feature: users have a first name, a last name and an e-mail address.

debian-package/src/usr/lib/vpn-router/vpnrouter_ldap.py

@@ -3,8 +3,8 @@
 The package keeps its own database, dc=vpn-router,dc=local in /var/lib/ldap/vpn-router,
 next to the one slapd's installation creates. Root manages it through the local socket
 with SASL EXTERNAL: the database's root DN is root's peer-credential DN, so there is no
-administrator password. Users are changed by the user-manager service account, which the
-ACLs allow to write ou=users and to set, never read, passwords.
+administrator password. Users and groups are changed by the user-manager service account,
+which the ACLs allow to write ou=users and ou=groups and to set, never read, passwords.
 """
 
 import os
@@ -20,6 +20,7 @@ import ldap.sasl
 URI = 'ldapi:///'
 BASE = 'dc=vpn-router,dc=local'
 USERS = f'ou=users,{BASE}'
+GROUPS = f'ou=groups,{BASE}'
 SERVICES = f'ou=services,{BASE}'
 POLICIES = f'ou=policies,{BASE}'
 DEFAULT_POLICY = f'cn=default,{POLICIES}'
@@ -39,6 +40,7 @@ PASSWORD_HASH = '{ARGON2}'
 ACCESS = (
     f'to attrs=userPassword by dn.exact="{MANAGER}" =wx by self =wx by anonymous auth by * none',
     f'to dn.subtree="{USERS}" by dn.exact="{MANAGER}" manage by * read',
+    f'to dn.subtree="{GROUPS}" by dn.exact="{MANAGER}" manage by * read',
     'to * by * read',
 )
 
@@ -168,7 +170,7 @@ def provision():
         database = _ensure_database(connection)
         _ensure_overlay(connection, database)
         _ensure_entry(connection, BASE, {'objectClass': [b'dcObject', b'organization'], 'dc': [b'vpn-router'], 'o': [b'vpn-router']})
-        for unit in (USERS, SERVICES, POLICIES):
+        for unit in (USERS, GROUPS, SERVICES, POLICIES):
             _ensure_entry(connection, unit, {'objectClass': [b'organizationalUnit'], 'ou': [unit.split(',')[0][3:].encode()]})
         _ensure_entry(connection, DEFAULT_POLICY, {
             'objectClass': [b'organizationalRole', b'pwdPolicy'],