Skip to main content

Deploying and Configuring an OpenLDAP Server using Docker

Prerequisite: Complete all steps in prerequisites before beginning deployment.

1. Install Required Software​

1.1 System Packages​

Install essential utilities:

sudo apt install -y git openssl curl coreutils grep jq ufw wget unzip

1.2 Docker and Compose​

Install Docker and enable the service, then install the compose plugin:

sudo curl -sSL https://get.docker.com/ | CHANNEL=stable sh
sudo systemctl enable --now docker

sudo apt install docker-compose-plugin docker-compose

2. Install ldap​

2.1 Create a docker compose file with the below configuration under /opt/ldap folder​

# OpenLDAP Server
  ldap:
    image: osixia/openldap:1.5.0
    container_name: openldap-server
    environment:
      LDAP_ORGANISATION: ${LDAP_ORGANISATION:-UCC Organization}
      LDAP_DOMAIN: ${LDAP_DOMAIN:-example.com}
      LDAP_BASE_DN: ${LDAP_BASE_DN:-dc=example,dc=com}
      LDAP_ADMIN_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin_secure_password}
      LDAP_CONFIG_PASSWORD: ${LDAP_CONFIG_PASSWORD:-config_secure_password}
      LDAP_READONLY_USER: ${LDAP_READONLY_USER:-true}
      LDAP_READONLY_USER_USERNAME: ${LDAP_READONLY_USER_USERNAME:-readonly}
      LDAP_READONLY_USER_PASSWORD: ${LDAP_READONLY_USER_PASSWORD:-readonly_secure_password}
    volumes:
      - ldap_data:/var/lib/ldap
      - ldap_config:/etc/ldap/slapd.d
    networks:
      - sso-network
    healthcheck:
      test: ["CMD", "ldapwhoami", "-D", "cn=admin,${LDAP_BASE_DN:-dc=example,dc=com}", "-w", "${LDAP_ADMIN_PASSWORD:-admin_secure_password}"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

volumes:
  ldap_data:
  ldap_config:

networks:
  sso-network:

2.2 Complete the settings by updating the appropriate values for the variables​

# LDAP Configuration
LDAP_ORGANISATION=
LDAP_DOMAIN=
LDAP_BASE_DN=
LDAP_ADMIN_PASSWORD=
LDAP_CONFIG_PASSWORD=
LDAP_READONLY_USER=true
LDAP_READONLY_USER_USERNAME=readonly
LDAP_READONLY_USER_PASSWORD=
PHPLDAPADMIN_PORT=8090

2.3 Bring up the ldap services​

cd /opt/ldap
docker compose up -d

Note the container ID of the ldap, which we will use later.

2.4 Verify that the ldap is configured correctly​

Run the below command to check

docker-compose exec ldap ldapwhoami \
  -D "cn=admin,dc=example,dc=com" \
  -w $LDAP_ADMIN_PASSWORD

2.5 Generate Password Hashes​

Before adding users, generate SSHA hashes for the passwords using slappasswd:

# For readonly user
slappasswd -s readonly_secure_password

# For mailuser
slappasswd -s mailuser_password

# For meetuser
slappasswd -s meetuser_password

# For collabuser
slappasswd -s collabuser_password

Replace the {SSHA}<generated key> in the LDIF files with the actual hashes generated.

2.6 Add the basic settings and organizational units​


# Create organizational units
dn: ou=users,dc=example,dc=com
objectClass: organizationalUnit
ou: users

dn: ou=groups,dc=example,dc=com
objectClass: organizationalUnit
ou: groups

dn: ou=system,dc=example,dc=com
objectClass: organizationalUnit
ou: system

# Create read-only user (for Keycloak)
dn: cn=readonly,ou=system,dc=example,dc=com
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: readonly
userPassword: {SSHA}<generated key with the actual password>

Copy this file into the ldap container to execute.

docker cp ./ldap-init-org.ldif <ldapContainerID>:/tmp/ldap-init-org.ldif

Execute the below command to load the settings

docker-compose exec -T ldap ldapadd \
  -x \
  -D "cn=admin,dc=example,dc=com" \
  -w <LDAP_ADMIN_PASSWORD> \
  -f /tmp/ldap-init-org.ldif

2.6 Add a few users to the ldap​

create the ldif file with the below user data

# Department groups
dn: cn=email,ou=groups,dc=example,dc=com
objectClass: groupOfNames
cn: Email
description: Email Team
member: uid=mailuser,ou=users,dc=example,dc=com

dn: cn=meet,ou=groups,dc=example,dc=com
objectClass: groupOfNames
cn: Meet
description: Meet Team
member: uid=meetuser,ou=users,dc=example,dc=com

dn: cn=collab,ou=groups,dc=example,dc=com
objectClass: groupOfNames
cn: Collab
description: Collab Team
member: uid=collabuser,ou=users,dc=example,dc=com

# Management group
dn: cn=administrators,ou=groups,dc=example,dc=com
objectClass: groupOfNames
cn: administrators
description: System Administrators
member: uid=mailuser,ou=users,dc=example,dc=com
member: uid=meetuser,ou=users,dc=example,dc=com
member: uid=collabuser,ou=users,dc=example,dc=com

# Mail department user
dn: uid=mailuser,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
uid: mailuser
cn: Mail User
sn: User
givenName: Mail
mail: mailuser@example.com
telephoneNumber: +91-9999999999
departmentNumber: email
title: Email User
userPassword: {SSHA}<generated key with the actual password>

# Meet department user
dn: uid=meetuser,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
uid: meetuser
cn: Meet User
sn: User
givenName: Meet
mail: meetuser@example.com
telephoneNumber: +91-9999999999
departmentNumber: Meet
title: Meet User
userPassword: {SSHA}<generated key with the actual password>

# Collab department user
dn: uid=collabuser,ou=users,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
uid: collabuser
cn: Collab User
sn: User
givenName: Collab
mail: collabuser@example.com
telephoneNumber: +91-9999999999
departmentNumber: Collab
title: Collab User
userPassword: {SSHA}<generated key with the actual password>

Copy this file into the ldap container to execute.

docker cp ./ldap-init-users.ldif <ldapContainerID>:/tmp/ldap-init-users.ldif

Execute the below command to load the settings

docker-compose exec -T ldap ldapadd \
  -x \
  -D "cn=admin,dc=example,dc=com" \
  -w <LDAP_ADMIN_PASSWORD> \
  -f /tmp/ldap-init-users.ldif