ldap2pg

https://ldap2pg.readthedocs.io/en/latest
Admin
ldap2pg automates the creation, update, and removal of PostgreSQL roles, users, and privileges by...
Tokens:20,970
Snippets:201
Trust Score:8.3
Update:10 months ago
Show doc for...
Tokens:
Raw
### Manual ldap2pg Installation

Source: https://ldap2pg.readthedocs.io/en/latest/install

Manually installs the ldap2pg binary by downloading it from the releases page, placing it in /usr/local/bin, and making it executable. Finally, it tests the installation by checking the version.

```bash
chmod 0755 /usr/local/bin/ldap2pg
ldap2pg --version
```

--------------------------------

### Install Documentation Dependencies with Pip

Source: https://ldap2pg.readthedocs.io/en/latest/hacking

Installs dependencies required for building the project's documentation using pip and a requirements file.

```shell
$ pip install -r docs/requirements.txt
...
Successfully installed babel-2.12.1 certifi-2023.7.22 charset-normalizer-3.2.0 click-8.1.7 colorama-0.4.6 ghp-import-2.1.0 idna-3.4 jinja2-3.1.2 markdown-3.5 m...

```

--------------------------------

### Install ldap2pg with YUM/DNF

Source: https://ldap2pg.readthedocs.io/en/latest/install

Installs the ldap2pg package using the YUM or DNF package manager on RHEL and compatible systems. This method requires enabling the Dalibo Labs YUM repository first.

```bash
yum install ldap2pg
```

--------------------------------

### Docker Compose for ldap2pg Development Environment

Source: https://ldap2pg.readthedocs.io/en/latest/hacking

This code snippet demonstrates how to use Docker Compose to pull images and start PostgreSQL and Samba Directory containers for ldap2pg development. It shows the commands to initialize the environment and confirms the creation of necessary containers. The default setup uses dnsdock aliases for accessing the containers.

```bash
$ docker compose pull
...
Status: Downloaded newer image for postgres:16-alpine
$ docker compose up -d
Creating network "ldap2pg_default" with the default driver
Creating ldap2pg_postgres_1 ...
Creating ldap2pg_samba_1 ...
Creating ldap2pg_postgres_1
Creating ldap2pg_samba_1 ... done

```

--------------------------------

### Install Development Dependencies with Pip

Source: https://ldap2pg.readthedocs.io/en/latest/hacking

Installs development dependencies for functional tests using pip and a requirements file. This is a prerequisite for running tests.

```shell
$ pip install -Ur test/requirements.txt
...
Successfully installed iniconfig-2.0.0 packaging-23.1 pluggy-1.3.0 pytest-7.4.2 sh-1.14.1
$
```

--------------------------------

### ldap2pg Debug Logging Example

Source: https://ldap2pg.readthedocs.io/en/latest/cli

Demonstrates how to increase ldap2pg's logging verbosity to DEBUG level using the LDAP2PG_VERBOSITY environment variable. This output includes detailed information about the startup process, configuration file searching, and warnings about running a prerelease version.

```bash
$ LDAP2PG_VERBOSITY=DEBUG ldap2pg
12:23:45 INFO   Starting ldap2pg                                 version=v6.0-alpha5 runtime=go1.21.0 commit=<none>
12:23:45 WARN   Running a prerelease! Use at your own risks!
12:23:45 DEBUG  Searching configuration file in standard locations.
12:23:45 DEBUG  Found configuration file.                        path=./ldap2pg.yml

```

--------------------------------

### Define Role Configuration Parameters in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

This example configures specific PostgreSQL parameters for a role using a YAML dictionary. ldap2pg will set these parameters upon role creation.

```yaml
- roles:
  - name: my-db-writer
    config:
      log_statement: mod
      log_min_duration_sample: 100
```

--------------------------------

### Execute SQL After Role Creation in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

This example defines an SQL snippet to be executed after a role has been successfully created. It demonstrates the use of LDAP attribute injection for dynamic SQL generation, including identifier escaping.

```yaml
rules:
- ldapsearch: ...
  role:
    name: "{sAMAccountName}"
    after_create: "CREATE SCHEMA {sAMAccountName.identifier()} AUTHORIZATION {sAMAccountName.identifier()}"
```

--------------------------------

### Run ldap2pg Docker Container with Environment Variables

Source: https://ldap2pg.readthedocs.io/en/latest/guides/cookbook

This command illustrates running the ldap2pg Docker container and configuring it using environment variables for PostgreSQL data source name (PGDSN), LDAP URI, LDAP bind DN, and LDAP password. This method is convenient for dynamic or CI/CD environments. Ensure the provided values are correct for your setup.

```bash
docker run --rm -v ${PWD}/ldap2pg.yml:/workspace/ldap2pg.yml -e PGDSN=postgres://postgres@localhost:5432/ -e LDAPURI=ldaps://localhost -e LDAPBINDDN=cn=you,dc=entreprise,dc=fr -e LDAPPASSWORD=pasglop dalibo/ldap2pg
```

--------------------------------

### Example ACL Definition in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

Defines an example Access Control List (ACL) within the ldap2pg configuration. This snippet shows the structure for defining an ACL for 'PROCEDURE', including its scope, the SQL query for inspecting grants, and the SQL queries for granting and revoking privileges.

```yaml
acls:
  PROCEDURE:
    scope: database
    inspect: |
      WITH ...
    grant: GRANT ...
    revoke: REVOKE ...

```

--------------------------------

### Enabling ldap2pg Verbose Debugging

Source: https://ldap2pg.readthedocs.io/en/latest/guides/acls

To get detailed debug messages from ldap2pg, use the `--verbose` command-line option. This option provides more insight into the tool's operations, aiding in troubleshooting.

```bash
ldap2pg --verbose

```

--------------------------------

### Configure PostgreSQL and LDAP Environment Variables

Source: https://ldap2pg.readthedocs.io/en/latest/hacking

This snippet shows how to set environment variables to connect to the PostgreSQL and LDAP containers. It exports PGHOST, PGUSER, PGPASSWORD for PostgreSQL and LDAPURI, LDAPPASSWORD for LDAP. The examples include commands to verify the connections using psql and ldapsearch.

```bash
$ export PGHOST=postgres.ldap2pg.docker PGUSER=postgres PGPASSWORD=postgres
$ psql -c 'SELECT version()';

$ export LDAPURI=ldaps://samba.ldap2pg.docker LDAPPASSWORD=1Ntegral
$ ldapsearch -vxw $LDAPPASSWORD -s base cn

```

--------------------------------

### ldap2pg Output for Custom ACL Changes

Source: https://ldap2pg.readthedocs.io/en/latest/guides/acls

This is an example output from running the ldap2pg command with the custom ACL configuration. It shows the planned 'Revoke' and 'Grant' operations for the 'USAGE' privilege on the 'myenum' type for the role 'alice', along with summary information about the comparison process.

```text
$ldp2pg
... 
16:52:02 CHANGE Would Revoke privileges.                         grant="USAGE ON TYPE myenum TO public" database=db0
16:52:02 CHANGE Would Grant privileges.                          grant="USAGE ON TYPE myenum TO alice" database=db0
16:52:02 INFO   Comparison complete.                             searches=0 roles=1 queries=5 grants=1
16:52:02 INFO   Use --real option to apply changes.
16:52:02 INFO   Done.                                            elapsed=44.345229ms mempeak=1.6MiB ldap=0s inspect=28.992071ms sync=0s
```

--------------------------------

### Generate Unique Role Comment per LDAP Entry in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

This example illustrates generating a unique SQL comment for each role based on LDAP attributes. It ensures that each role receives a distinct comment derived from its corresponding LDAP entry.

```yaml
rules:
- ldapsearch:
    ...
  role:
    name: "{member.cn}"
    comment: "Generated from LDAP entry {member}."
```

--------------------------------

### Run Functional Tests with Pytest

Source: https://ldap2pg.readthedocs.io/en/latest/hacking

Executes functional tests for ldap2pg using the pytest framework. This command assumes dependencies are already installed.

```shell
$ pip install -Ur test/requirements.txt
...
$ pytest test/
...
ldap2pg: /home/bersace/src/dalibo/ldap2pg/test/ldap2pg.sh
...
test/test_nominal.py::test_re_revoke PASSED                                  [ 90%]
test/test_nominal.py::test_nothing_to_do PASSED                              [100%]

=============================== 11 passed in 14.90s ================================
$
```

--------------------------------

### Configure LDAP Search Base, Scope, and Filter in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

Defines the parameters for an LDAP search operation used in synchronization rules. This includes the base DN to start the search from, the scope (e.g., 'sub' for subtree), and a filter to select specific entries.

```yaml
rules:
- ldapsearch:
    base: ou=people,dc=acme,dc=tld
    scope: sub
    filter: >
      (&
         (member=*) 
         (cn=group_*)
      )

```

--------------------------------

### Postgres Roles Blacklist Configuration

Source: https://ldap2pg.readthedocs.io/en/latest/config

Defines a list of roles and glob patterns that ldap2pg should exclude from management. This prevents ldap2pg from modifying or deleting critical system roles or other specified roles. Note the need to quote patterns starting with '*'.

```yaml
postgres:
  roles_blacklist_query:
  - postgres
  - "pg_*"
  - "rds_*"

```

--------------------------------

### Define PostgreSQL Privilege Profiles in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

Specifies privilege profiles used for granting permissions in PostgreSQL. Profiles are lists of references to PostgreSQL ACL types or other profiles. They can be recursive. Profiles starting with '_' are inactive unless included in an active profile.

```yaml
privileges:
  reading:
  - on: GLOBAL DEFAULT
    type: SELECT
    object: TABLES

  writing:
  - reading
  - on: GLOBAL
    type: SELECT
    object: TABLES

```

--------------------------------

### Remove All Roles from PostgreSQL using ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/guides/cookbook

Provides a method to remove all roles from a PostgreSQL cluster using `ldap2pg`. This is accomplished by explicitly defining an empty `rules` array in the `ldap2pg.yaml` configuration, which instructs `ldap2pg` to drop all managed roles. The example uses standard input to provide the configuration.

```bash
$ echo '{version: 6, rules: []}' | ldap2pg --config -
... 
Empty synchronization map. All roles will be dropped!
... 

```

--------------------------------

### Postgres Managed Roles Query Configuration

Source: https://ldap2pg.readthedocs.io/en/latest/config

Specifies the SQL query to list the names of roles that ldap2pg should manage. This restricts role deletion and privilege management to a defined set of roles, often used with a dedicated group like 'ldap_roles'. The example shows managing 'public', 'ldap_roles', and its members.

```yaml
postgres:
  managed_roles_query: |
    VALUES
      ('public'),
      ('ldap_roles')

    UNION

    SELECT DISTINCT role.rolname
    FROM pg_roles AS role
    JOIN pg_auth_members AS ms ON ms.member = role.oid
    JOIN pg_roles AS parent
      ON parent.rolname = 'ldap_roles' AND parent.oid = ms.roleid
    ORDER BY 1;

```

--------------------------------

### Run ldap2pg Docker Container with Help

Source: https://ldap2pg.readthedocs.io/en/latest/guides/cookbook

This command demonstrates how to run the ldap2pg Docker container and display its help message. It's useful for understanding the available command-line options. No specific configuration files or environment variables are required for this basic help command.

```bash
docker run --rm dalibo/ldap2pg --help
```

--------------------------------

### Run ldap2pg from Source

Source: https://ldap2pg.readthedocs.io/en/latest/hacking

This command demonstrates how to run the ldap2pg application directly from the source code using `go run`. The output shows the startup messages, including version information, configuration file usage, and the result of the synchronization process, indicating no pending actions.

```bash
$ go run .
09:54:27 INFO   Starting ldap2pg                                 version=v6.0-alpha5 runtime=go1.20.3 commit=<none>
09:54:27 WARN   Running a prerelease! Use at your own risks!
09:54:27 INFO   Using YAML configuration file.                   path=./ldap2pg.yml
...  
09:54:27 INFO   Nothing to do.                                   elapsed=78.470278ms mempeak=1.2MiB postgres=0s queries=0 ldap=486.921µs searches=1

```

--------------------------------

### ldap2pg CLI Arguments Help

Source: https://ldap2pg.readthedocs.io/en/latest/cli

Displays the help message for ldap2pg command-line arguments, listing available options for configuration, mode selection, and output control. It shows the usage pattern and a detailed breakdown of each argument.

```bash
$ ldap2pg --help
usage: ldap2pg [OPTIONS] [dbname]

      --check                     Check mode: exits with 1 if Postgres instance is unsynchronized.
      --color                     Force color output.
  -c, --config string             Path to YAML configuration file. Use - for stdin.
  -C, --directory string          Path to directory containing configuration files.
  -?, --help                      Show this help message and exit. (default true)
  -y, --ldappassword-file string  Path to LDAP password file.
  -q, --quiet count               Decrease log verbosity.
  -R, --real                      Real mode. Apply changes to Postgres instance.
  -P, --skip-privileges           Turn off privilege synchronisation.
  -v, --verbose count             Increase log verbosity.
  -V, --version                   Show version and exit. (default true)

Optional argument dbname is alternatively the database name or a conninfo string or an URI.
See man psql(1) for more information.

By default, ldap2pg runs in dry mode.
ldap2pg requires a configuration file to describe LDAP searches and mappings.
See https://ldap2pg.readthedocs.io/en/latest/ for further details.

```

--------------------------------

### Search LDAP Directory using ldapsearch

Source: https://ldap2pg.readthedocs.io/en/latest/guides/cookbook

Demonstrates how to search an LDAP directory using the `ldapsearch` command-line tool. It covers basic connection, authentication, and filtering results to find specific entries like group members. The output of `ldapsearch` is shown, along with how to save connection settings in `.ldaprc` and environment variables.

```bash
$ ldapsearch -H ldaps://ldap.ldap2pg.docker -U testsasl -W
Enter LDAP Password:
SASL/DIGEST-MD5 authentication started
SASL username: testsasl
SASL SSF: 128
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
...
# search result
search: 4
result: 0 Success

# numResponses: 16
# numEntries: 15
$ 

```

```bash
LDAPURI ldaps://ldap.ldap2pg.docker
LDAPSASL_AUTHCID testsasl

```

```bash
$ ldapsearch -H ldaps://ldap.ldap2pg.docker -U testsasl -W -b cn=dba,ou=groups,dc=ldap,dc=ldap2pg,dc=docker '' member
...
# dba, groups, ldap.ldap2pg.docker
dn: cn=dba,ou=groups,dc=ldap,dc=ldap2pg,dc=docker
member: cn=Alan,ou=people,dc=ldap,dc=ldap2pg,dc=docker
member: cn=albert,ou=people,dc=ldap,dc=ldap2pg,dc=docker
member: cn=ALICE,ou=people,dc=ldap,dc=ldap2pg,dc=docker

# search result
search: 4
result: 0 Success

... $
```

--------------------------------

### Example PostgreSQL CREATE TYPE Statement

Source: https://ldap2pg.readthedocs.io/en/latest/guides/acls

This SQL snippet defines a custom PostgreSQL enumeration type named 'myenum' within the 'public' schema. This type can then be managed using a custom ACL in ldap2pg.

```sql
CREATE TYPE public.myenum AS ENUM ('toto', 'titi', 'tata');
```

--------------------------------

### Run ldap2pg Docker Container with Configuration File

Source: https://ldap2pg.readthedocs.io/en/latest/guides/cookbook

This command shows how to run the ldap2pg Docker container while mounting a local ldap2pg.yml configuration file into the container. This allows for persistent and complex configurations to be managed outside the container. The `${PWD}/ldap2pg.yml` path should be replaced with the actual path to your configuration file.

```bash
docker run --rm -v ${PWD}/ldap2pg.yml:/workspace/ldap2pg.yml dalibo/ldap2pg
```

--------------------------------

### Run ldap2pg Unit Tests

Source: https://ldap2pg.readthedocs.io/en/latest/hacking

This command executes the unit tests for the ldap2pg project using the standard Go testing tool. The output lists the packages being tested and indicates which ones have tests (`ok`) and which do not (`no test files`). This confirms that the tests are running and passing.

```bash
$ go test ./...
?       github.com/dalibo/ldap2pg/cmd/render-doc        [no test files]
ok      github.com/dalibo/ldap2pg/cmd/mon-dojo  0.002s
ok      github.com/dalibo/ldap2pg/v6/internal      0.003s
ok      github.com/dalibo/ldap2pg/v6/internal/config       0.007s
ok      github.com/dalibo/ldap2pg/v6/internal/inspect      0.005s
ok      github.com/dalibo/ldap2pg/v6/internal/ldap 0.005s
ok      github.com/dalibo/ldap2pg/v6/internal/lists        0.005s
?       github.com/dalibo/ldap2pg/v6/internal/postgres     [no test files]
ok      github.com/dalibo/ldap2pg/v6/internal/perf 0.004s
ok      github.com/dalibo/ldap2pg/v6/internal/privileges    0.003s
?       github.com/dalibo/ldap2pg/v6/internal/role [no test files]
ok      github.com/dalibo/ldap2pg/v6/internal/pyfmt        0.004s
ok      github.com/dalibo/ldap2pg/v6/internal/tree 0.002s
ok      github.com/dalibo/ldap2pg/v6/internal/wanted       0.003s

```

--------------------------------

### Configure LDAP High Availability with ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/guides/cookbook

Shows how to configure `ldap2pg` to use multiple LDAP servers for high availability. This is achieved by providing a space-separated list of URIs to the `LDAPURI` environment variable, allowing `ldap2pg` to connect to any available LDAP server.

```bash
$ LDAPURI="ldaps://ldap1 ldaps://ldap2" ldap2pg

```

--------------------------------

### Execute Tests in CI Environment

Source: https://ldap2pg.readthedocs.io/en/latest/hacking

Commands to build the ldap2pg project and run tests using Docker Compose, mimicking the CI environment. Requires `goreleaser` and Docker.

```shell
$ goreleaser build --clean --snapshot --single-target
$ COMPOSE_FILE=docker-compose.yml:test/docker-compose.yml docker compose up --exit-code-from=test

```

--------------------------------

### YAML Quoting for LDAP Attribute Injection

Source: https://ldap2pg.readthedocs.io/en/latest/config

Demonstrates the correct way to quote YAML strings containing LDAP attributes to ensure proper parsing. Incorrect quoting can lead to invalid YAML dictionaries instead of strings with injected attributes.

```yaml
rules:
  - role: {cn}  # It's an invalid YAML dict.
  - role: "{cn}"  # It's a string with LDAP attribute injection

```

--------------------------------

### Define Role Options in ldap2pg (String and Dict)

Source: https://ldap2pg.readthedocs.io/en/latest/config

This snippet shows how to define PostgreSQL role options using either a space-separated string or a YAML dictionary. It covers static options for a role.

```yaml
- roles:
  - name: my-dba
    options: LOGIN SUPERUSER
  - name: my-group
    options:
      LOGIN: no
      INHERIT: yes
```

--------------------------------

### Execute SQL Before Role Creation in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

This configuration shows how to specify an SQL snippet to be executed immediately before a role is created. It supports LDAP attribute injection, with methods for escaping identifiers and strings.

```yaml
rules:
- ldapsearch: ...
  role:
    name: "{cn}"
    before_create: "INSERT INTO log VALUES ({cn.string()})"
```

--------------------------------

### LDAP Attribute Injection with Case Control

Source: https://ldap2pg.readthedocs.io/en/latest/ldap

Demonstrates how to inject LDAP attributes into role definitions and control their case using `.lower()` or `.upper()` methods. This allows for dynamic role naming based on LDAP data.

```yaml
- ldapsearch: ...
  role: "{cn.lower()}"
```

--------------------------------

### Use Static Lists for ldap2pg Queries

Source: https://ldap2pg.readthedocs.io/en/latest/postgres

Replaces dynamic SQL queries with static lists defined directly in the YAML configuration. This is useful for fixing values for databases or schemas, ensuring a consistent synchronization scope.

```yaml
postgres:
  databases_query: [postgres]
  schemas_query: [public]
```

--------------------------------

### Using Predefined Privilege Profiles in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/builtins

This YAML configuration demonstrates how to define custom privilege profiles ('ro', 'rw', 'ddl') by referencing built-in profiles (e.g., '__connect__', '__usage_on_schemas__') and then applying a custom profile ('ddl') to a specific database ('mydb') for a role ('admins').

```yaml
privileges:
  ro:
  - __connect__
  - __usage_on_schemas__
  - __select_on_tables__

  rw:
  - ro
  - __insert__
  - __update_on_tables__

  ddl:
  - rw
  - __all_on_schemas__
  - __all_on_tables__

rules:
- grant:
    privilege: ddl
    database: mydb
    role: admins

```

--------------------------------

### Postgres Database Query Configuration

Source: https://ldap2pg.readthedocs.io/en/latest/config

Configures how ldap2pg identifies databases in the PostgreSQL cluster. This can be done using an SQL query to dynamically fetch database names or by providing a static list of database names.

```yaml
postgres:
  databases_query: "SELECT datname FROM pg_catalog.pg_databases;"
  # OR
  databases_query: [mydb]

```

--------------------------------

### Define PostgreSQL Role Rules in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

Specifies rules for creating or managing PostgreSQL roles. Each rule can define role attributes like name, login options (e.g., SUPERUSER, LOGIN), and membership. This can be a single rule or a list of rules.

```yaml
rules:
- role:
    name: dba
    options: SUPERUSER LOGIN
- roles:
  - name: group0
    options: NOLOGIN
  - name: group1
    options: NOLOGIN

```

--------------------------------

### Define Privilege Profiles and Grant Rules in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/privileges

This YAML configuration demonstrates how to define privilege profiles like 'reading', 'writing', and 'owning' by referencing built-in privilege types or other profiles. It then shows how to use 'rules' to grant these profiles to specific roles, including options like 'NOLOGIN'.

```yaml
privileges:
  reading:
  - __connect__
  - __usage_on_schemas__
  - __select_on_tables__

  writing:
  - reading  # include reading privileges
  - __insert_on_tables__
  - __update_on_tables__

  owning:
  - writing
  - __create_on_schemas__
  - __truncate_on_tables__

rules:
- role:
  - names:
    - readers
    - writers
    - owners
    options: NOLOGIN
- grant:
  - privilege: reading
    role: readers
  - privilege: writing
    role: writers
  - privilege: owning
    role: owners

```

--------------------------------

### Configure Default Privileges in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/postgres

Sets up default privileges for database objects. The 'reading' privilege with SELECT on TABLES is defined and then granted to 'readers' for the 'public' schema, owned by 'ownerrole' or '__auto__'.

```yaml
privileges:
  reading:
  - default: global
    type: SELECT
    on: TABLES

rules:
- grant:
  - privilege: reading
    role: readers
    schema: public
    owner: ownerrole

-
  grant:
  - privilege: reading
    role: readers
    schema: public
    owner __auto__
```

--------------------------------

### Define Parent Role in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

This snippet defines a parent role for a newly created role. The `GRANT ROLE` SQL command will be executed to establish the inheritance relationship.

```yaml
rules:
- role:
    name: myrole
    parent: myparent
```

--------------------------------

### Define LDAP-based Role Synchronization Rules in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

Sets up synchronization rules for creating PostgreSQL roles based on LDAP group memberships. It includes an optional LDAP search section to query the directory for role information.

```yaml
rules:
- description: "Define DBA roles"
  ldapsearch:
    base: ...
  roles:
  - name: "{cn}"
    options: LOGIN SUPERUSER

```

--------------------------------

### Configure Privilege Types in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

Specifies the type of privilege to grant in PostgreSQL, referencing standard types like SELECT, REFERENCES, or USAGE. This can be a single string or a list of strings. Multiple types defined will create separate privileges.

```yaml
privileges:
  reading:
  - type: USAGE
    on: SCHEMAS

```

--------------------------------

### Map LDAP Search Results to PostgreSQL Roles with ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/guides/cookbook

Configures `ldap2pg.yaml` to translate LDAP search results into PostgreSQL roles. This snippet shows how to define the LDAP base search and map attributes from LDAP entries (like `member.cn`) to PostgreSQL role names and options. It also demonstrates the dry run mode of `ldap2pg` before applying changes.

```yaml
- ldapsearch:
    base: cn=dba,ou=groups,dc=ldap,dc=ldap2pg,dc=docker
  role:
    name: '{member.cn}'
    options: LOGIN SUPERUSER

```

```bash
$ ldap2pg
... 
Querying LDAP cn=dba,ou=groups,dc=ldap,dc=ldap2pg,dc=docker...
Would create alan.
Would create albert.
Would update options of alice.
...
Comparison complete.
$ 

```

--------------------------------

### Define Databases for Synchronization in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/postgres

Specifies the SQL query to retrieve the list of databases that ldap2pg should manage. This query must return the default database defined in PGDATABASE and influences the scope of role and grant inspection.

```yaml
postgres:
  databases_query: |
    SELECT datname
    FROM pg_catalog.pg_database
    WHERE datallowconn IS TRUE;
```

--------------------------------

### Generate and Synchronize Big Case Configuration

Source: https://ldap2pg.readthedocs.io/en/latest/hacking

Generates a large configuration for ldap2pg and synchronizes it with the database. Uses `make big` and pipes output to the ldap2pg command.

```shell
$ test/genbigconfig.sh | PGDATABASE=big0 go run . -c -

```

--------------------------------

### Configure Default SELECT Privileges on Future Tables (YAML)

Source: https://ldap2pg.readthedocs.io/en/latest/privileges

This YAML configuration demonstrates how to set default privileges for future tables created by a role. It ensures that a specified role (e.g., 'bob') can SELECT on all tables that another role (e.g., 'alice') will create. This uses the `SCHEMA DEFAULT` ACL type to target schema-level defaults.

```yaml
privileges:
  reading:
  - type: SELECT
    on: SCHEMA DEFAULT
    object: TABLES
  owning:
  - type: CREATE
    on: SCHEMAS

rules:
- roles:
    names:
    - alice
    - bob
    options: LOGIN
- grant:
    privilege: owning
    role: alice
- grant:
    privilege: reading
    role: bob

```

--------------------------------

### Synchronize a Subset of Roles in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/postgres

Customizes the SQL query to determine which roles ldap2pg should synchronize. This allows excluding specific roles like superusers or focusing on a subset of roles, such as members of a particular group.

```yaml
postgres:
  managed_roles_query: |
    SELECT 'public'
    UNION
    SELECT rolname
    FROM pg_catalog.pg_roles
    WHERE rolsuper IS FALSE
    ORDER BY 1;
```

--------------------------------

### Configure LDAP Joins for Sub-Searches in ldap2pg

Source: https://ldap2pg.readthedocs.io/en/latest/config

Customizes LDAP sub-searches within synchronization rules. The 'joins' section allows specifying search parameters (filter, scope) for attributes that require further LDAP lookups. Only one sub-search per top-level search is supported.

```yaml
rules:
- ldapsearch:
    joins:
      member:
        filter: ...
        scope: ...
  role:
  - name: "{member.sAMAccountName}"

```

--------------------------------

### Configure ldap2pg Role Blacklist

Source: https://ldap2pg.readthedocs.io/en/latest/roles

This configuration snippet shows how to define a blacklist for roles that ldap2pg should ignore during synchronization. The 'roles_blacklist_query' is specified as a list of glob patterns. Roles matching these patterns, including their grants, will not be processed by ldap2pg. The default blacklist includes 'postgres' and 'pg_*'.

```yaml
postgres:
  # This is the default value.
  roles_blacklist_query: [postgres, pg_*]
```
Tokens:
Raw