80 lines
3.6 KiB
Bash
80 lines
3.6 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# =============================================================================
|
||
|
|
# eBdesk SiCABE — print-openldap-requirements.sh
|
||
|
|
# -----------------------------------------------------------------------------
|
||
|
|
# Mencetak KEBUTUHAN OpenLDAP (nilai konkret dari .env) untuk diserahkan ke
|
||
|
|
# administrator LDAP — pasangan dari docs/openldap-existing-requirements.md.
|
||
|
|
#
|
||
|
|
# Read-only: hanya menampilkan.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# ./scripts/print-openldap-requirements.sh
|
||
|
|
# ./scripts/print-openldap-requirements.sh --env-file generated/host-control/.env
|
||
|
|
# ./scripts/print-openldap-requirements.sh --mask # sembunyikan bind password
|
||
|
|
# =============================================================================
|
||
|
|
set -uo pipefail
|
||
|
|
|
||
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||
|
|
# shellcheck source=../lib/common.sh
|
||
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
||
|
|
# shellcheck source=../config/environment.defaults.sh
|
||
|
|
source "${SCRIPT_DIR}/config/environment.defaults.sh"
|
||
|
|
|
||
|
|
MASK=0
|
||
|
|
ARGS=()
|
||
|
|
for _a in "$@"; do
|
||
|
|
case "${_a}" in
|
||
|
|
--mask) MASK=1 ;;
|
||
|
|
*) ARGS+=("${_a}") ;;
|
||
|
|
esac
|
||
|
|
done
|
||
|
|
sicabe_load_env "${SCRIPT_DIR}" "${ARGS[@]}"
|
||
|
|
|
||
|
|
BASE_DN="${LDAP_BASE_DN:-dc=sicabe,dc=local}"
|
||
|
|
USERS_DN="${LDAP_USERS_DN:-ou=users,${BASE_DN}}"
|
||
|
|
GROUPS_DN="${LDAP_GROUPS_DN:-ou=groups,${BASE_DN}}"
|
||
|
|
BIND_DN="${LDAP_ADMIN_DN:-cn=admin,${BASE_DN}}"
|
||
|
|
LDAP_URL="${LDAP_URL:-ldap://openldap:389}"
|
||
|
|
LDAP_HOST="${LDAP_HOST:-localhost}"
|
||
|
|
LDAP_PORT="${LDAP_PORT:-389}"
|
||
|
|
|
||
|
|
show_secret() { # <value> <dev-default>
|
||
|
|
local v="${1:-}" d="${2:-}"
|
||
|
|
if [[ -z "${v}" ]]; then echo "(KOSONG!)"; return; fi
|
||
|
|
if [[ "${MASK}" == "1" ]]; then echo "********"; return; fi
|
||
|
|
if [[ "${v}" == "${d}" ]]; then echo "${v} ← DEFAULT DEV, ganti di produksi"; else echo "${v}"; fi
|
||
|
|
}
|
||
|
|
|
||
|
|
printf '%s\n' "================================================================================"
|
||
|
|
printf '%s\n' " KEBUTUHAN OPENLDAP (existing) — dari: ${SICABE_ENV_FILE:-${SCRIPT_DIR}/.env}"
|
||
|
|
printf '%s\n' "================================================================================"
|
||
|
|
printf '%s\n' " Peran LDAP di SiCABE = SUMBER GRUP (bukan autentikasi; auth = Keycloak OIDC)."
|
||
|
|
printf '\n'
|
||
|
|
printf ' URL (dari container) : %s\n' "${LDAP_URL}"
|
||
|
|
printf ' host:port (dari host): %s:%s\n' "${LDAP_HOST}" "${LDAP_PORT}"
|
||
|
|
printf '\n'
|
||
|
|
printf ' Base DN : %s\n' "${BASE_DN}"
|
||
|
|
printf ' OU users : %s\n' "${USERS_DN}"
|
||
|
|
printf ' OU groups : %s\n' "${GROUPS_DN}"
|
||
|
|
printf '\n'
|
||
|
|
printf ' Akun BIND (buat baca) : %s\n' "${BIND_DN}"
|
||
|
|
printf ' → boleh akun READ-ONLY, bukan harus admin.\n'
|
||
|
|
printf ' password : %s\n' "$(show_secret "${LDAP_ADMIN_PASSWORD:-}" "ldap_admin_DevOnly")"
|
||
|
|
printf '\n'
|
||
|
|
printf '%s\n' " Grup (WAJIB, objectClass=groupOfNames, atribut cn + member=DN user):"
|
||
|
|
printf '%s\n' " data-admin data-engineer data-analyst data-viewer"
|
||
|
|
printf '%s\n' " → nama ini HARUS sama dengan kunci roles di config/opa/data.json"
|
||
|
|
printf '%s\n' " DAN permitted_groups StarRocks."
|
||
|
|
printf '\n'
|
||
|
|
printf '%s\n' " User (objectClass inetOrgPerson + posixAccount):"
|
||
|
|
printf '%s\n' " uid HARUS = username Keycloak (preferred_username) ← krusial"
|
||
|
|
printf '%s\n' " atribut minimal: uid, cn, sn, mail, uidNumber, gidNumber, homeDirectory"
|
||
|
|
printf '\n'
|
||
|
|
printf '%s\n' " Kembalikan ke SiCABE: LDAP_URL, host:port, bind DN + password, base DN/OU,"
|
||
|
|
printf '%s\n' " dan konfirmasi bahwa uid user = username Keycloak & keanggotaan grup benar."
|
||
|
|
if [[ "${MASK}" == "0" ]]; then
|
||
|
|
printf '\n'
|
||
|
|
printf '%s\n' " ⚠ KELUARAN MEMUAT PASSWORD — kirim lewat kanal aman; jangan tempel di tiket publik."
|
||
|
|
fi
|
||
|
|
printf '%s\n' "================================================================================"
|