From bdf13d29baed359e975b21d18d84247a0e40eb19 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Thu, 8 Oct 2026 17:02:51 -0400 Subject: [PATCH] chore(docker-dev): LDAP bind password via OTOPCUA_LDAP_BIND_PASSWORD with dev default (#619) Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe --- docker-dev/README.md | 2 ++ docker-dev/docker-compose.yml | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/docker-dev/README.md b/docker-dev/README.md index 97da16a5..f7706820 100644 --- a/docker-dev/README.md +++ b/docker-dev/README.md @@ -102,6 +102,8 @@ The first build takes a few minutes (.NET SDK image + restore + publish). **No m Central nodes authenticate against the shared GLAuth at `10.100.0.35:3893` (baseDN `dc=zb,dc=local`). `DevStubMode` is **not** active. Sign in with any test user (password `password`); `multi-role` / `password` returns all three roles (Administrator, Designer, Viewer). Group→role mappings are seeded by `seed/seed-clusters.sql`. The GLAuth source of truth + deploy runbook is in `scadaproj/infra/glauth/`. **Do not** enable `DevStubMode` outside local debugging — production must always bind a real LDAP backend. +The LDAP service-account bind password is read from the host env var `OTOPCUA_LDAP_BIND_PASSWORD` (compose default `serviceaccount123`, the committed dev password of the shared GLAuth, so the rig works with nothing set). Export it before `docker compose up` to bind with a different password (#619). + ## Headless deploy ```bash diff --git a/docker-dev/docker-compose.yml b/docker-dev/docker-compose.yml index 395601a4..1b8391b0 100644 --- a/docker-dev/docker-compose.yml +++ b/docker-dev/docker-compose.yml @@ -194,7 +194,7 @@ x-ldap-env: &ldap-env Security__Ldap__AllowInsecure: "true" Security__Ldap__SearchBase: "dc=zb,dc=local" Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local" - Security__Ldap__ServiceAccountPassword: "serviceaccount123" + Security__Ldap__ServiceAccountPassword: "${OTOPCUA_LDAP_BIND_PASSWORD:-serviceaccount123}" Security__Ldap__GroupToRole__ReadOnly: "ReadOnly" Security__Ldap__GroupToRole__WriteOperate: "WriteOperate" Security__Ldap__GroupToRole__WriteTune: "WriteTune" @@ -402,7 +402,7 @@ services: Security__Ldap__AllowInsecure: "true" Security__Ldap__SearchBase: "dc=zb,dc=local" Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local" - Security__Ldap__ServiceAccountPassword: "serviceaccount123" + Security__Ldap__ServiceAccountPassword: "${OTOPCUA_LDAP_BIND_PASSWORD:-serviceaccount123}" Security__DeployApiKey: "docker-dev-deploy-key" Security__Auth__DisableLogin: "${OTOPCUA_DISABLE_LOGIN:-true}" # #520 stage 6 — node ACL enforcement, the dark switch. Default OFF, exactly as in production. @@ -535,7 +535,7 @@ services: Security__Ldap__AllowInsecure: "true" Security__Ldap__SearchBase: "dc=zb,dc=local" Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local" - Security__Ldap__ServiceAccountPassword: "serviceaccount123" + Security__Ldap__ServiceAccountPassword: "${OTOPCUA_LDAP_BIND_PASSWORD:-serviceaccount123}" Security__DeployApiKey: "docker-dev-deploy-key" Security__Auth__DisableLogin: "${OTOPCUA_DISABLE_LOGIN:-true}" # Node ACL enforcement, the dark switch — same env override and same default-OFF as central-1.