gnutls

service/slapd/slapd.sh

@@ -73,23 +73,24 @@ if [ ! -e /etc/ldap/slapd.d/docker_bootstrapped ]; then
   if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then
     status "certificates found"
 
-    chmod 600 /etc/ldap/ssl/ldap.key
   else
 
-    #generate default tls certificates / set domain name
+    # generate default tls certificate
     export SSL_SLAPD_COMMON_NAME="$DOMAIN_NAME"
     export SSL_SLAPD_ORGANIZATION="${LDAP_ORGANISATION}"
 
-    /sbin/ssl-create-cert slapd /etc/ldap/ssl/ldap.crt /etc/ldap/ssl/ldap.key
-    ln -s /etc/ssl/certs/docker_baseimage_cacert.pem /etc/ldap/ssl/ca.crt
+    /sbin/ssl-gnutls-create-signed-cert slapd /etc/ldap/ssl/ldap.crt /etc/ldap/ssl/ldap.key
+    ln -s /etc/ssl/certs/docker_baseimage_gnutls_cacert.pem /etc/ldap/ssl/ca.crt
 
   fi
 
-  sed -i 's,TLS_CACERT.*,TLS_CACERT ./etc/ldap/ssl/ca.crt,g' /etc/ldap/ldap.conf
-
   # Fix permission on certificates
   chown openldap:openldap -R /etc/ldap/ssl
+  chmod 600 /etc/ldap/ssl/ldap.key
 
+  # ldap client config
+  sed -i 's,TLS_CACERT.*,TLS_CACERT /etc/ldap/ssl/ca.crt,g' /etc/ldap/ldap.conf
+ 
   # create DHParamFile if not found
   [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048
 
@@ -97,7 +98,7 @@ if [ ! -e /etc/ldap/slapd.d/docker_bootstrapped ]; then
 
   # add fake dnsmasq route to certificate cn
   cn=$(openssl x509 -in /etc/ldap/ssl/ldap.crt -subject -noout | sed -n 's/.*CN=\(.*\)\/*\(.*\)/\1/p')
-  echo "127.0.0.1	" $cn >> /etc/dhosts
+  /sbin/dns-add-host 127.0.0.1 $cn
 
   # Replication
   # todo :)

test/test.out

@@ -0,0 +1,33 @@
+docker run --name openldap-repository-test-container --dns=127.0.0.1 -v /home/bgouny/Bureau/pop/docker-openldap/test/tls/ssl:/etc/ldap/ssl -d osixia/openldap:latest  /sbin/my_init --enable-insecure-key
+ --> Obtaining IP
+ --> 172.17.0.37
+ldapsearch -x -h ldap-test.example.com -b dc=example,dc=com -ZZ
+# extended LDIF
+#
+# LDAPv3
+# base <dc=example,dc=com> with scope subtree
+# filter: (objectclass=*)
+# requesting: ALL
+#
+
+# example.com
+dn: dc=example,dc=com
+objectClass: top
+objectClass: dcObject
+objectClass: organization
+o: Example Inc.
+dc: example
+
+# admin, example.com
+dn: cn=admin,dc=example,dc=com
+objectClass: simpleSecurityObject
+objectClass: organizationalRole
+cn: admin
+description: LDAP administrator
+
+# search result
+search: 3
+result: 0 Success
+
+# numResponses: 3
+# numEntries: 2

test/tools/run-container.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 
-echo "docker run --name $testContainer $runOptions -d $testImage $runCommand"
-ID=`docker run --name $testContainer $runOptions -d $testImage $runCommand`
+echo "docker run --name $testContainer $runOptions -d $testImage $runCommand /sbin/my_init --enable-insecure-key"
+ID=`docker run --name $testContainer $runOptions -d $testImage $runCommand /sbin/my_init --enable-insecure-key`
 sleep 10
 
 echo " --> Obtaining IP"