diff --git a/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml b/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml
index 61ea6f2..810c4ce 100644
--- a/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml
+++ b/seed/applicationservice/2022.03.08/dovecot/dictionaries/22_dovecot.xml
@@ -8,6 +8,7 @@
/etc/postfix/main.cf
/etc/postfix/master.cf
/etc/postfix/relay_passwd
+ /etc/postfix/ldapsource.cf
/etc/pki/ca-trust/source/anchors/ca_MailServer.crt
/etc/pki/tls/certs/postfix.crt
/etc/pki/tls/private/postfix.key
@@ -41,8 +42,6 @@
/etc/dovecot/conf.d/auth-oauth2.conf.ext
/etc/dovecot/dovecot-oauth2.conf.ext
- /etc/dovecot/conf.d/auth-passwdfile.conf.ext
- /etc/dovecot/risotto_users
/etc/pki/ca-trust/source/anchors/ca_IMAPServer.crt
/etc/pki/tls/certs/dovecot.crt
/etc/pki/tls/private/dovecot.key
@@ -77,13 +76,9 @@
-
-
-
-
-
+
@@ -92,13 +87,6 @@
-
- domain_name_eth0
-
- local authentification
- cleartext
- local_authentification_password_
-
smtp_relay_address
lmtp_server
@@ -175,5 +163,12 @@
mail_domains
well_knowns
+
+ all
+ ldap_server_address
+ client_family
+ domain_name_eth0
+ mail_domains_calc
+
diff --git a/seed/applicationservice/2022.03.08/dovecot/templates/10-auth.conf b/seed/applicationservice/2022.03.08/dovecot/templates/10-auth.conf
index 113b796..d04ac00 100644
--- a/seed/applicationservice/2022.03.08/dovecot/templates/10-auth.conf
+++ b/seed/applicationservice/2022.03.08/dovecot/templates/10-auth.conf
@@ -137,6 +137,4 @@ auth_mechanisms = $auth_mechanisms xoauth2
!include auth-oauth2.conf.ext
# IMAP auth
!include auth-ldap.conf.ext
-# Internal users (ie. roundcube)
-!include auth-passwdfile.conf.ext
# None:
def calc_ldapclient_base_dn(ldap_base_dn: str,
family_name: str,
+ accounts: bool=False,
) -> str:
+ base = f'ou=accounts,{ldap_base_dn}'
+ if accounts:
+ return base
if not family_name:
- return f'ou=users,{ldap_base_dn}'
- return f'ou={family_name},ou=families,{ldap_base_dn}'
+ return f'ou=users,{base}'
+ families = f'ou=families,{base}'
+ if family_name != '-':
+ return f'ou={family_name},{families}'
+ return families
diff --git a/seed/applicationservice/2022.03.08/lemonldap/dictionaries/70_lemonldap_ng.xml b/seed/applicationservice/2022.03.08/lemonldap/dictionaries/70_lemonldap_ng.xml
index 5e5d601..e73c071 100644
--- a/seed/applicationservice/2022.03.08/lemonldap/dictionaries/70_lemonldap_ng.xml
+++ b/seed/applicationservice/2022.03.08/lemonldap/dictionaries/70_lemonldap_ng.xml
@@ -29,4 +29,13 @@
+
+
+ all
+ ldap_server_address
+ client_family
+ domain_name_eth0
+ lemon_mail_admin
+
+
diff --git a/seed/applicationservice/2022.03.08/lemonldap/extras/oauth2/00_oauth2.xml b/seed/applicationservice/2022.03.08/lemonldap/extras/oauth2/00_oauth2.xml
index 4d3db5f..56a6fec 100644
--- a/seed/applicationservice/2022.03.08/lemonldap/extras/oauth2/00_oauth2.xml
+++ b/seed/applicationservice/2022.03.08/lemonldap/extras/oauth2/00_oauth2.xml
@@ -8,7 +8,7 @@
-
+
HS512
diff --git a/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json b/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json
index 3410a9f..4ebfc5b 100644
--- a/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json
+++ b/seed/applicationservice/2022.03.08/lemonldap/templates/lmConf-1.json
@@ -29,7 +29,7 @@ commentStartToken = §
"ldapServer" : "ldaps://%%ldap_server_address",
"ldapVerify" : "required",
"ldapTimeout" : 120,
- "cfgAuthor" : "EOLE",
+ "cfgAuthor" : "Risotto",
"cfgNum" : 1,
"cfgVersion" : "2.0.9",
"demoExportedVars" : {
@@ -187,17 +187,19 @@ commentStartToken = §
"cat_%%index" : {
"catname" : "%%cat",
%for %%dico in %%remotes[%%cat]
- "%%dico['key']" : {
+ %for %%idx, %%uri in %%enumerate(%%dico['uri'])
+ "%%{dico['key']}_%%idx" : {
"options" : {
"description" : "%%dico['description']",
"display" : "auto",
"logo" : "%%dico['logo']",
"name" : "%%dico['name']",
- "uri" : "%%dico['uri']"
+ "uri" : "%%uri"
},
"type" : "application"
},
-%end for
+ %end for
+ %end for
"type" : "category"
}%slurp
%end for
diff --git a/seed/applicationservice/2022.03.08/mailman/dictionaries/31_mailman.xml b/seed/applicationservice/2022.03.08/mailman/dictionaries/31_mailman.xml
index 4ef3218..e3f4218 100644
--- a/seed/applicationservice/2022.03.08/mailman/dictionaries/31_mailman.xml
+++ b/seed/applicationservice/2022.03.08/mailman/dictionaries/31_mailman.xml
@@ -21,7 +21,7 @@
-
+
diff --git a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml
index 09f818b..3ccd39c 100644
--- a/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml
+++ b/seed/applicationservice/2022.03.08/nginx-reverse-proxy/dictionaries/25_nginx.xml
@@ -14,9 +14,6 @@
80
443
-
-
-
diff --git a/seed/applicationservice/2022.03.08/oauth2-client/funcs/oauth2_client.py b/seed/applicationservice/2022.03.08/oauth2-client/funcs/oauth2_client.py
index 7181e84..29b1f55 100644
--- a/seed/applicationservice/2022.03.08/oauth2-client/funcs/oauth2_client.py
+++ b/seed/applicationservice/2022.03.08/oauth2-client/funcs/oauth2_client.py
@@ -1,4 +1,10 @@
+from risotto.utils import multi_function as _multi_function
+
+
+@_multi_function
def calc_oauth2_client_external(external, location, *extras):
if not external or not location or None in extras:
return
+ if isinstance(external, list):
+ return [f'https://{exter}{location[0]}' + ''.join(extras) for exter in external]
return f'https://{external}{location[0]}' + ''.join(extras)
diff --git a/seed/applicationservice/2022.03.08/openldap/DEBUG.md b/seed/applicationservice/2022.03.08/openldap/DEBUG.md
index fa1978d..ae68e4b 100644
--- a/seed/applicationservice/2022.03.08/openldap/DEBUG.md
+++ b/seed/applicationservice/2022.03.08/openldap/DEBUG.md
@@ -9,9 +9,9 @@ ldapsearch -D cn=admin,ou=in,o=gnunux,o=info -y /usr/local/lib/secrets/admin_lda
Search with nexcloud admin user:
```
-USER="cn=nextcloud_in_gnunux_info,ou=in,o=gnunux,o=info"
+USER="cn=lemonldap.in.silique.fr,ou=in,o=silique,o=fr"
PASS="01CXZAjVr4A2iSoqdYIU5CFiC2BCuCQlvCR-wmeG6ns"
-DN="ou=users,ou=in,o=gnunux,o=info"
+DN="ou=accounts,ou=in,o=gnunux,o=info"
ldapsearch -D "$USER" -w "$PASS" -b "$DN"
```
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/config_acl.ldif b/seed/applicationservice/2022.03.08/openldap/templates/config_acl.ldif
index 34a86a0..e74e8a5 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/config_acl.ldif
+++ b/seed/applicationservice/2022.03.08/openldap/templates/config_acl.ldif
@@ -13,7 +13,11 @@ olcAccess: {0}to attrs=userPassword
by * none
%set %%aclidx = 1
%for %%family, %%remotes in %%dns.items()
+ %if %%family == 'all'
+olcAccess: {%%aclidx}to dn.subtree="%%calc_ldapclient_base_dn(%%ldap_base_dn, None, accounts=True)"
+ %else
olcAccess: {%%aclidx}to dn.subtree="%%calc_ldapclient_base_dn(%%ldap_base_dn, %%family)"
+ %end if
by self read
%for %%remote in %%remotes
by dn="%%remote[0]" %slurp
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/users.ldif b/seed/applicationservice/2022.03.08/openldap/templates/users.ldif
index 53fcff8..246f22e 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/users.ldif
+++ b/seed/applicationservice/2022.03.08/openldap/templates/users.ldif
@@ -21,14 +21,22 @@ objectClass: top
objectClass: inetOrgPerson
%end for
-# Users
-dn: ou=users,%%ldap_base_dn
+# Accounts
+%set %%users = %%calc_ldapclient_base_dn(%%ldap_base_dn, '')
+dn: %%calc_ldapclient_base_dn(%%ldap_base_dn, None, accounts=True)
+ou: accounts
+objectClass: top
+objectClass: organizationalUnit
+
+## Users
+%set %%users = %%calc_ldapclient_base_dn(%%ldap_base_dn, '')
+dn: %%users
ou: users
objectClass: top
objectClass: organizationalUnit
%for %%user in %%accounts.users.ldap_user_mail
-dn: cn=%%user,ou=users,%%ldap_base_dn
+dn: cn=%%user,%%users
cn: %%user
mail: %%user
sn: %%user.ldap_user_sn
@@ -43,20 +51,21 @@ objectClass: inetOrgPerson
objectClass: posixAccount
%end for
-# Families
-dn: ou=families,%%ldap_base_dn
+## Families
+dn: %%calc_ldapclient_base_dn(%%ldap_base_dn, '-')
ou: families
objectClass: top
objectClass: organizationalUnit
%for %%family in %%accounts.families
-dn: ou=%%family,ou=families,%%ldap_base_dn
+%set %%families = %%calc_ldapclient_base_dn(%%ldap_base_dn, %%family)
+dn: %%families
ou: %%family
objectClass: top
objectClass: organizationalUnit
%for %%user in %%accounts['family_' + %%family]['users_' + %%family]['ldap_user_mail_' + %%family]
-dn: cn=%%user,ou=%%family,ou=families,%%ldap_base_dn
+dn: cn=%%user,%%families
cn: %%user
mail: %%user
sn: %%user['ldap_user_sn_' + %%family]
diff --git a/seed/applicationservice/2022.03.08/openldap/templates/users_mod.ldif b/seed/applicationservice/2022.03.08/openldap/templates/users_mod.ldif
index 506724a..41aeded 100644
--- a/seed/applicationservice/2022.03.08/openldap/templates/users_mod.ldif
+++ b/seed/applicationservice/2022.03.08/openldap/templates/users_mod.ldif
@@ -8,8 +8,9 @@ userPassword:: %%ssha_encode(%%accounts['remote_' + %%name]['password_' + %%name
%end for
## Users
+#%set %%users = %%calc_ldapclient_base_dn(%%ldap_base_dn, '')
#%for %%user in %%accounts.users.ldap_user_mail
-#dn: cn=%%user,ou=users,%%ldap_base_dn
+#dn: cn=%%user,%%users
#changetype: modify
#replace: homeDirectory
#homeDirectory: /srv/home/users/%%user
@@ -17,8 +18,9 @@ userPassword:: %%ssha_encode(%%accounts['remote_' + %%name]['password_' + %%name
#%end for
## Families
#%for %%family in %%accounts.families
+# %set %%families = %%calc_ldapclient_base_dn(%%ldap_base_dn, %%family)
# %for %%user in %%accounts['family_' + %%family]['users_' + %%family]['ldap_user_mail_' + %%family]
-#dn: cn=%%user,ou=%%family,ou=families,%%ldap_base_dn
+#dn: cn=%%user,%%families
#replace: homeDirectory
#homeDirectory: /srv/home/families/%%family/%%user
#
diff --git a/seed/applicationservice/2022.03.08/roundcube/applicationservice.yml b/seed/applicationservice/2022.03.08/roundcube/applicationservice.yml
index eb793c3..81cf879 100644
--- a/seed/applicationservice/2022.03.08/roundcube/applicationservice.yml
+++ b/seed/applicationservice/2022.03.08/roundcube/applicationservice.yml
@@ -8,3 +8,4 @@ depends:
- oauth2-client
- nginx-https
- php-fpm
+ - ldap-client-fedora
diff --git a/seed/applicationservice/2022.03.08/roundcube/dictionaries/31_roundcube.xml b/seed/applicationservice/2022.03.08/roundcube/dictionaries/31_roundcube.xml
index 92b8269..d4fc6d7 100644
--- a/seed/applicationservice/2022.03.08/roundcube/dictionaries/31_roundcube.xml
+++ b/seed/applicationservice/2022.03.08/roundcube/dictionaries/31_roundcube.xml
@@ -4,6 +4,7 @@
/etc/roundcubemail/config.inc.php
/etc/nginx/default.d/roundcubemail.conf
+ /etc/roundcubemail/courriel.cloud.silique.fr.inc.php
/secrets/roundcube-init.php
/static/silique_cloud.svg
/static/watermark.html
@@ -13,6 +14,10 @@
+
+
+
+
@@ -30,8 +35,10 @@
silique_email.png
+
+
/usr/share/roundcubemail/
@@ -39,9 +46,6 @@
/
-
-
-
@@ -52,10 +56,17 @@
roundcube_des_key
- revprox_client_external_domainname
+ revprox_client_external_domainnames
revprox_client_location
index.php/login/oauth
- oauth2_client_login
+ oauth2_client_external
+
+ all
+ ldap_server_address
+ client_family
+ domain_name_eth0
+ ldap_family
+
diff --git a/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php b/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php
index 5c7f05b..c80512a 100644
--- a/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php
+++ b/seed/applicationservice/2022.03.08/roundcube/templates/config.inc.php
@@ -763,7 +763,8 @@ $config['useragent'] = null;
// try to load host-specific configuration
// see https://github.com/roundcube/roundcubemail/wiki/Configuration:-Multi-Domain-Setup
// for more details
-$config['include_host_config'] = false;
+$config['include_host_config'] = array("%%revprox_client_external_domainname" => "%%{revprox_client_external_domainname}.inc.php"
+);
// path to a text file which will be added to each sent message
// paths are relative to the Roundcube root folder
@@ -1058,55 +1059,6 @@ $config['address_book_type'] = 'sql';
// example further below. if you would like to test, simply uncomment the example.
// Array key must contain only safe characters, ie. a-zA-Z0-9_
$config['ldap_public'] = [];
-#>GNUNUX
-%if %%getVar('ldap_server_address', None)
-$config['ldap_public'] = array (
- 'Local' => array (
- 'name' => "Ma famille",
- 'hosts' => array (
- 0 => 'ldaps://%%ldap_server_address',
- ),
- 'port' => 636,
- 'use_tls' => false,
- 'bind_user' => '',
- 'bind_dn' => '%%ldapclient_remote_user',
- 'bind_pass' => '%%ldapclient_remote_user_password',
- 'auth_method' => '',
- 'vlv' => false, //Samba do not support Virtual List View functions
- 'user_specific' => false,
- 'base_dn' => 'ou=%%ldapclient_family,ou=families,%%ldap_base_dn',
- 'writable' => false,
- 'required_fields' => array (
- 0 => 'cn',
- 1 => 'sn',
- 2 => 'mail',
- 3 => 'uid',
- ),
- 'groups' => array(
- 'base_dn' => '',
- 'object_classes' => ['top', 'groupOfNames'],
- ),
- 'LDAP_rdn' => 'mail',
- 'ldap_version' => 3,
- 'search_fields' => array ('mail', 'cn', 'sn', 'givenName'),
- 'name_field' => 'cn',
- 'email_field' => 'mail',
- 'surname_field' => 'sn',
- 'firstname_field' => 'gn',
- 'sort' => 'cn',
- 'scope' => 'sub',
- 'filter' => '(mail=*)',
- 'fuzzy_search' => true,
- 'fieldmap' => array(
- 'name' => 'cn',
- 'surname' => 'sn',
- 'firstname' => 'givenName',
- 'email' => 'mail',
- ),
- ),
-);
-%end if
-#
diff --git a/seed/applicationservice/2022.03.08/roundcube/templates/domain.inc.php b/seed/applicationservice/2022.03.08/roundcube/templates/domain.inc.php
new file mode 100644
index 0000000..1e0bd57
--- /dev/null
+++ b/seed/applicationservice/2022.03.08/roundcube/templates/domain.inc.php
@@ -0,0 +1,49 @@
+GNUNUX
+$config['ldap_public'] = array (
+ 'Local' => array (
+ 'name' => "Ma famille",
+ 'hosts' => array (
+ 0 => 'ldaps://%%ldap_server_address',
+ ),
+ 'port' => 636,
+ 'use_tls' => false,
+ 'bind_user' => '',
+ 'bind_dn' => '%%ldapclient_remote_user',
+ 'bind_pass' => '%%ldapclient_remote_user_password',
+ 'auth_method' => '',
+ 'vlv' => false, //Samba do not support Virtual List View functions
+ 'user_specific' => false,
+ 'base_dn' => 'ou=%%ldapclient_family,ou=families,%%ldap_base_dn',
+ 'writable' => false,
+ 'required_fields' => array (
+ 0 => 'cn',
+ 1 => 'sn',
+ 2 => 'mail',
+ 3 => 'uid',
+ ),
+ 'groups' => array(
+ 'base_dn' => '',
+ 'object_classes' => ['top', 'groupOfNames'],
+ ),
+ 'LDAP_rdn' => 'mail',
+ 'ldap_version' => 3,
+ 'search_fields' => array ('mail', 'cn', 'sn', 'givenName'),
+ 'name_field' => 'cn',
+ 'email_field' => 'mail',
+ 'surname_field' => 'sn',
+ 'firstname_field' => 'gn',
+ 'sort' => 'cn',
+ 'scope' => 'sub',
+ 'filter' => '(mail=*)',
+ 'fuzzy_search' => true,
+ 'fieldmap' => array(
+ 'name' => 'cn',
+ 'surname' => 'sn',
+ 'firstname' => 'givenName',
+ 'email' => 'mail',
+ ),
+ ),
+);
+#