Revision as of 06:54, 11 May 2022

Abstract

This document describes the OpenLDAP directory data organisation for the Load Balancer as a Service (LBaaS).

Data Organisation

The following chapters explain the data organisation of the stoney cloud OpenLDAP directory. In this case we are looking at the Load Balancer as a Service (LBaaS).

Load Balancer as a Service (LBaaS)

The sub tree ou=lbaas,ou=services,dc=stoney-cloud,dc=org contains all the HAProxy based Load Balancer as a Service (LBaaS) data. The following LDIF shows the lbaas LDAP entry for the Load Balancer as a Service (LBaaS):

dn: ou=lbaas,ou=services,dc=stoney-cloud,dc=org
objectclass: top
objectclass: organizationalUnit
ou: lbaas
description: The sub tree for the HAproxy based Load Balancer as a Service (LBaaS).

The following table describes the different attributes:

Attribute	Objectclass	Existance	Mandatory	Description
ou	organizationalUnit	MUST	x	The name of the leaf. For the HAProxy based Load Balancer as a Service (LBaaS) this is: `lbaas`.
description	organizationalUnit	MAY	x	The description of the leaf. For the HAProxy based Load Balancer as a Service (LBaaS) the description ist is: `The sub tree for the HAproxy based Load Balancer as a Service (LBaaS).`

Legend:

x: Mandatory in all cases.

Load Balancer as a Service (LBaaS) - Configuration

The sub tree for the configuration of the Load Balancer as a Service (LBaaS):

dn: ou=configuration,ou=lbaas,ou=services,dc=stoney-cloud,dc=org
objectclass: top
objectclass: organizationalUnit
ou: configuration
description: The sub tree for the configuration of the HAProxy based Load Balancer as a Service (LBaaS).

The following table describes the different attributes:

Attribute	Objectclass	Existance	Mandatory	Description
ou	organizationalUnit	MUST	x	The name of the leaf. For the configuration of the HAProxy based Load Balancer as a Service (LBaaS) this is: `configuration`.
description	organizationalUnit	MAY	x	The description of the leaf. For the configuration of the HAProxy based Load Balancer as a Service (LBaaS) this is: `The sub tree for the configuration of the HAProxy based Load Balancer as a Service (LBaaS).`

Legend:

x: Mandatory in all cases.

Load Balancer as a Service (LBaaS) - Configuration - Provisioning daemon

See the Services description for the naming convention.

The sub tree for the configuration of the prov-lbaas-haproxy daemon:

dn: ou=prov-lbaas-haproxy,ou=configuration,ou=lbaas,ou=services,dc=stoney-cloud,dc=org
objectclass: top
objectclass: organizationalUnit
objectclass: sstServiceConfigurationObjectClass
ou: prov-lbaas-haproxy
description: The sub tree for the configuration of the prov-lbaas-haproxy provisioning daemon.
sstIsActive: TRUE

The following table describes the different attributes:

Attribute	Objectclass	Existance	Mandatory	Description
ou	organizationalUnit	MUST	x	The name of the leaf. For the HAProxy based Load Balancer as a Service (LBaaS) prov-lbaas-haproxy provisioning daemon this is: `prov-lbaas-haproxy`.
description	organizationalUnit	MAY	x	The description of the leaf. For the HAProxy based Load Balancer as a Service (LBaaS) prov-lbaas-haproxy provisioning daemon this is: `The sub tree for the configuration of the prov-lbaas-haproxy provisioning daemon.`
sstIsActive	sstServiceConfigurationObjectClass	MUST	x	Is the entry active? Either `TRUE` (yes) or `FALSE` (no). The default value is `TRUE`.

Legend:

x: Mandatory in all cases.

Load Balancer as a Service (LBaaS) - Configuration - Reseller

The sub tree for the reseller specific Load Balancer as a Service (LBaaS) settings:

dn: ou=reseller,ou=configuration,ou=lbaas,ou=services,dc=stoney-cloud,dc=org
objectclass: top
objectclass: organizationalUnit
ou: reseller
description: The sub tree for the reseller specific configuration of the HAProxy based Load Balancer as a Service (LBaaS).

The following table describes the different attributes:

Attribute	Objectclass	Existance	Mandatory	Description
ou	organizationalUnit	MUST	x	The name of the leaf. For the reseller specific HAProxy based Load Balancer as a Service (LBaaS) service this is: `reseller`.
description	organizationalUnit	MAY	x	The description of the leaf. For the reseller specific HAProxy based Load Balancer as a Service (LBaaS) service this is: `The sub tree for the configuration of the HAProxy based Load Balancer as a Service (LBaaS).`

Legend:

x: Mandatory in all cases.

The sub tree for the specific Load Balancer as a Service (LBaaS) settings for the reseller Reseller Ltd. with the uid 4000000.

dn: uid=4000000,ou=reseller,ou=configuration,ou=lbaas,ou=services,dc=stoney-cloud,dc=org
objectclass: top
objectclass: sstReseller
objectclass: sstServiceConfigurationObjectClass
uid: 4000000
organizationName: Reseller Ltd.
description: The sub tree for the specific Load Balancer as a Service (LBaaS) settings for the reseller Reseller Ltd. with the uid 4000000.
sstIsActive: TRUE
sstIsCompany: TRUE
sstIsDefault: TRUE
sstBelongsToResellerUID: 4000000

The following table describes the different attributes:

Attribute	Objectclass	Existance	Mandatory	Description
uid	sstReseller	MUST	x	A unique integer value with 7 digits or more. For example: `uid: 4000000` corresponds with `sstBelongsToResellerUID: 4000000`.
organizationName	sstReseller	MAY	x¹	The company name. For example: `stepping stone AG`.
givenName	sstReseller	MAY	x¹	Name. For example: `Hans`.
surname	sstReseller	MAY	x¹	Surname. For example: `Muster`.
description	sstReseller	MAY	x	The description of the leaf. For example: `The sub tree for the specific Load Balancer as a Service (LBaaS) settings for the reseller Reseller Ltd. with the uid 4000000.`
sstIsActive	sstReseller	MUST	x	Is the entry active? Either `TRUE` (yes) or `FALSE` (no). The default value is `TRUE`.
sstIsCompany	sstReseller	MUST	x	Do we have an organisation or a private person? Either `TRUE` (yes) or `FALSE` (no). The default value is `TRUE`.
sstIsDefault	sstServiceConfigurationObjectClass	MAY	x	Is this leaf a default entry? Either `TRUE` (yes) or `FALSE` (no). If `sstIsDefault` is set to `TRUE`, this entry acts as a fall back configuration. In other words: If a reseller doesn't have his own Load Balancer as a Service (LBaaS) configuration, then this one will be used. As you would normally have only one default configuration per cloud, the default value is `FALSE`.
sstBelongsToResellerUID	sstReseller	MUST	x	Stores the reseller UID the leaf belongs to. A unique value with 7 digits or more. For example: `sstBelongsToResellerUID: 4000000` corresponds with `uid: 4000000`.

Legend:

x: Mandatory in all cases.
x¹: If sstIsCompany is set to TRUE, the organizationName must be set. Otherwise givenName and surname must be set.

Load Balancer as a Service (LBaaS) - Accounts

The sub tree for the accounts of the Load Balancer as a Service (LBaaS):

dn: ou=accounts,ou=lbaas,ou=services,dc=stoney-cloud,dc=org
objectclass: top
objectclass: organizationalUnit
ou: accounts
description: The sub tree for the accounts of the Load Balancer as a Service (LBaaS).

The following table describes the different attributes:

Attribute	Objectclass	Existance	Mandatory	Description
ou	organizationalUnit	MUST	x	The name of the leaf. In this case: `accounts`.
description	organizationalUnit	MAY	x	The description of the leaf. In this case: `The sub tree for the accounts of the Load Balancer as a Service (LBaaS).`

Legend:

x: Mandatory in all cases.

Load Balancer as a Service (LBaaS) - Account example

The following example shows the OpenLDAP directory entry for the stoney wiki account with the uid number 3730083:

dn: uid=3730083,ou=accounts,ou=lbaas,ou=services,dc=stoney-cloud,dc=org
objectclass: top
objectclass: account
objectclass: posixAccount
objectclass: shadowAccount
objectclass: sstProvisioning
objectclass: sstRelationship
uid: 3730083
userPassword: {SSHA}E/KLUgeAtApAPQ7mG2GMddCxTE9m9QOS
uidNumber: 3730083
gidNumber: 3730083
cn: sst-mei
gecos: Michael Eichenberger   # 
homeDirectory: /home/3730083
loginShell: /bin/false
shadowFlag: 134539460
shadowLastChange: 11108
shadowMax: 99999
shadowWarning: 7
sstIsActive: TRUE
 
sstLBaaSFrontendURI: https://www.example.com/                     # Uniform Resource Identifier with optional label
sstLBaaSFrontendURI: https://www.example.com:8080/                # Uniform Resource Identifier with optional label
sstLBaaSFrontendURI: https://example.com/                         # Uniform Resource Identifier with optional label
sstLBaaSFrontendURI: https://api.example.com/                     # Uniform Resource Identifier with optional label
 
sstLBaaSBackendURI: https://sst-int-001.os.stoney-cloud.com/      # Uniform Resource Identifier with optional label
sstLBaaSBackendURI: https://sst-int-002.os.stoney-cloud.com/      # Uniform Resource Identifier with optional label
 
sstLBaaSHost: haproxy-001.os.stoney-cloud.com                     # Fully qualified domain name (FQDN)
sstLBaaSHost: haproxy-002.os.stoney-cloud.com                     # Fully qualified domain name (FQDN)
 
sstProvisioningMode: add
sstProvisioningExecutionDate: 0
sstProvisioningState: 0
sstBelongsToResellerUID: 4000000
sstBelongsToCustomerUID: 4000001
sstBelongsToPersonUID: 4000002
sstBelongsToServiceUID: 4000003

This will result in the following getent passwd entry:

.--------------------------------------------------------------------- login name
|       .------------------------------------------------------------- encrypted password indicator
|       | .----------------------------------------------------------- numerical user ID
|       | |       .--------------------------------------------------- numerical group ID
|       | |       |       .------------------------------------------- gecos field (the typical format is a comma-delimited list)
|       | |       |       |                    .---------------------- user home directory
|       | |       |       |                    |             .-------- user command interpreter
|       | |       |       |                    |             |
|       | |       |       |                    |             |
3730083:x:3730083:3730083:Michael Eichenberger:/home/3730083:/bin/false

The following table describes the different attributes:

Attribute	Objectclass	Existance	Mandatory	Description
uid	account	MUST	x	The unique identifier (uid). This attribute is created by the Self-Service interface by reading (and incrementing) the next free uid from <cod>cn=nextfreeuid,ou=administration,dc=stoney-cloud,dc=org</code>.
userPassword	posixAccount	MAY	x	Identifies the entry's password and encryption method in the following format: `{encryption method}encrypted password`. For example: `{SSHA}zBiT1dHAZh/8zbCeyocRVWhdP0j9xJ3U`.
uidNumber	posixAccount	MUST	x	Related to the /etc/shadow file, this attribute specifies the user's login ID. Has the same value as the `uid`. For example: `3730083`.
gidNumber	posixAccount	MUST	x	Group ID number. Has the same value as the `uid`. For example: `3730083`.
cn	posixAccount	MUST	x	Consists of the uid and the domain stoney-wiki.com. For example: 3730083.stoney-wiki.com.
gecos	posixAccount	MAY	x	Named for historical reasons, the GECOS field is mandatory and is used to store extra information (such as the user's full name). Utilities such as finger or getent access this field to provide additional user information. For a personal account, this entry would consist of `givenName` and `surname`, for example `Michael Eichenberger`. These values are taken from the owners entry (ou=people). For a service account, the attribute `sstDisplayName` from the corresponding service would be used for the content of this attribute. Please be aware, that this attribute is a IA5String (OID=1.3.6.1.4.1.1466.115.121.1.26) IA5 (almost ASCII) character set (7-bit). Does NOT allow extended characters e.g. é, Ø, å etc. The Self-Service interface automatically creates the content of this attribute. Consists of the uid and the domain stoney-wiki.com. For example: 3730083.stoney-wiki.com. You can use: `~ $ echo "Tüpfelhyänenöhrchen" \| iconv -f 'utf-8' -t 'ASCII//TRANSLIT'` which gives you: `Tuepfelhyaenenoehrchen` or: `iconv("UTF-8", "ASCII//TRANSLIT", "Tüpfelhyänenöhrchen")` Please be aware, that some characters don't get converted properly ... For example: Ø and £. The characters $ and € work.
homeDirectory	posixAccount	MUST	x	The directory path corresponds with the 7 digit account uid. The following example describes, how the directory structure is built up for the account with the uid 3730083. `/var/wiki/g/efg/bcd/abcdefg` `/var/wiki/3/083/730/3730083` This attribute is created by the Self-Service interface.
loginShell	posixAccount	MAY	x	The path to the login shell. The default is /bin/false and can no be changed.
shadowFlag	shadowAccount	MAY	x	Related to the /etc/shadow file, this attribute is currently not used and is reserved for future use. The default is set to 134539460 and is taken from the "ou=settings,uid=<UID>,ou=reseller,ou=configuration,ou=lbaas,ou=services,dc=stoney-cloud,dc=org" entry.
shadowLastChange	shadowAccount	MAY	x	Related to the /etc/shadow file, this attribute specifies number of days between January 1, 1970, and the date that the password was last modified. Must be set to the day, that the password was set (must be updated, when the password is changed). This attribute is created by the Self-Service interface.
shadowMax	shadowAccount	MAY	x	Related to the /etc/shadow file, this attribute specifies the maximum number of days the password is valid. The default is 99999, which corresponds to about 273 years. In reality, this means, that the user does not need to change the password. This attribute is created by the Self-Service interface. The value is taken from the "ou=settings,uid=<UID>,ou=reseller,ou=configuration,ou=lbaas,ou=services,dc=stoney-cloud,dc=org" entry.
shadowWarning	shadowAccount	MAY	x	Related to the /etc/shadow file, this attribute specifies the number of days before the password expires that the user is warned. The default is 7 and is taken from the "ou=settings,uid=<UID>,ou=reseller,ou=configuration,ou=lbaas,ou=services,dc=stoney-cloud,dc=org" entry.
sstIsActive	sstWiki	MUST	x	Is the wiki account active? Either `TRUE` (yes) or `FALSE` (no). Default is `TRUE` (yes) and is taken from the "ou=defaults,uid=<UID>,ou=reseller,ou=configuration,ou=lbaas,ou=services,dc=stoney-cloud,dc=org" entry.
sstNotificationWarningOn	sstWiki	MUST	x	Are the users notification warnings turned on or not? Either `TRUE` (yes) or `FALSE` (no). Default is TRUE (yes) and is taken from the "ou=settings,uid=<UID>,ou=reseller,ou=configuration,ou=lbaas,ou=services,dc=stoney-cloud,dc=org" entry.
sstNotificationWarning	sstWiki	MAY		This multi-valued attribute will be used to turn single notifications on or off. The attribute `sstWikiWarningOn` must be set to `TRUE`. Currently, the Load Balancer as a Service (LBaaS) only supports `quota` (the names correspond with the template dn).
sstNotificationWarningMedium	sstWiki	MUST	x	The notification medium, either sms (points to the multi-valued attribute `mobileTelephoneNumber`) or mail (points to the multi-valued attribute `mail`). Currently, only mail is supported. This is the default is taken from the "ou=defaults,uid=<UID>,ou=reseller,ou=configuration,ou=lbaas,ou=services,dc=stoney-cloud,dc=org" entry.
sstSoftwareVersion	sstWiki	MAY	x	TBD
sstFileUploadSize	sstWiki	MAY	x	TBD
host	sstWiki	MAY	x	TBD
sstProvisioningMode	sstProvisioning	MUST	x	The provisioning mode, either `add`, `modify` or `delete`. For a new account, this attribute must be set to `add`. See Provisioning for details.
sstProvisioningExecutionDate	sstProvisioning	MUST	x	The date the provisioning shall occur in the form of [YYYY][MM][DD] (ISO 8601). For a new account, this attribute must be set to 0. See Provisioning for details.
sstProvisioningReturnValue	sstProvisioning	MAY		The provisioning return value written by the prov-wiki-mediawiki daemon. 0 means success, >0 means failure. See the prov-wiki-mediawiki Exit Codes for detailed information.
sstProvisioningState	sstProvisioning	MUST	x	The provisioning state, either 0 or in the form of [YYYY][MM][DD]T[hh][mm][ss] (ISO 8601). For a new account, this attribute must be set to 0. See Provisioning for details.
sstBelongsToResellerUID		MUST	x	Stores the reseller UID the leaf belongs to.
sstBelongsToCustomerUID	TBD	MUST	x	Stores the customer UID the leaf belongs to.
sstBelongsToPersonUID	sstRelationship	MAY	x³	Stores the person UID the leaf belongs to.

Legend:

x: Mandatory in all cases.
x¹: Only show, if the number is larger than zero.
x²: Only show, if sstWikiWarningOn is set to TRUE.
x³: Either sstBelongsToPersonUID or sstBelongsToServiceUID must bei set.

Load Balancer as a Service (LBaaS) - Groups

The sub tree for the groups of the Load Balancer as a Service (LBaaS):

dn: ou=groups,ou=lbaas,ou=services,dc=stoney-cloud,dc=org
objectclass: top
objectclass: organizationalUnit
ou: groups
description: The sub tree for the groups of the Load Balancer as a Service (LBaaS).

Load Balancer as a Service (LBaaS) - Group example

dn: cn=3730083,ou=groups,ou=lbaas,ou=services,dc=stoney-cloud,dc=org
objectclass: top
objectclass: posixGroup
objectclass: sstRelationship
cn: 3730083
gidNumber: 3730083
sstIsActive: TRUE
sstBelongsToResellerUID: 4000000
sstBelongsToCustomerUID: 4000001
sstBelongsToPersonUID: 4000002

Links

@@ Line 380: / Line 380: @@
 This will result in the following <code>getent passwd</code> entry:
-<syntaxhighlight lang='bash'>
+<syntaxhighlight lang='text'>
 .--------------------------------------------------------------------- login name
 |       .------------------------------------------------------------- encrypted password indicator
@@ Line 390: / Line 390: @@
 |       | |       |       |                    |             |
 |       | |       |       |                    |             |
-3730083:x:3730083:3730083:Michael Eichenberger:/home/3730083:/bin/sh
+3730083:x:3730083:3730083:Michael Eichenberger:/home/3730083:/bin/false
 </syntaxhighlight>

Difference between revisions of "Load Balancer as a Service (LBaaS): OpenLDAP directory data organisation"

Revision as of 06:54, 11 May 2022

Contents

Abstract

Data Organisation

Load Balancer as a Service (LBaaS)

Load Balancer as a Service (LBaaS) - Configuration

Load Balancer as a Service (LBaaS) - Configuration - Provisioning daemon

Load Balancer as a Service (LBaaS) - Configuration - Reseller

Load Balancer as a Service (LBaaS) - Accounts

Load Balancer as a Service (LBaaS) - Account example

Load Balancer as a Service (LBaaS) - Groups

Load Balancer as a Service (LBaaS) - Group example

Links

Navigation menu

Personal tools

Namespaces

Variants

Views

Actions

Search

Navigation

Wiki

Tools