• Stars
    star
    208
  • Rank 189,015 (Top 4 %)
  • Language
    Go
  • License
    PostgreSQL License
  • Created over 7 years ago
  • Updated about 1 month ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

🐘 👥 Manage PostgreSQL roles and privileges from YAML or LDAP

ldap2pg: PostgreSQL role and privileges management

Swiss-army knife to synchronize Postgres roles and privileges from YAML or LDAP.

Documentation Continuous Integration report Docker Cloud Automated build

Postgres is able to check password of an existing role using the LDAP protocol out of the box. ldap2pg automates the creation, update and removal of PostgreSQL roles and users from an entreprise directory.

Managing roles is close to managing privileges as you expect roles to have proper default privileges. ldap2pg can grant and revoke privileges too.

Features

  • Reads settings from an expressive YAML config file.
  • Creates, alters and drops PostgreSQL roles from LDAP searches.
  • Creates static roles from YAML to complete LDAP entries.
  • Manages role parents (alias groups).
  • Grants or revokes privileges statically or from LDAP entries.
  • Dry run, check mode.
  • Logs LDAP searches as ldapsearch(1) commands.
  • Logs every SQL statements.

Here is a sample configuration and execution:

$ cat ldap2pg.yml
version: 6

rules:
- role:
    name: nominal
    options: NOLOGIN
    comment: "Database owner"
- ldapsearch:
    base: ou=people,dc=ldap,dc=ldap2pg,dc=docker
    filter: "(objectClass=organizationalPerson)"
  role:
    name: '{cn}'
    options:
      LOGIN: yes
      CONNECTION LIMIT: 5
$ ldap2pg --real
08:25:12 INFO   Starting ldap2pg                                 version=v6.0-alpha5 runtime=go1.21.0 commit=<none>
08:25:12 INFO   Using YAML configuration file.                   path=docs/readme/ldap2pg.yml
08:25:12 INFO   Running as unprivileged user.                    user=ldap2pg super=false server="PostgreSQL 15.3" cluster=ldap2pg-dev database=nominal
08:25:12 INFO   Connected to LDAP directory.                     uri=ldaps://ldap.ldap2pg.docker authzid="dn:cn=admin,dc=ldap,dc=ldap2pg,dc=docker"
08:25:12 INFO   Real mode. Postgres instance will modified.
08:25:12 CHANGE Create role.                                     role=charles database=nominal
08:25:12 CHANGE Set role comment.                                role=charles database=nominal
08:25:12 CHANGE Inherit role for management.                     role=charles database=nominal
08:25:12 CHANGE Alter options.                                   role=alain options="LOGIN CONNECTION LIMIT 5" database=nominal
08:25:12 CHANGE Terminate running sessions.                      role=omar database=nominal
08:25:12 CHANGE Allow current user to reassign objects.          role=omar parent=ldap2pg database=nominal
08:25:12 CHANGE Reassign objects and purge ACL.                  role=omar owner=nominal database=nominal
08:25:12 CHANGE Drop role.                                       role=omar database=nominal
08:25:12 INFO   Comparison complete.                             elapsed=68.47058ms mempeak=1.6MiB postgres=15.323294ms queries=8 ldap=635.894µs searches=1
$

Installation

Download package or binary from Releases page.

$ sudo yum install https://github.com/dalibo/ldap2pg/releases/download/v6.0-alpha5/ldap2pg_6.0-alpha5_linux_amd64.rpm
...
Installed:
  ldap2pg-6.0.0~alpha5-1.x86_64

Complete!
$ ldap2pg --help
usage: ldap2pg [OPTIONS]

      --check             Check mode: exits with 1 if Postgres instance is unsynchronized.
      --color             Force color output. (default true)
  -c, --config string     Path to YAML configuration file. Use - for stdin.
  -?, --help              Show this help message and exit. (default true)
  -q, --quiet count       Decrease log verbosity.
  -R, --real              Real mode. Apply changes to Postgres instance.
  -P, --skip-privileges   Turn off privilege synchronisation.
  -v, --verbose count     Increase log verbosity.
  -V, --version           Show version and exit. (default true)


By default, ldap2pg runs in dry mode.
ldap2pg requires a configuration file to describe LDAP searches and mappings.
See https://ldap2pg.readthedocs.io/en/latest/ for further details.
$

ldap2pg is licensed under PostgreSQL license.

ldap2pg requires a configuration file called ldap2pg.yaml. Project ships a tested ldap2pg.yml as a starting point.

# curl -LO https://github.com/dalibo/ldap2pg/raw/master/ldap2pg.yml
# editor ldap2pg.yml

Finally, it's up to you to use ldap2pg in a crontab or a playbook. Have fun!

ldap2pg is reported to work with OpenLDAP, FreeIPA, Oracle Internet Directory and Microsoft Active Directory.

Support

If you need support and you didn't found it in documentation, just drop a question in a GitHub issue! French accepted. Don't miss the cookbook for advanced use cases.

Authors

ldap2pg is a Dalibo Labs project.

More Repositories

1

pev2

Postgres Explain Visualizer 2
TypeScript
2,492
star
2

pg_activity

pg_activity is a top like application for PostgreSQL server activity monitoring.
Python
2,472
star
3

sqlserver2pgsql

Migration tool to convert a Microsoft SQL Server Database into a PostgreSQL database, as automatically as possible
Perl
507
star
4

temboard

PostgreSQL Remote Control
Python
449
star
5

pandocker

🐳 A simple docker image for pandoc with filters, templates, fonts, and the latex bazaar
Shell
145
star
6

pitrery

DEPRECATED. PostgreSQL Point In Time Recovery made easy
Shell
108
star
7

pgshark

Messing with PostgreSQL network traffic to make some usefull things
Perl
85
star
8

emaj

E-Maj is a PostgreSQL extension that tracks updates on tables sets with rollback capabilities
PLpgSQL
73
star
9

explain.dalibo.com

PEV2 Flask service. Visualizing and understanding PostgreSQL EXPLAIN plans made easy.
HTML
37
star
10

workshops

PostgreSQL Workshops
HTML
34
star
11

db2topg

Automated tool for DB2 migration to PostgreSQL, ala ora2pg
Perl
31
star
12

pgbadger

pgbadger.github.io
HTML
23
star
13

pgtoolkit

Postgres Support from Python
Python
21
star
14

temboard-agent

PostgreSQL Remote Control agent [MERGED IN dalibo/temboard]
Python
20
star
15

pgsnap

pgsnap is a PostgreSQL tool that mimics orasnap performance report tool for Oracle.
PHP
20
star
16

pg_log_authfail

C
16
star
17

pgsql-resource-agent

Simple Pacemaker OCF Agent for two PostgreSQL servers in streaming replication
Shell
11
star
18

docker

Docker images of Dalibo's projects
10
star
19

emaj_web

A web client for the E-Maj PostgreSQL extension
PHP
10
star
20

data2pg

PLpgSQL
10
star
21

check_patroni

A nagios plugin for patroni.
Python
7
star
22

pg_dumpacl

Tool for dumping database creation options
C
7
star
23

pgsql_logwatch

Monitor PostgreSQL logfile using Logwatch
ApacheConf
6
star
24

selinux-pgsql-pgdg

SELinux policy module for PGDG rpms
Shell
4
star
25

pg_query_settings

Module that dynamically set queries parameters based on their queryid
C
4
star
26

cornac

Migrated to GitLab
Python
4
star
27

docker-python26

Docker image with EOL Python 2.6
HTML
3
star
28

from-oracle-to-postgresql

Yet another transition guide for developers
HTML
3
star
29

patroni-rpm

Patroni RPM packaging (centos/rhel)
Shell
3
star
30

blog

🐘 blog.dalibo.com
HTML
3
star
31

hackingpg

Dépôt relatif aux journées de hacking sur PostgreSQL
C
2
star
32

selinux-powa

SELinux policy for PoWA
Makefile
2
star
33

pgpool_adm

A PostgreSQL extension to control pgpool using its pcp protocol
C
2
star
34

pg_french_datatypes

A simple set of handy data types for french speaking PostgreSQL developpers
2
star
35

dalibo.github.io

Some PostgreSQL tools developped by DALIBO, the french PostgreSQL company
CSS
1
star
36

keyex

SSH Key Exchanger
Python
1
star
37

yang

Yet Another Nagios Grapher
JavaScript
1
star
38

docker-pgtap

1
star
39

docker-labs-sdk

Mutualised docker image for PostgreSQL tooling development
Dockerfile
1
star
40

docker-cornac-sdk

Docker image for CI and development of cornac
Makefile
1
star
41

vault-rpm

HashiCorp Vault RPM packaging for CentOS / RHEL 7
Shell
1
star
42

ansible-collection-dolibarr

Ansible collection to manage the lifecycle of your Dolibarr instance
Jinja
1
star