Joseph Doherty
59bf74760c
Self-signed cert (SAN IP 10.100.0.35), public cert checked in, key host-only. Deployed on 10.100.0.35: TLS chain verifies with the cert and fails without it; raw LDAPS simple bind returns 0 for a good password and 49 for a bad one; plain :3893 bind unchanged. README: thumbprint, client config, rotation; also fixes the user-bind DN example (GLAuth puts users under their primary group OU). Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
19 lines
844 B
YAML
19 lines
844 B
YAML
# Shared dev GLAuth for OtOpcUa + MxAccessGateway + ScadaBridge.
|
|
# Deploy on the shared Docker host 10.100.0.35: docker compose up -d
|
|
# Verify: ldapsearch -x -H ldap://10.100.0.35:3893 \
|
|
# -D cn=serviceaccount,dc=zb,dc=local -w '<service-account-password>' \
|
|
# -b dc=zb,dc=local "(cn=multi-role)" memberOf
|
|
# (the serviceaccount password is rotated out-of-band — SEC-36 — not recorded here)
|
|
name: zb-shared-glauth
|
|
services:
|
|
glauth:
|
|
image: glauth/glauth:latest
|
|
container_name: zb-shared-glauth
|
|
restart: unless-stopped
|
|
ports:
|
|
- "3893:3893" # plain LDAP (Transport=None)
|
|
- "3894:3894" # LDAPS (Transport=Ldaps) — mxaccessgw#180
|
|
volumes:
|
|
- ./config.toml:/app/config/config.cfg:ro
|
|
- ./tls:/app/config/tls:ro # cert.pem (public, in repo) + key.pem (host only)
|