Manage PostgreSQL roles and privileges from YAML or LDAP
Project description
Swiss-army knife to synchronize Postgres roles and privileges from YAML or LDAP.
Postgres is able to check password against an entreprise directory using the LDAP protocol out of the box. ldap2pg automates the creation, update and removal of PostgreSQL roles and users based on entreprise organigram described in the directory.
Managing roles is close to managing privileges as you expect roles to have proper default privileges. ldap2pg can grant and revoke privileges too.
Features
Reads settings from an expressive YAML config file.
Creates, alters and drops PostgreSQL roles from LDAP searches.
Creates static roles from YAML to complete LDAP entries.
Manages role members (alias groups).
Grants or revokes privileges statically or from LDAP entries.
Dry run, check mode.
Logs LDAP searches as ldapsearch(1) commands.
Logs every SQL query.
Here is a sample configuration and execution:
$ cat ldap2pg.yml
- role:
name: ldap_roles
options: NOLOGIN
- ldapsearch:
base: ou=people,dc=ldap,dc=ldap2pg,dc=docker
filter: "(objectClass=organizationalPerson)"
role:
name: '{cn}'
options: LOGIN
parent: ldap_roles
$ ldap2pg --real
Starting ldap2pg 5.7.
Using .../ldap2pg.yml.
Running in real mode.
Inspecting roles in Postgres cluster...
Querying LDAP ou=people,dc=ldap,dc=lda... (objectClass...
Create domitille.
Add missing ldap_roles members.
Delete spurious ldap_roles members.
Update options of albert.
Reassign oscar objects and purge ACL on postgres.
Reassign oscar objects and purge ACL on template1.
Drop oscar.
Synchronization complete.
$
Installation
ldap2pg requires Python 2.6+ or 3+, pyyaml, python-ldap and psycopg2.
The universal installation method is to download from PyPI using pip. Other methods and more details are described in this documentation.
# apt install -y libldap2-dev libsasl2-dev # pip install ldap2pg psycopg2-binary
ldap2pg is licensed under PostgreSQL license. ldap2pg is available with the help of wonderful people, jump to contributors list to see them.
ldap2pg requires a configuration file called ldap2pg.yaml. The [dumb but tested ldap2pg.yml](https://github.com/dalibo/ldap2pg/blob/master/ldap2pg.yml) is a good way to start.
# curl -LO https://github.com/dalibo/ldap2pg/raw/master/ldap2pg.yml # editor ldap2pg.yml
Finally, it’s up to you to use ldap2pg in a crontab or a playbook. Have fun!
ldap2pg is reported to work with OpenLDAP, FreeIPA, Oracle Internet Directory and Microsoft Active Directory.
Support
If you need support and you didn’t found it in documentation, just drop a question in a GitHub issue! French accepted. Don’t miss the cookbook. You’re welcome!
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
File details
Details for the file ldap2pg-5.9.tar.gz.
File metadata
- Download URL: ldap2pg-5.9.tar.gz
- Upload date:
- Size: 44.7 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.2 CPython/3.11.2
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 5282705d9c280b6685e4597e4c004c4d0420a198a24605be3f9a5ad027a97f61 |
|
| MD5 | 842fa2c67ce0fd068064e5b181dbb9c9 |
|
| BLAKE2b-256 | 123a168db93a4cbd03b6b9058c3103343480ad68dd14e763579c0fee3807c5fc |
File details
Details for the file ldap2pg-5.9-py2.py3-none-any.whl.
File metadata
- Download URL: ldap2pg-5.9-py2.py3-none-any.whl
- Upload date:
- Size: 48.7 kB
- Tags: Python 2, Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.2 CPython/3.11.2
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 0271783a8067e9167a06ee5ce26bf368c91e5b82eaeb9553448820e1a69fd7ca |
|
| MD5 | a7eb9f61d9670f87bbff5ddbd69dcfea |
|
| BLAKE2b-256 | e9c65c6fc8577039307ea9976398879a6315183ce8e3ba9c3bea752e1b0de246 |
