dohertj2/lmxopcua
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

chore(docker-dev): LDAP bind password via OTOPCUA_LDAP_BIND_PASSWORD with dev default (#619)

Browse Source 
Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe
This commit is contained in:
Joseph Doherty
2026-10-08 17:02:51 -04:00
parent ad108f6a02
commit bdf13d29ba
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-dev/README.md
+2
View File
@@ -102,6 +102,8 @@ The first build takes a few minutes (.NET SDK image + restore + publish). **No m
Central nodes authenticate against the shared GLAuth at `10.100.0.35:3893` (baseDN `dc=zb,dc=local`). `DevStubMode` is **not** active. Sign in with any test user (password `password`); `multi-role` / `password` returns all three roles (Administrator, Designer, Viewer). Group→role mappings are seeded by `seed/seed-clusters.sql`. The GLAuth source of truth + deploy runbook is in `scadaproj/infra/glauth/`. **Do not** enable `DevStubMode` outside local debugging — production must always bind a real LDAP backend. Central nodes authenticate against the shared GLAuth at `10.100.0.35:3893` (baseDN `dc=zb,dc=local`). `DevStubMode` is **not** active. Sign in with any test user (password `password`); `multi-role` / `password` returns all three roles (Administrator, Designer, Viewer). Group→role mappings are seeded by `seed/seed-clusters.sql`. The GLAuth source of truth + deploy runbook is in `scadaproj/infra/glauth/`. **Do not** enable `DevStubMode` outside local debugging — production must always bind a real LDAP backend.
The LDAP service-account bind password is read from the host env var `OTOPCUA_LDAP_BIND_PASSWORD` (compose default `serviceaccount123`, the committed dev password of the shared GLAuth, so the rig works with nothing set). Export it before `docker compose up` to bind with a different password (#619).
## Headless deploy ## Headless deploy
```bash ```bash
docker-dev/docker-compose.yml
+3 -3
View File
@@ -194,7 +194,7 @@ x-ldap-env: &ldap-env
Security__Ldap__AllowInsecure: "true" Security__Ldap__AllowInsecure: "true"
Security__Ldap__SearchBase: "dc=zb,dc=local" Security__Ldap__SearchBase: "dc=zb,dc=local"
Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local" Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local"
Security__Ldap__ServiceAccountPassword: "serviceaccount123" Security__Ldap__ServiceAccountPassword: "${OTOPCUA_LDAP_BIND_PASSWORD:-serviceaccount123}"
Security__Ldap__GroupToRole__ReadOnly: "ReadOnly" Security__Ldap__GroupToRole__ReadOnly: "ReadOnly"
Security__Ldap__GroupToRole__WriteOperate: "WriteOperate" Security__Ldap__GroupToRole__WriteOperate: "WriteOperate"
Security__Ldap__GroupToRole__WriteTune: "WriteTune" Security__Ldap__GroupToRole__WriteTune: "WriteTune"
@@ -402,7 +402,7 @@ services:
Security__Ldap__AllowInsecure: "true" Security__Ldap__AllowInsecure: "true"
Security__Ldap__SearchBase: "dc=zb,dc=local" Security__Ldap__SearchBase: "dc=zb,dc=local"
Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local" Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local"
Security__Ldap__ServiceAccountPassword: "serviceaccount123" Security__Ldap__ServiceAccountPassword: "${OTOPCUA_LDAP_BIND_PASSWORD:-serviceaccount123}"
Security__DeployApiKey: "docker-dev-deploy-key" Security__DeployApiKey: "docker-dev-deploy-key"
Security__Auth__DisableLogin: "${OTOPCUA_DISABLE_LOGIN:-true}" Security__Auth__DisableLogin: "${OTOPCUA_DISABLE_LOGIN:-true}"
# #520 stage 6 — node ACL enforcement, the dark switch. Default OFF, exactly as in production. # #520 stage 6 — node ACL enforcement, the dark switch. Default OFF, exactly as in production.
@@ -535,7 +535,7 @@ services:
Security__Ldap__AllowInsecure: "true" Security__Ldap__AllowInsecure: "true"
Security__Ldap__SearchBase: "dc=zb,dc=local" Security__Ldap__SearchBase: "dc=zb,dc=local"
Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local" Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local"
Security__Ldap__ServiceAccountPassword: "serviceaccount123" Security__Ldap__ServiceAccountPassword: "${OTOPCUA_LDAP_BIND_PASSWORD:-serviceaccount123}"
Security__DeployApiKey: "docker-dev-deploy-key" Security__DeployApiKey: "docker-dev-deploy-key"
Security__Auth__DisableLogin: "${OTOPCUA_DISABLE_LOGIN:-true}" Security__Auth__DisableLogin: "${OTOPCUA_DISABLE_LOGIN:-true}"
# Node ACL enforcement, the dark switch — same env override and same default-OFF as central-1. # Node ACL enforcement, the dark switch — same env override and same default-OFF as central-1.