#!/bin/bash
# slapd Setup Script - xinux.int Produktivbetrieb
# Basis: dc=xinux,dc=int
# Features: TLS (eigene CA), memberOf Overlay, readonly Bind-User,
#           inetOrgPerson, mailAlternateAddress, Gruppen pro Dienst,
#           Sammelkonten, sudo-Schema, ldapscripts, SSSD

set -e

# ============================================================
# Variablen
# ============================================================
DOM="xinux.int"
DC1="xinux"
DC2="int"
ADMINPW='123Start$'
READONLYPW='readonly123$'

# Zertifikatspfade (eigene CA, bereits im System-CA-Store)
CERT="/etc/ssl/own.crt"
KEY="/etc/ssl/own.key"

# ============================================================
# Zertifikat holen (Wildcard *.xinux.int von eigener CA)
# ============================================================
echo "==> Zertifikat holen..."
wget -nv -O /tmp/${DOM}.tgz https://web.samogo.de/certs/${DOM}.tgz
tar -C /tmp -xzf /tmp/${DOM}.tgz
mv /tmp/fullchain.pem ${CERT}
mv /tmp/privkey.pem ${KEY}

# ============================================================
# Aufräumen
# ============================================================
echo "==> Aufräumen..."
systemctl stop slapd 2>/dev/null || true
apt purge -y slapd ldap-utils ldapscripts sssd libnss-sss libpam-sss libsss-sudo 2>/dev/null || true
rm -rf /etc/ldap/ /var/lib/ldap/ /etc/ldapscripts/ /etc/sssd/

# ============================================================
# Installation vorbereiten
# ============================================================
echo "==> Installation vorbereiten..."
debconf-set-selections <<< "slapd slapd/password1 password ${ADMINPW}"
debconf-set-selections <<< "slapd slapd/password2 password ${ADMINPW}"
debconf-set-selections <<< "slapd slapd/domain string ${DOM}"
debconf-set-selections <<< "slapd shared/organization string xinux"
debconf-set-selections <<< "slapd slapd/backend select MDB"
debconf-set-selections <<< "slapd slapd/purge_database boolean false"
debconf-set-selections <<< "slapd slapd/move_old_database boolean true"
debconf-set-selections <<< "slapd slapd/allow_ldap_v2 boolean false"

# ============================================================
# Installation
# ============================================================
echo "==> Installation..."
DEBIAN_FRONTEND=noninteractive apt install -y \
    slapd ldap-utils ldapscripts \
    sssd libnss-sss libpam-sss libsss-sudo \
    pwgen

# ============================================================
# Zertifikat Rechte
# ============================================================
chown openldap:openldap ${CERT} ${KEY}
chmod 640 ${CERT} ${KEY}

# ============================================================
# TLS konfigurieren
# ============================================================
echo "==> TLS konfigurieren..."
cat <<HERE > /tmp/tls.ldif
dn: cn=config
changetype: modify
replace: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/ca-certificates.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: ${CERT}
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: ${KEY}
HERE
ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/tls.ldif

# ldaps aktivieren
sed -i 's|SLAPD_SERVICES=.*|SLAPD_SERVICES="ldap:/// ldaps:/// ldapi:///"|' /etc/default/slapd
systemctl restart slapd

# ============================================================
# memberOf Overlay
# ============================================================
echo "==> memberOf Overlay aktivieren..."
cat <<HERE > /tmp/memberof.ldif
dn: cn=module,cn=config
changetype: add
objectClass: olcModuleList
cn: module
olcModulePath: /usr/lib/ldap
olcModuleLoad: memberof

dn: olcOverlay=memberof,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcMemberOf
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf
HERE
ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/memberof.ldif

# refint Overlay (hält memberOf konsistent bei Löschungen)
cat <<HERE > /tmp/refint.ldif
dn: cn=module,cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: refint

dn: olcOverlay=refint,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
olcOverlay: refint
olcRefintAttribute: memberof member manager owner
HERE
ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/refint.ldif

# ============================================================
# ldap.conf
# ============================================================
cat <<HERE > /etc/ldap/ldap.conf
BASE    dc=${DC1},dc=${DC2}
URI     ldaps://ldap.${DOM}
TLS_CACERT /etc/ssl/certs/ca-certificates.crt
HERE

# ============================================================
# Grundstruktur
# ============================================================
echo "==> Grundstruktur anlegen..."
cat <<HERE > /tmp/struktur.ldif
dn: ou=users,dc=${DC1},dc=${DC2}
objectClass: organizationalUnit
ou: users

dn: ou=groups,dc=${DC1},dc=${DC2}
objectClass: organizationalUnit
ou: groups

dn: ou=hosts,dc=${DC1},dc=${DC2}
objectClass: organizationalUnit
ou: hosts

dn: ou=sudo,dc=${DC1},dc=${DC2}
objectClass: organizationalUnit
ou: sudo
HERE
ldapadd -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/struktur.ldif

# ============================================================
# Readonly Bind-User
# ============================================================
echo "==> Readonly Bind-User anlegen..."
READONLY_HASH=$(slappasswd -s "${READONLYPW}")
cat <<HERE > /tmp/readonly.ldif
dn: cn=readonly,dc=${DC1},dc=${DC2}
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: readonly
description: Read-only bind user fuer Dienste (Dovecot, Nextcloud, MediaWiki, HedgeDoc, OPNsense)
userPassword: ${READONLY_HASH}
HERE
ldapadd -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/readonly.ldif

# ============================================================
# ACL: readonly darf lesen, nicht schreiben
# ============================================================
echo "==> ACL konfigurieren..."
cat <<HERE > /tmp/acl.ldif
dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to attrs=userPassword
  by self write
  by dn="cn=admin,dc=${DC1},dc=${DC2}" write
  by anonymous auth
  by * none
olcAccess: {1}to *
  by self write
  by dn="cn=admin,dc=${DC1},dc=${DC2}" write
  by dn="cn=readonly,dc=${DC1},dc=${DC2}" read
  by * none
HERE
ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/acl.ldif

# ============================================================
# Xinux-Schema (eigenes Attribut mailAlternateAddress)
# ============================================================
echo "==> Xinux-Schema laden..."
cat <<HERE > /tmp/xinux.ldif
dn: cn=xinux,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: xinux
olcAttributeTypes: ( 1.3.6.1.4.1.99999.1.1
  NAME 'mailAlternateAddress'
  DESC 'Zusaetzliche E-Mail-Adressen (Aliase)'
  EQUALITY caseIgnoreIA5Match
  SUBSTR caseIgnoreIA5SubstringsMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcObjectClasses: ( 1.3.6.1.4.1.99999.2.1
  NAME 'xinuxMailUser'
  DESC 'Xinux Mail-Erweiterung fuer Aliase'
  SUP top AUXILIARY
  MAY ( mailAlternateAddress ) )
HERE
ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/xinux.ldif

# ============================================================
# Sudo-Schema
# ============================================================
echo "==> Sudo-Schema laden..."
cat <<HERE > /tmp/sudo.ldif
dn: cn=sudo,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: sudo
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) who may run sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 'Command(s) to be executed' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoOption' DESC 'Options passed to sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoRunAsUser' DESC 'User(s) impersonated by sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.6 NAME 'sudoRunAsGroup' DESC 'Group(s) impersonated by sudo' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.7 NAME 'sudoNotBefore' DESC 'Start of time interval for which the entry is valid' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.8 NAME 'sudoNotAfter' DESC 'End of time interval for which the entry is valid' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.9 NAME 'sudoOrder' DESC 'an integer to order the sudoRole entries' EQUALITY integerMatch ORDERING integerOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
olcObjectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' DESC 'Sudoer Entries' SUP top STRUCTURAL MUST cn MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoOption $ sudoRunAsUser $ sudoRunAsGroup $ sudoNotBefore $ sudoNotAfter $ sudoOrder $ description ) )
HERE
ldapadd -Y EXTERNAL -H ldapi:/// -f /tmp/sudo.ldif

# ============================================================
# Sudo-Regeln
# ============================================================
echo "==> Sudo-Regeln anlegen..."
cat <<HERE > /tmp/sudo_rules.ldif
dn: cn=defaults,ou=sudo,dc=${DC1},dc=${DC2}
objectClass: sudoRole
cn: defaults
sudoOption: env_keep+=SSH_AUTH_SOCK

dn: cn=admin_role,ou=sudo,dc=${DC1},dc=${DC2}
objectClass: sudoRole
cn: admin_role
sudoUser: %sudo
sudoHost: ALL
sudoCommand: ALL
sudoRunAsUser: ALL
sudoRunAsGroup: ALL
HERE
ldapadd -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/sudo_rules.ldif

# ============================================================
# Gruppen anlegen (groupOfNames für memberOf, posixGroup für GID)
# ============================================================
echo "==> Gruppen anlegen..."
cat <<HERE > /tmp/gruppen.ldif
dn: cn=it,ou=groups,dc=${DC1},dc=${DC2}
objectClass: posixGroup
cn: it
gidNumber: 10000
description: Primärgruppe

dn: cn=sudo,ou=groups,dc=${DC1},dc=${DC2}
objectClass: posixGroup
cn: sudo
gidNumber: 10001
description: Sudo-Berechtigte

dn: cn=mailusers,ou=groups,dc=${DC1},dc=${DC2}
objectClass: groupOfNames
objectClass: posixGroup
cn: mailusers
gidNumber: 10002
description: Postfix/Dovecot Zugang
member: cn=mailusers,ou=groups,dc=${DC1},dc=${DC2}

dn: cn=nextcloud-users,ou=groups,dc=${DC1},dc=${DC2}
objectClass: groupOfNames
objectClass: posixGroup
cn: nextcloud-users
gidNumber: 10003
description: Nextcloud Zugang
member: cn=nextcloud-users,ou=groups,dc=${DC1},dc=${DC2}

dn: cn=mediawiki-users,ou=groups,dc=${DC1},dc=${DC2}
objectClass: groupOfNames
objectClass: posixGroup
cn: mediawiki-users
gidNumber: 10004
description: MediaWiki Zugang
member: cn=mediawiki-users,ou=groups,dc=${DC1},dc=${DC2}

dn: cn=hedgedoc-users,ou=groups,dc=${DC1},dc=${DC2}
objectClass: groupOfNames
objectClass: posixGroup
cn: hedgedoc-users
gidNumber: 10005
description: HedgeDoc Zugang
member: cn=hedgedoc-users,ou=groups,dc=${DC1},dc=${DC2}

dn: cn=vpn-users,ou=groups,dc=${DC1},dc=${DC2}
objectClass: groupOfNames
objectClass: posixGroup
cn: vpn-users
gidNumber: 10006
description: OPNsense VPN Zugang
member: cn=vpn-users,ou=groups,dc=${DC1},dc=${DC2}
HERE
ldapadd -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/gruppen.ldif

# ============================================================
# ldapscripts konfigurieren (mit UTEMPLATE für inetOrgPerson)
# ============================================================
echo "==> ldapscripts konfigurieren..."
cat <<HERE > /etc/ldapscripts/ldapscripts.conf
SERVER="ldaps://ldap.${DOM}"
SUFFIX="dc=${DC1},dc=${DC2}"
GSUFFIX="ou=groups"
USUFFIX="ou=users"
MSUFFIX="ou=hosts"
BINDDN="cn=admin,dc=${DC1},dc=${DC2}"
USHELL="/bin/bash"
UHOMES="/home/%u"
CREATEHOMES="yes"
HOMESKEL="/etc/skel"
BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
GIDSTART="10000"
UIDSTART="10000"
MIDSTART="20000"
GCLASS="posixGroup"
PASSWORDGEN="pwgen"
RECORDPASSWORDS="no"
LOGTOFILE="yes"
LOGFILE="/var/log/ldapscripts.log"
LOGTOSYSLOG="no"
LDAPSEARCHBIN="/usr/bin/ldapsearch"
LDAPADDBIN="/usr/bin/ldapadd"
LDAPDELETEBIN="/usr/bin/ldapdelete"
LDAPMODIFYBIN="/usr/bin/ldapmodify"
LDAPMODRDNBIN="/usr/bin/ldapmodrdn"
LDAPPASSWDBIN="/usr/bin/ldappasswd"
LDAPSEARCHOPTS="-o ldif-wrap=no"
UTEMPLATE="/etc/ldapscripts/ldapadduser.template"
GTEMPLATE=""
MTEMPLATE=""
HERE

# User-Template mit inetOrgPerson + mailAlternateAddress
cat <<'HERE' > /etc/ldapscripts/ldapadduser.template
dn: uid=<user>,<usuffix>,<suffix>
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
objectClass: xinuxMailUser
cn: <user>
sn: <user>
uid: <user>
uidNumber: <uid>
gidNumber: <gid>
homeDirectory: <home>
loginShell: <shell>
mail: <user>@xinux.de
HERE

echo -n "${ADMINPW}" > /etc/ldapscripts/ldapscripts.passwd
chmod 600 /etc/ldapscripts/ldapscripts.passwd

# ============================================================
# User anlegen: thomas.will und tina.messmann
# ============================================================
echo "==> User anlegen..."
ldapaddgroup it 2>/dev/null || true
ldapadduser thomas.will it
ldapadduser tina.messmann it

# Passwörter setzen
echo -e "${ADMINPW}\n${ADMINPW}" | ldapsetpasswd thomas.will 2>/dev/null
echo -e "${ADMINPW}\n${ADMINPW}" | ldapsetpasswd tina.messmann 2>/dev/null

# ============================================================
# Mail-Attribute ergänzen (primäre Adresse + Aliase)
# ============================================================
echo "==> Mail-Attribute setzen..."
cat <<HERE > /tmp/mail_thomas.ldif
dn: uid=thomas.will,ou=users,dc=${DC1},dc=${DC2}
changetype: modify
add: objectClass
objectClass: xinuxMailUser
-
replace: mail
mail: thomas.will@xinux.de
-
add: mailAlternateAddress
mailAlternateAddress: thomas@xinux.de
mailAlternateAddress: thomas@xinux.org
mailAlternateAddress: thomas@xinux.com
mailAlternateAddress: thomas@xinux.net
mailAlternateAddress: thomas.will@xinux.org
mailAlternateAddress: thomas.will@xinux.com
mailAlternateAddress: thomas.will@xinux.net
-
replace: sn
sn: Will
-
replace: cn
cn: Thomas Will
HERE
ldapmodify -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/mail_thomas.ldif

cat <<HERE > /tmp/mail_tina.ldif
dn: uid=tina.messmann,ou=users,dc=${DC1},dc=${DC2}
changetype: modify
add: objectClass
objectClass: xinuxMailUser
-
replace: mail
mail: tina.messmann@xinux.de
-
add: mailAlternateAddress
mailAlternateAddress: tina@xinux.de
mailAlternateAddress: tina@xinux.org
mailAlternateAddress: tina@xinux.com
mailAlternateAddress: tina@xinux.net
mailAlternateAddress: tina.messmann@xinux.org
mailAlternateAddress: tina.messmann@xinux.com
mailAlternateAddress: tina.messmann@xinux.net
-
replace: sn
sn: Messmann
-
replace: cn
cn: Tina Messmann
HERE
ldapmodify -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/mail_tina.ldif

# ============================================================
# Sammelkonto info@xinux.de
# ============================================================
echo "==> Sammelkonto info@ anlegen..."
cat <<HERE > /tmp/sammelkonten.ldif
dn: cn=info,ou=groups,dc=${DC1},dc=${DC2}
objectClass: groupOfNames
cn: info
mail: info@xinux.de
description: Sammelpostfach info@xinux.de
member: uid=thomas.will,ou=users,dc=${DC1},dc=${DC2}
member: uid=tina.messmann,ou=users,dc=${DC1},dc=${DC2}
HERE
ldapadd -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/sammelkonten.ldif

# ============================================================
# User zu Gruppen hinzufügen
# ============================================================
echo "==> Gruppen befüllen..."

# sudo
ldapaddusertogroup thomas.will sudo
ldapaddusertogroup tina.messmann sudo

# mailusers (groupOfNames - manuell per ldapmodify)
cat <<HERE > /tmp/grp_mail.ldif
dn: cn=mailusers,ou=groups,dc=${DC1},dc=${DC2}
changetype: modify
add: member
member: uid=thomas.will,ou=users,dc=${DC1},dc=${DC2}
member: uid=tina.messmann,ou=users,dc=${DC1},dc=${DC2}
HERE
ldapmodify -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/grp_mail.ldif

# nextcloud-users
cat <<HERE > /tmp/grp_nextcloud.ldif
dn: cn=nextcloud-users,ou=groups,dc=${DC1},dc=${DC2}
changetype: modify
add: member
member: uid=thomas.will,ou=users,dc=${DC1},dc=${DC2}
member: uid=tina.messmann,ou=users,dc=${DC1},dc=${DC2}
HERE
ldapmodify -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/grp_nextcloud.ldif

# mediawiki-users
cat <<HERE > /tmp/grp_mediawiki.ldif
dn: cn=mediawiki-users,ou=groups,dc=${DC1},dc=${DC2}
changetype: modify
add: member
member: uid=thomas.will,ou=users,dc=${DC1},dc=${DC2}
member: uid=tina.messmann,ou=users,dc=${DC1},dc=${DC2}
HERE
ldapmodify -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/grp_mediawiki.ldif

# hedgedoc-users
cat <<HERE > /tmp/grp_hedgedoc.ldif
dn: cn=hedgedoc-users,ou=groups,dc=${DC1},dc=${DC2}
changetype: modify
add: member
member: uid=thomas.will,ou=users,dc=${DC1},dc=${DC2}
member: uid=tina.messmann,ou=users,dc=${DC1},dc=${DC2}
HERE
ldapmodify -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/grp_hedgedoc.ldif

# vpn-users
cat <<HERE > /tmp/grp_vpn.ldif
dn: cn=vpn-users,ou=groups,dc=${DC1},dc=${DC2}
changetype: modify
add: member
member: uid=thomas.will,ou=users,dc=${DC1},dc=${DC2}
member: uid=tina.messmann,ou=users,dc=${DC1},dc=${DC2}
HERE
ldapmodify -xD cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" -H ldap://localhost -f /tmp/grp_vpn.ldif

# ============================================================
# SSSD konfigurieren (für lokalen Login auf dem LDAP-Server)
# ============================================================
echo "==> SSSD konfigurieren..."
cat <<HERE > /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
services = nss, pam, sudo
domains = ${DOM}

[domain/${DOM}]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
access_provider = permit
sudo_provider = ldap
ldap_uri = ldaps://ldap.${DOM}
ldap_search_base = dc=${DC1},dc=${DC2}
ldap_sudo_search_base = ou=sudo,dc=${DC1},dc=${DC2}
ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
ldap_tls_reqcert = demand
cache_credentials = true

[nss]
filter_users = root,daemon,bin,sys,sync,games,man,lp,mail,news,uucp,proxy,nobody,systemd-network,systemd-resolve,dbus,polkitd,sssd,sshd

[pam]
offline_credentials_expiration = 2
HERE
chmod 600 /etc/sssd/sssd.conf
pam-auth-update --enable sss mkhomedir
systemctl enable --now sssd

# ============================================================
# Aufräumen
# ============================================================
rm -f /tmp/*.ldif /tmp/${DOM}.tgz

# ============================================================
# Fertig - Kurzcheck
# ============================================================
echo ""
echo "==> Fertig. Kurzcheck:"
echo "--- slapd Status ---"
systemctl is-active slapd
echo "--- TLS Test ---"
ldapwhoami -x -H ldaps://ldap.${DOM} -D cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}"
echo "--- Readonly Bind ---"
ldapwhoami -x -H ldaps://ldap.${DOM} -D cn=readonly,dc=${DC1},dc=${DC2} -w "${READONLYPW}"
echo "--- User ---"
ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" \
    -b ou=users,dc=${DC1},dc=${DC2} uid mail mailAlternateAddress memberOf
echo "--- Gruppen ---"
ldapsearch -xLLL -H ldap://localhost -D cn=admin,dc=${DC1},dc=${DC2} -w "${ADMINPW}" \
    -b ou=groups,dc=${DC1},dc=${DC2} cn member
echo ""
echo "Readonly PW: ${READONLYPW}"
echo "Admin PW:    ${ADMINPW}"