DE 

//Cloudogu EcoSystem Docs

  1. docs.cloudogu.com
  2. Developer documentation
  3. Dogus
  4. LDAP
  5. Development
  6. LDAP root password rotation
Getting Started
User manual
Developer documentation

LDAP root password rotation

Background

The LDAP backend stores the password of its privileged root DN, cn=admin,<openldap_suffix>, in olcRootPW. This account is separate from CES users and service accounts.

Previously, olcRootPW was set only during database initialization, so later changes to the encrypted rootpwd configuration had no effect. Instances initially installed with LDAP up to version 2.6.7-4 may also retain a password generated by a doguctl version that used Go's math/rand.

Startup behavior

startup.sh now calls applyRootPassword on every start while the initialization daemon is running:

  1. It finds the backend database below cn=config whose olcSuffix matches OPENLDAP_SUFFIX.
  2. It reads rootpwd or generates a password with doguctl random when the key is absent.
  3. It hashes the password with slappasswd and replaces olcRootPW over ldapi:///.

Generated plaintext is not persisted because no Dogu uses the root DN. The update has no completion marker and runs after every start, including after restoring an old LDAP configuration volume.

Failure handling

If the backend cannot be found or updated, startup logs a [ROOT-PASSWORD] warning and continues so service accounts can still be reconciled. The update is retried on the next start. Password values are never logged.