From b181e37a362c067cd8f755ff2c070737d5002dee Mon Sep 17 00:00:00 2001 From: Michael Li Date: Fri, 27 Oct 2023 14:42:17 -0400 Subject: [PATCH] doc: Add examples for using LDAP (#506) --- docs/resources/account_ldap.md | 45 +++++++++++++++++++ docs/resources/auth_method_ldap.md | 32 +++++++++++++ docs/resources/managed_group_ldap.md | 39 ++++++++++++++++ .../resources/boundary_account_ldap/import.sh | 1 + .../boundary_account_ldap/resource.tf | 34 ++++++++++++++ .../boundary_auth_method_ldap/import.sh | 1 + .../boundary_auth_method_ldap/resource.tf | 21 +++++++++ .../boundary_managed_group_ldap/import.sh | 1 + .../boundary_managed_group_ldap/resource.tf | 28 ++++++++++++ 9 files changed, 202 insertions(+) create mode 100644 examples/resources/boundary_account_ldap/import.sh create mode 100644 examples/resources/boundary_account_ldap/resource.tf create mode 100644 examples/resources/boundary_auth_method_ldap/import.sh create mode 100644 examples/resources/boundary_auth_method_ldap/resource.tf create mode 100644 examples/resources/boundary_managed_group_ldap/import.sh create mode 100644 examples/resources/boundary_managed_group_ldap/resource.tf diff --git a/docs/resources/account_ldap.md b/docs/resources/account_ldap.md index dc2f393f..a96c681c 100644 --- a/docs/resources/account_ldap.md +++ b/docs/resources/account_ldap.md @@ -10,7 +10,44 @@ description: |- The account resource allows you to configure a Boundary account. +## Example Usage +```terraform +resource "boundary_scope" "org" { + name = "organization_one" + description = "My first scope!" + scope_id = "global" + auto_create_admin_role = true + auto_create_default_role = true +} + +resource "boundary_auth_method_ldap" "forumsys_ldap" { + name = "forumsys public LDAP" + scope_id = "global" # add the new auth method to the global scope + urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server + user_dn = "dc=example,dc=com" # the basedn for users + user_attr = "uid" # the user attribute + group_dn = "dc=example,dc=com" # the basedn for groups + bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding + bind_password = "password" # passwd to use when binding + state = "active-public" # make sure the new auth-method is available to everyone + enable_groups = true # this turns-on the discovery of a user's groups + discover_dn = true # this turns-on the discovery of an authenticating user's dn +} + +resource "boundary_account_ldap" "einstein" { + auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id + login_name = "einstein" + name = "einstein" +} + +resource "boundary_user" "einstein" { + name = "einstein" + description = "User resource for einstein" + scope_id = "global" + account_ids = [boundary_account_ldap.einstein.id] +} +``` ## Schema @@ -29,3 +66,11 @@ The account resource allows you to configure a Boundary account. ### Read-Only - `id` (String) The ID of the account. + +## Import + +Import is supported using the following syntax: + +```shell +terraform import boundary_account_ldap.foo +``` diff --git a/docs/resources/auth_method_ldap.md b/docs/resources/auth_method_ldap.md index 40db2119..a7e74f4f 100644 --- a/docs/resources/auth_method_ldap.md +++ b/docs/resources/auth_method_ldap.md @@ -10,7 +10,31 @@ description: |- The LDAP auth method resource allows you to configure a Boundary auth_method_ldap. +## Example Usage +```terraform +resource "boundary_scope" "org" { + name = "organization_one" + description = "My first scope!" + scope_id = "global" + auto_create_admin_role = true + auto_create_default_role = true +} + +resource "boundary_auth_method_ldap" "forumsys_ldap" { + name = "forumsys public LDAP" + scope_id = "global" # add the new auth method to the global scope + urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server + user_dn = "dc=example,dc=com" # the basedn for users + user_attr = "uid" # the user attribute + group_dn = "dc=example,dc=com" # the basedn for groups + bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding + bind_password = "password" # passwd to use when binding + state = "active-public" # make sure the new auth-method is available to everyone + enable_groups = true # this turns-on the discovery of a user's groups + discover_dn = true # this turns-on the discovery of an authenticating user's dn +} +``` ## Schema @@ -54,3 +78,11 @@ The LDAP auth method resource allows you to configure a Boundary auth_method_lda ### Read-Only - `id` (String) The ID of the auth method. + +## Import + +Import is supported using the following syntax: + +```shell +terraform import boundary_auth_method_ldap.foo +``` diff --git a/docs/resources/managed_group_ldap.md b/docs/resources/managed_group_ldap.md index 043ec036..703d4d4d 100644 --- a/docs/resources/managed_group_ldap.md +++ b/docs/resources/managed_group_ldap.md @@ -10,7 +10,38 @@ description: |- The managed group resource allows you to configure a Boundary group. +## Example Usage +```terraform +resource "boundary_scope" "org" { + name = "organization_one" + description = "My first scope!" + scope_id = "global" + auto_create_admin_role = true + auto_create_default_role = true +} + +resource "boundary_auth_method_ldap" "forumsys_ldap" { + name = "forumsys public LDAP" + scope_id = "global" # add the new auth method to the global scope + urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server + user_dn = "dc=example,dc=com" # the basedn for users + user_attr = "uid" # the user attribute + group_dn = "dc=example,dc=com" # the basedn for groups + bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding + bind_password = "password" # passwd to use when binding + state = "active-public" # make sure the new auth-method is available to everyone + enable_groups = true # this turns-on the discovery of a user's groups + discover_dn = true # this turns-on the discovery of an authenticating user's dn +} + +resource "boundary_managed_group_ldap" "forumsys_scientists" { + name = "scientists" + description = "forumsys scientists managed group" + auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id + group_names = ["Scientists"] +} +``` ## Schema @@ -28,3 +59,11 @@ The managed group resource allows you to configure a Boundary group. ### Read-Only - `id` (String) The ID of the group. + +## Import + +Import is supported using the following syntax: + +```shell +terraform import boundary_managed_group_ldap.foo +``` diff --git a/examples/resources/boundary_account_ldap/import.sh b/examples/resources/boundary_account_ldap/import.sh new file mode 100644 index 00000000..c23d4dbf --- /dev/null +++ b/examples/resources/boundary_account_ldap/import.sh @@ -0,0 +1 @@ +terraform import boundary_account_ldap.foo diff --git a/examples/resources/boundary_account_ldap/resource.tf b/examples/resources/boundary_account_ldap/resource.tf new file mode 100644 index 00000000..cbaacf7e --- /dev/null +++ b/examples/resources/boundary_account_ldap/resource.tf @@ -0,0 +1,34 @@ +resource "boundary_scope" "org" { + name = "organization_one" + description = "My first scope!" + scope_id = "global" + auto_create_admin_role = true + auto_create_default_role = true +} + +resource "boundary_auth_method_ldap" "forumsys_ldap" { + name = "forumsys public LDAP" + scope_id = "global" # add the new auth method to the global scope + urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server + user_dn = "dc=example,dc=com" # the basedn for users + user_attr = "uid" # the user attribute + group_dn = "dc=example,dc=com" # the basedn for groups + bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding + bind_password = "password" # passwd to use when binding + state = "active-public" # make sure the new auth-method is available to everyone + enable_groups = true # this turns-on the discovery of a user's groups + discover_dn = true # this turns-on the discovery of an authenticating user's dn +} + +resource "boundary_account_ldap" "einstein" { + auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id + login_name = "einstein" + name = "einstein" +} + +resource "boundary_user" "einstein" { + name = "einstein" + description = "User resource for einstein" + scope_id = "global" + account_ids = [boundary_account_ldap.einstein.id] +} diff --git a/examples/resources/boundary_auth_method_ldap/import.sh b/examples/resources/boundary_auth_method_ldap/import.sh new file mode 100644 index 00000000..00da7b2e --- /dev/null +++ b/examples/resources/boundary_auth_method_ldap/import.sh @@ -0,0 +1 @@ +terraform import boundary_auth_method_ldap.foo diff --git a/examples/resources/boundary_auth_method_ldap/resource.tf b/examples/resources/boundary_auth_method_ldap/resource.tf new file mode 100644 index 00000000..bd20d221 --- /dev/null +++ b/examples/resources/boundary_auth_method_ldap/resource.tf @@ -0,0 +1,21 @@ +resource "boundary_scope" "org" { + name = "organization_one" + description = "My first scope!" + scope_id = "global" + auto_create_admin_role = true + auto_create_default_role = true +} + +resource "boundary_auth_method_ldap" "forumsys_ldap" { + name = "forumsys public LDAP" + scope_id = "global" # add the new auth method to the global scope + urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server + user_dn = "dc=example,dc=com" # the basedn for users + user_attr = "uid" # the user attribute + group_dn = "dc=example,dc=com" # the basedn for groups + bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding + bind_password = "password" # passwd to use when binding + state = "active-public" # make sure the new auth-method is available to everyone + enable_groups = true # this turns-on the discovery of a user's groups + discover_dn = true # this turns-on the discovery of an authenticating user's dn +} diff --git a/examples/resources/boundary_managed_group_ldap/import.sh b/examples/resources/boundary_managed_group_ldap/import.sh new file mode 100644 index 00000000..5008b093 --- /dev/null +++ b/examples/resources/boundary_managed_group_ldap/import.sh @@ -0,0 +1 @@ +terraform import boundary_managed_group_ldap.foo diff --git a/examples/resources/boundary_managed_group_ldap/resource.tf b/examples/resources/boundary_managed_group_ldap/resource.tf new file mode 100644 index 00000000..91234627 --- /dev/null +++ b/examples/resources/boundary_managed_group_ldap/resource.tf @@ -0,0 +1,28 @@ +resource "boundary_scope" "org" { + name = "organization_one" + description = "My first scope!" + scope_id = "global" + auto_create_admin_role = true + auto_create_default_role = true +} + +resource "boundary_auth_method_ldap" "forumsys_ldap" { + name = "forumsys public LDAP" + scope_id = "global" # add the new auth method to the global scope + urls = ["ldap://ldap.forumsys.com"] # the addr of the LDAP server + user_dn = "dc=example,dc=com" # the basedn for users + user_attr = "uid" # the user attribute + group_dn = "dc=example,dc=com" # the basedn for groups + bind_dn = "cn=read-only-admin,dc=example,dc=com" # the dn to use when binding + bind_password = "password" # passwd to use when binding + state = "active-public" # make sure the new auth-method is available to everyone + enable_groups = true # this turns-on the discovery of a user's groups + discover_dn = true # this turns-on the discovery of an authenticating user's dn +} + +resource "boundary_managed_group_ldap" "forumsys_scientists" { + name = "scientists" + description = "forumsys scientists managed group" + auth_method_id = boundary_auth_method_ldap.forumsys_ldap.id + group_names = ["Scientists"] +}