Service ID OpenLDAP

Location

• Production: ako/Jetstream
• Staging: ruiru/Jetstream

License

No license.

Description of the service

LDAP. To be accessed by the ID Dashboard and Crowd.

How to access it

OpenLDAP is dockerized. It listens on 127.0.0.1:689. It's only accessible from ambam and baragoi machines.

How to restart it

cd /root/docker/ldap
docker-compose restart ldap

How to setup

Via ansible/docker compose apps.

Backups and restores

Backup

Check Backups-Strategy to understand how to download or upload backups files from/to AWS S3.

- Stop your OpenLDAP server (`docker-compose stop ldap`)
- Make a copy of LDAP config directory (`/data/docker/volumes/ldap_config`) and LDAP data directory (`/data/docker/volumes/ldap_database`) to your backup directory
- Start OpenLDAP server (`docker-compose start ldap`)

Restore

- Stop your OpenLDAP server (`docker-compose stop ldap`)
- Replace the contents of LDAP config directory (`/data/docker/volumes/ldap_config`) and LDAP data directory (`/data/docker/volumes/ldap_database`) with the contents extracted
- Start OpenLDAP server (`docker-compose start ldap`)

• Using slapcat/slapadd is not recommended and can lead to inconsistencies.

Logs

cd /root/docker/ldap
docker-compose logs -f

Troubleshooting

LDAP refusing to start

We know that we cannot restart our LDAP containers. https://issues.openmrs.org/browse/ITSM-4134

Find user groups

If you want to check if a user belongs to a group in LDAP, there's a bunch of way:

• Check formage as mongodb has a copy of users created since January/2019
• Crowd. It might timeout.
• JIRA or Wiki user management screen (if they've already logged in, as the groups are only loaded on those occasions)
• Straight in LDAP

ssh ldap.openmrs.org
sudo -i
docker exec -it ldap_ldap_1 bash
SEARCH_USER=<username>
ldapsearch -LLL -D "cn=admin,dc=openmrs,dc=org" -W -b "cn=jira-users,ou=groups,dc=openmrs,dc=org" | fgrep $SEARCH_USER
ldapsearch -LLL -D "cn=admin,dc=openmrs,dc=org" -W -b "cn=jira-trunk-developer,ou=groups,dc=openmrs,dc=org" | fgrep $SEARCH_USER
ldapsearch -LLL -D "cn=admin,dc=openmrs,dc=org" -W -b "cn=confluence-users,ou=groups,dc=openmrs,dc=org" | fgrep $SEARCH_USER
# creds in LP

Rename user

Check Rename user docs.