ansible-base/roles/ldap_server/tasks/ldap_tls.yml
2020-08-09 11:37:21 +02:00

125 lines
4.1 KiB
YAML

---
- name: olcTLSCACertificateFile configured (cn=config)
ldap_attr:
dn: "cn=config"
name: olcTLSCACertificateFile
values: "{{ openldap_confdir }}/sasl2/fullchain.pem"
state: exact
start_tls: yes
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
bind_dn: "{{ ldap_config_admin_user_dn }}"
bind_pw: "{{ ldap_config_admin_user_password }}"
notify: "restart slapd"
- name: olcTLSCACertificateFile configured (cn=config)
ldap_attr:
dn: "cn=config"
name: olcTLSCertificateKeyFile
values: "{{ openldap_confdir }}/sasl2/privkey.pem"
state: exact
start_tls: yes
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
bind_dn: "{{ ldap_config_admin_user_dn }}"
bind_pw: "{{ ldap_config_admin_user_password }}"
notify: "restart slapd"
- name: olcTLSCertificateFile configured (cn=config)
ldap_attr:
dn: "cn=config"
name: olcTLSCertificateFile
values: "{{ openldap_confdir }}/sasl2/cert.pem"
state: exact
start_tls: yes
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
bind_dn: "{{ ldap_config_admin_user_dn }}"
bind_pw: "{{ ldap_config_admin_user_password }}"
notify: "restart slapd"
- name: olcTLSProtocolMin configured (cn=config)
ldap_attr:
dn: "cn=config"
name: olcTLSProtocolMin
values: "3.3"
state: exact
start_tls: yes
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
bind_dn: "{{ ldap_config_admin_user_dn }}"
bind_pw: "{{ ldap_config_admin_user_password }}"
notify: "restart slapd"
- name: olcSecurity configured (cn=config)
ldap_attr:
dn: "cn=config"
name: olcSecurity
values: "tls=1"
state: exact
start_tls: yes
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
bind_dn: "{{ ldap_config_admin_user_dn }}"
bind_pw: "{{ ldap_config_admin_user_password }}"
notify: "restart slapd"
- name: TLS required (olcDatabase={-1}frontend,cn=config)
ldap_attr:
dn: "olcDatabase={-1}frontend,cn=config"
name: olcSecurity
values: "tls=1"
state: exact
start_tls: yes
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
bind_dn: "{{ ldap_config_admin_user_dn }}"
bind_pw: "{{ ldap_config_admin_user_password }}"
notify: "restart slapd"
- name: TLS required (olcDatabase={0}config,cn=config)
ldap_attr:
dn: "olcDatabase={0}config,cn=config"
name: olcSecurity
values: "tls=1"
state: exact
start_tls: yes
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
bind_dn: "{{ ldap_config_admin_user_dn }}"
bind_pw: "{{ ldap_config_admin_user_password }}"
notify: "restart slapd"
- name: TLS required (olcDatabase={1}mdb,cn=config)
ldap_attr:
dn: "olcDatabase={1}mdb,cn=config"
name: olcSecurity
values: "tls=1"
state: exact
start_tls: yes
server_uri: "ldap://{{ ldap_host }}:{{ ldap_port }}/"
bind_dn: "{{ ldap_config_admin_user_dn }}"
bind_pw: "{{ ldap_config_admin_user_password }}"
notify: "restart slapd"
#- name: olcTLSCipherSuite configured (cn=config)
# ldap_attr:
# dn: "cn=config"
# name: olcTLSCipherSuite
# #values: "ECDHE-RSA-AES256-SHA384:AES256-SHA256:!RC4:HIGH:!MD5:!aNULL:!EDH:!EXP:!SSLV2:!eNULL"
# values: "ALL:!NULL"
# # values: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
# state: exact
# start_tls: yes
# bind_dn: "{{ ldap_config_admin_user_dn }}"
# bind_pw: "{{ ldap_config_admin_user_password }}"
# notify: "restart slapd"
#
#- name: olcTLSDHParamFile configured (cn=config)
# ldap_attr:
# dn: "cn=config"
# name: olcTLSDHParamFile
# values: "{{ openldap_confdir }}/sasl2/slapd.dh.params"
# state: exact
# start_tls: yes
# bind_dn: "{{ ldap_config_admin_user_dn }}"
# bind_pw: "{{ ldap_config_admin_user_password }}"
# notify: "restart slapd"
- name: Force all notified handlers to run at this point, not waiting for normal sync points
meta: flush_handlers