Overlay Features

Deploy OpenLDAP with all three overlays enabled — memberOf, password policy, and audit logging — and validate they work together.

Project Files

services:
  openldap:
    image: ${LDAP_IMAGE:-openldap:local}
    container_name: openldap-overlays
    hostname: openldap-overlays
    environment:
      - LDAP_DOMAIN=example.com
      - LDAP_ADMIN_PASSWORD=AdminPass123!
      - LDAP_ORGANIZATION=Overlay Test Organization
      
      # Schemas required for testing
      - INCLUDE_SCHEMAS=cosine,inetorgperson,nis
      
      # Enable all overlays for testing
      - ENABLE_MEMBEROF=true
      - ENABLE_PASSWORD_POLICY=true
      - ENABLE_AUDIT_LOG=true
      - ENABLE_MONITORING=true
    ports:
      - "389:389"
    volumes:
      - ldap-data:/var/lib/ldap
      - ldap-config:/etc/openldap/slapd.d
      - ./logs:/logs
      - ./init:/docker-entrypoint-initdb.d:ro
    
    # Security settings
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - DAC_READ_SEARCH
      - DAC_OVERRIDE
      - NET_BIND_SERVICE
      - SETUID
      - SETGID
      - CHOWN
    stop_grace_period: 30s
    
    restart: unless-stopped
    
    # Resource limits
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1.0'
        reservations:
          memory: 128M
    
    # Log rotation
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  ldap-data:
  ldap-config:

Set image

export LDAP_IMAGE=ghcr.io/vibhuvioio/openldap:latest

Start

docker compose up -d

# Watch the automated tests run
docker logs -f openldap-overlays

What Gets Tested

The init script automatically validates all three overlays:

Verify Results

# Check test results from logs
docker logs openldap-overlays 2>&1 | grep -E "(PASS|FAIL|Testing)"

Expected output:

=== Test 1: memberOf overlay ===
✓ PASS: memberOf attribute correctly set on user1

=== Test 2: Password Policy overlay ===
✓ PASS: Weak password correctly rejected
✓ PASS: Strong password accepted

=== Test 3: Audit Log ===
✓ PASS: Audit log file exists

Manual Testing

Test memberOf

ldapsearch -x -H ldap://localhost:389 \
  -D "cn=Manager,dc=example,dc=com" \
  -w "AdminPass123!" \
  -b "uid=user1,ou=Users,dc=example,dc=com" \
  "(objectClass=*)" memberOf

Test Password Policy

# Should fail — password too short
ldappasswd -x -H ldap://localhost:389 \
  -D "cn=Manager,dc=example,dc=com" \
  -w "AdminPass123!" \
  -s "123" \
  "uid=user1,ou=Users,dc=example,dc=com"

View Audit Log

docker exec openldap-overlays tail -20 /logs/audit.log

Environment Variables

environment:
  - LDAP_DOMAIN=example.com
  - LDAP_ADMIN_PASSWORD=AdminPass123!
  - ENABLE_MEMBEROF=true
  - ENABLE_PASSWORD_POLICY=true
  - ENABLE_AUDIT_LOG=true
  - ENABLE_MONITORING=true

Connection Details

Cleanup

docker compose down -v