From 7ad67630c40c0669cc1c140ff2d42311fb780b47 Mon Sep 17 00:00:00 2001
From: Jonas Gunz <himself@jonasgunz.de>
Date: Thu, 27 Jul 2023 21:46:38 +0200
Subject: openldap move access control to hostettings

---
 roles/openldap/defaults/main.yml | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

(limited to 'roles/openldap/defaults/main.yml')

diff --git a/roles/openldap/defaults/main.yml b/roles/openldap/defaults/main.yml
index 4d18343..63094ee 100644
--- a/roles/openldap/defaults/main.yml
+++ b/roles/openldap/defaults/main.yml
@@ -11,4 +11,28 @@ ldap:
     key: '/etc/ssl/private/ssl-cert-snakeoil.key'
     cert: '/etc/ssl/certs/ssl-cert-snakeoil.pem'
   schema: []
-
+  ous:
+    - users
+    - apps
+    - groups
+    - unixgroups
+  groupsofnames:
+    in: 'ou=groups,dc=example,dc=com'
+    names:
+      - ldap_admin
+      - external_auth
+  access_control:
+    - >-
+      {0}to attrs=userPassword
+      by self write
+      by group/groupOfNames/member=cn=external_auth,ou=groups,dc=example,dc=com read
+      by anonymous auth
+      by * none
+    - >-
+      {1}to attrs=shadowLastChange
+      by self write
+      by * read
+    - >-
+      {2}to *
+      by users read
+      by group/groupOfNames/member=cn=ldap_admin,ou=groups,dc=example,dc=com manage
-- 
cgit v1.2.3