userdir ldap #4

Supports: focal bionic xenial


Installs userdir-ldap and configures it.

Install the Canonical userdir-ldap package and configure it for use with Canonical infra.

The default options should be fine for our normal use. The only one you may want to pay attention to is "users-to-migrate", which is a space-separated list of usernames whose ssh keys will be copied from ~/.ssh/authorized_keys to /etc/ssh/user-authorized_keys. By default this is just the ubuntu user, as without this Juju will break, but if you need to add others, this is the place to do it.

Units of the userdir-ldap charm can also be cascaded. Cascaded units will take userdata from their upstream userdir-ldap units. To do this a "server" application can be related to a "client" application via the udprovide and udconsume relations. The "server" unit will attempt to rsync userdata from userdb.internal for the related "client" units. Note that userdb.internal may be configured to only allow syncing of the "template-hostname" userdata. In this case, "client" units will only be able to get userdata for "template-hostname" as well. See the bundle in "./tests/bundles/xenial.yaml" for an example.

Design note: with cascaded userdir-ldap units, user data is coming into the "server" from userdb-host unit via two paths:

  • rsynced via ud-replicate, where ud-replicate will process userdata for local consumption

  • straight rsync, without postprocessing, where client units in turn will be able to ud-replicate from


(string) Apt repository key, typically needed for apt-repo-spec.
(string) Apt repository to install userdir-ldap from.
deb xenial-cat main
(string) List of ciphers allowed. Defaults available since OpenSSH 6.5, and available since OpenSSH 6.2. All supported in both Trusty and Xenial.,,
(string) Fallback domain when none present. This is mostly to work around MAAS's failure to add DNS for LXC containers - LP#1274947.
(string) KEX (Key Exchange) algorithms allowed. Default which has been available since OpenSSH 6.5 so already supported on both Trusty and Xenial.
(string) List of MAC (message authentication code) algorithms allowed. Default MACs available since OpenSSH 6.2 so already supported on both Trusty and Xenial.,,,hmac-sha2-256
(string) An openssh-format RSA private key with no passphrase. (This option is a trapdoor; setting it back to null has no real effect.)
(string) Comma separated groups of sudoers who do not require password
(string) Comma separated groups of sudoers who require a password
(string) If the files rsynced from sshdist don't match our hostname, create a symlink to bridge the gap from /var/lib/misc/thishost.
(string) Name of the userdb host
(string) IP address of the userdb host
(string) A (possibly multiple-line) string of known_hosts entries to seed the userdb trust during install. If none specified, ssh-keyscan will be used.
(string) A space-separated list of usernames whose authorized_keys files should be migrated from ~/.ssh/authorized_keys to /etc/ssh/user-authorized-keys on install.