📖

MinIO+Keycloak+LDAPの連携

2024/06/18に公開

MinIO

ldap

Keycloak

tech

夢は広がる…

と

の続きです。

今度はLDAPを立ててみようと思いまして、立ててみてその後にKeycloakとの連携をしてみました。

manager付でLDAPを立てる

まずはLDAPを立てます。
面倒なのでDocker Composeで立てちゃいます。

compose.yml

services:
  ldap-nginx:
    container_name: ldap-nginx
    hostname: ldap-nginx
    image: nginx:stable-alpine3.19-perl
    volumes:
      - ./conf/nginx.conf:/etc/nginx/nginx.conf
      - ./certs/evakichi.example.com.crt:/opt/certs/evakichi.example.com.crt:ro
      - ./certs/evakichi.example.com.key:/opt/certs/evakichi.example.com.key:ro
    ports:
      - 8085:80
      - 8444:443
    networks:
      - ldap-network
  ldap:
    container_name: ldap
    hostname: ldap
    image: osixia/openldap:1.5.0
    ports:
      - 389:389
      - 636:636
    environment:
      - LDAP_ORGANISATION=Example.com.
      - LDAP_DOMAIN=example.com
      - LDAP_ADMIN_PASSWORD=admin
      - LDAP_BASE_DN=dc=example,dc=com
      - LDAP_READONLY_USER=true
      - LDAP_READONLY_USER_USERNAME=readonly
      - LDAP_READONLY_USER_PASSWORD=readonly_password
      - LDAP_TLS_VERIFY_CLIENT=never
      - LDAP_TLS_CRT_FILENAME=evakichi.example.com.crt
      - LDAP_TLS_KEY_FILENAME=evakichi.example.com.key
      - LDAP_TLS_CA_CRT_FILENAME=evakichi.example.com.ca.crt
      - TZ=Asia/Tokyo
    volumes:
      - ldap_data:/var/lib/ldap
      - ldap_config:/etc/ldap/slapd.d
      - ./certs/evakichi.example.com.ca.crt:/container/run/service/slapd/assets/certs/evakichi.example.com.ca.crt
      - ./certs/evakichi.example.com.crt:/container/run/service/slapd/assets/certs/evakichi.example.com.crt
      - ./certs/evakichi.example.com.key:/container/run/service/slapd/assets/certs/evakichi.example.com.key
    tty: true
    networks:
      - ldap-network
    restart: always
  lam:
    container_name: lam
    hostname: lam
    image: ghcr.io/ldapaccountmanager/lam:stable
    environment: 
      - LDAP_DOMAIN=example.com
      - LDAP_BASE_DN=dc=example,dc=com
      - LDAP_USERS_DN=ou=people,dc=example,dc=com
      - LDAP_GROUPS_DN=ou=groups,dc=example,dc=com
      - LDAP_SERVER=ldap://ldap:389
      - LAM_LANG=ja_JP
      - LAM_PASSWORD=lam
      - VIRTUAL_HOST=lam
    networks:
      - ldap-network

networks:
  ldap-network:
volumes:
  ldap_data:
  ldap_config:

このとき、nginxのconfigファイルは以下のとおりです。（おそらく無駄なことも書いています。あしからず）

nginx.conf


user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
	server {
		listen 	80;
		server_name evakichi.example.com;
		return	301 https://$http_host$request_uri;
	}
	server {
		listen       443 ssl;
		listen  [::]:443 ssl;
		server_name  evakichi.example.com;
		ssl_protocols TLSv1.3;

		ssl_certificate /opt/certs/evakichi.example.com.crt;
		ssl_certificate_key /opt/certs/evakichi.example.com.key;

		# Allow special characters in headers
		ignore_invalid_headers off;
		# Allow any size file to be uploaded.
		# Set to a value such as 1000m; to restrict file size to a specific value
		client_max_body_size 0;
		# Disable buffering
		proxy_buffering off;
		proxy_request_buffering off;
		location / {
			proxy_set_header Host $http_host;
		  	proxy_set_header X-Real-IP $remote_addr;
		  	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		  	proxy_set_header X-Forwarded-Proto $scheme;
		  	proxy_connect_timeout 300;
			# Default is HTTP/1, keepalive is only enabled in HTTP/1.1
			proxy_http_version 1.1;
			proxy_set_header Upgrade $http_upgrade;
			proxy_set_header Connection "upgrade";
			chunked_transfer_encoding off;
			proxy_pass http://lam:80; # This uses the upstream directive definition to load balance
		}
	}
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}