LDAP Directory Information Tree

This document describes how the debops.nslcd Ansible role fits in the LDAP directory structure organized by DebOps.

Directory structure

• cn=host.example.org -> debops.ldap

  • uid=nslcd

Object Classes and Attributes

• uid=nslcd

  • debops.nslcd: Object Classes, Attributes

Access Control

DebOps LDAP environment includes the 'ldapns' schema which can be used to define access control rules to services. The lists below define the attribute values which will grant access to the service managed by the debops.nslcd role, and specifies other roles with the same access control rules:

• objectClass hostObject, attribute host:

  • posix:all (all hosts)

  • posix:hostname.example.org

  • posix:*.example.org

  • posix:urn:<pattern> (see nslcd__ldap_posix_urns variable)

LDAP filter definition: nslcd__ldap_host_filter

These rules apply to UNIX accounts (passwd database) as well as UNIX groups (group database). UNIX accounts or group without the specified host attribute values will not be present on a given host.

Parent nodes

• debops.ldap

  • ansible_local.ldap.base_dn -> nslcd__ldap_base_dn

  • ansible_local.ldap.device_dn -> nslcd__ldap_device_dn

Child nodes

There are no child nodes defined for the debops.nslcd Ansible role.