aboutsummaryrefslogtreecommitdiff
path: root/app/directory/config/bottin
diff options
context:
space:
mode:
Diffstat (limited to 'app/directory/config/bottin')
-rw-r--r--app/directory/config/bottin/config.json.tpl26
1 files changed, 26 insertions, 0 deletions
diff --git a/app/directory/config/bottin/config.json.tpl b/app/directory/config/bottin/config.json.tpl
new file mode 100644
index 0000000..844f7b7
--- /dev/null
+++ b/app/directory/config/bottin/config.json.tpl
@@ -0,0 +1,26 @@
+{
+ "suffix": "{{ key "secrets/directory/ldap_base_dn" }}",
+ "bind": "0.0.0.0:389",
+ "log_level": "debug",
+ "acl": [
+ "*,{{ key "secrets/directory/ldap_base_dn" }}::read:*:* !userpassword !user_secret !alternate_user_secrets !garage_s3_secret_key",
+ "*::read modify:SELF:*",
+ "ANONYMOUS::bind:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:",
+ "ANONYMOUS::bind:cn=admin,{{ key "secrets/directory/ldap_base_dn" }}:",
+ "*,ou=services,ou=users,{{ key "secrets/directory/ldap_base_dn" }}::bind:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
+ "*,ou=services,ou=users,{{ key "secrets/directory/ldap_base_dn" }}::read:*:*",
+
+ "*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:add:*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}:*",
+ "ANONYMOUS::bind:*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}:",
+ "*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::delete:SELF:*",
+
+ "*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:add:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
+ "*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::add:*,ou=users,{{ key "secrets/directory/ldap_base_dn" }}:*",
+
+ "*:cn=asso_deuxfleurs,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:modifyAdd:cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:*",
+ "*,ou=invitations,{{ key "secrets/directory/ldap_base_dn" }}::modifyAdd:cn=email,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:*",
+
+ "cn=admin,{{ key "secrets/directory/ldap_base_dn" }}::read add modify delete:*:*",
+ "*:cn=admin,ou=groups,{{ key "secrets/directory/ldap_base_dn" }}:read add modify delete:*:*"
+ ]
+}