv
dHRpcy5kZTEYMBYGA1UEAwwPdGVzdHMuaG90dGlzLmRlMR0wGwYJKoZIhvcNAQkB
Fg53b2hvQGhvdHRpcy5kZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
ALGNhsQN4InP9KEYcRkiqgNFjleHm/xr1I5dV9kvEl7ainE7eLzSYB6TqeHEIfjX
QRCf6Qjq0shjIMMIHtDgTRTFPiqKs//qDKTtW/KcmSAZxq/OfVEuIjLfPMGbsrHu
dkYVvONOSW1/wB+BsjsfcSffE9EHtvop3FMy92NndH8OBkKIRpBXM5zoV6LxLVCz
wJtIm7/6O/PENoqISmHzxotKuEy7f0ZxBT44nHI1tPlc/D8eohuasywZj7vi4r91
AlgrWfhqxzuX9KK/PAsiSEElmmOFmIDXgBnrSQl41CVqc4UZWG5VrnF+hbBh6X5n
JMgiolvA2qZ5VhrV+/GExeMCAwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQBvvgv2
YQV5T74wmBPZcyvFlCKANH7t7WNexLvN956phbKuxyk9xlw52+AVJs4rb3zLJHQx
3B//X6KDL0m07GHrFPaQ726DAssHrEdXaiVb0htT86ImhxUqgYDAVbo1931uO/dD
io5EpdOYevmpUBl2oVVwfPbGzKHAZS4JMiGLVRIKbVymuUwK/XmfWMaXj+qB2Z9k
byf8hSi3NRX1qEHqClXsBvKmIOLY23cZxEU7XuB3xBydeN8BEND/ztLiPpJ1k8DU
hM4UhEqRSxVl7IIfZf1twWnkTDoLLs11NWLxdj8gGb0gYiaB1561/WmGDcA4j1Hd
FW4oxDpS1uG268DR
-----END CERTIFICATE REQUEST-----

21
test/startEnv.sh Executable file
View File

@ -0,0 +1,21 @@
#!/bin/bash
echo "Starting LDAP server"
docker run --name ldapserver --rm -d -p 389:389 osixia/openldap:1.2.5
echo "Wait until it settled"
sleep 10
echo "Load LDAP server"
cat bs.ldif | docker exec -i ldapserver ldapadd -x -H ldap://localhost -D "cn=admin,dc=example,dc=org" -w admin
echo "Start database server"
docker run -d --rm -e MYSQL_ROOT_PASSWORD=test123 -p 3306:3306 --name mariadb --link ldapserver registry.gitlab.com/wolutator/mariadb-with-ldap-pam:TEST-0.2-10.4
echo "Wait until it settled"
sleep 60
echo "Load database server"
cat bs.sql | docker exec -i mariadb mysql -h 127.0.0.1 -u root --password=test123 mysql