tegwick
4e07d60ff1
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ea3-7939-7b63-8125-699f8b50bedd
45 lines
1.4 KiB
Bash
Executable file
45 lines
1.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# repair-realm-live.sh - attended repair for privacyIDEA realm bootstrap state.
|
|
#
|
|
# This wrapper prompts for live passwords, writes them only to a private
|
|
# temporary directory, runs the idempotent realm bootstrap, and removes the
|
|
# temporary files on exit.
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
|
|
SSO_MFA_K8S_DIR=$(cd -- "$SCRIPT_DIR/.." && pwd)
|
|
PI_URL="${PI_URL:-https://pink.coulomb.social}"
|
|
|
|
if [[ ! -t 0 ]]; then
|
|
echo "ERROR: repair-realm-live.sh needs an interactive terminal for password prompts." >&2
|
|
exit 1
|
|
fi
|
|
|
|
export PATH="/home/worsch/.local/bin:$PATH"
|
|
umask 077
|
|
|
|
tmp="$(mktemp -d)"
|
|
cleanup() {
|
|
rm -rf "$tmp"
|
|
unset PI_ADMIN_PASSWORD LLDAP_LDAP_USER_PASS
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
mkdir -p "$tmp/privacyidea" "$tmp/lldap"
|
|
|
|
printf "privacyIDEA pi-admin password: " >&2
|
|
read -rs PI_ADMIN_PASSWORD
|
|
printf "\n" >&2
|
|
printf "LLDAP bind/admin password: " >&2
|
|
read -rs LLDAP_LDAP_USER_PASS
|
|
printf "\n" >&2
|
|
|
|
printf "PI_ADMIN_PASSWORD=%q\n" "$PI_ADMIN_PASSWORD" > "$tmp/privacyidea/secrets.env"
|
|
printf "LLDAP_LDAP_USER_PASS=%q\n" "$LLDAP_LDAP_USER_PASS" > "$tmp/lldap/secrets.env"
|
|
|
|
bash "$SCRIPT_DIR/bootstrap-realm.sh" "$tmp" "$PI_URL"
|
|
|
|
echo "Realm configuration applied; functional verification requires an enrolled OTP token."
|
|
bash "$SSO_MFA_K8S_DIR/verify-t06.sh" --pi-url "$PI_URL" --user "${MFA_USER:-platform-root}"
|
|
echo "[OK] realm repair and functional MFA verification passed."
|