{"id":4190,"date":"2014-10-17T15:58:59","date_gmt":"2014-10-17T07:58:59","guid":{"rendered":"http:\/\/www.hmouse2.tk\/?p=4190"},"modified":"2014-10-24T13:58:24","modified_gmt":"2014-10-24T05:58:24","slug":"ldap%e7%9a%84%e5%ae%89%e8%a3%85%e5%92%8c%e9%85%8d%e7%bd%ae","status":"publish","type":"post","link":"https:\/\/www.hmouse.cn\/?p=4190","title":{"rendered":"LDAP\u7684\u5b89\u88c5\u548c\u914d\u7f6e"},"content":{"rendered":"

\u53c2\u8003url\uff1ahttp:\/\/my.oschina.net\/aiguozhe\/blog\/151554<\/a><\/p>\n

\u7f51\u4e0a\u53d1\u73b0\u5f88\u591a\u5b89\u88c5\u7684\u6587\u6863\uff0c\u5f88\u591a\u90fd\u662f\u4e0d\u53ef\u4ee5\u7528\u7684\uff0c\u6240\u4ee5\u81ea\u5df1\u6574\u7406\u4e86\u4e0b\u3002\u6bd4\u8f83\u9760\u8c31\u7684\u5c31\u662f\u8fd9\u4e2a\u53c2\u8003url\u7684\u8bf4\u6cd5\u3002<\/p>\n

centos \u4e3b\u8981\u7684\u5c31\u662fopenldap\uff0c\u8fd9\u4e2a\u5b89\u88c5\u7528yum\u7684\u8bdd\u5f88\u7b80\u5355\u3002<\/p>\n

yum install openldap openldap-servers openldap-clients -y<\/p>\n

\u914d\u7f6e<\/p>\n

cp<\/code> \/usr\/share\/openldap-servers\/slapd<\/code>.conf.obsolete <\/code>\/etc\/openldap\/slapd<\/code>.conf<\/code> <\/p>\n

cp<\/code> \/usr\/share\/openldap-servers\/DB_CONFIG<\/code>.example <\/code>\/var\/lib\/ldap\/DB_CONFIG<\/code> <\/p>\n

mv<\/code> \/etc\/openldap\/slapd<\/code>.d{,.bak}<\/code> <\/p>\n

\u4e5f\u8bb8\u4f60\u5df2\u7ecf\u731c\u5230\uff0cslapd.conf\u662fOpenLDAP\u7684\u914d\u7f6e\u6587\u4ef6\u3002\u4e0b\u9762\u5bf9slapd.conf\u7684\u4e00\u4e9b\u914d\u7f6e\u9879\u505a\u4e9b\u8bf4\u660e\uff1a <\/p>\n

cat \/etc\/openldap\/slapd.conf | grep -v “#” <\/p>\n

############# <\/p>\n

include         \/etc\/openldap\/schema\/corba.schema
include         \/etc\/openldap\/schema\/core.schema
include         \/etc\/openldap\/schema\/cosine.schema
include         \/etc\/openldap\/schema\/duaconf.schema
include         \/etc\/openldap\/schema\/dyngroup.schema
include         \/etc\/openldap\/schema\/inetorgperson.schema
include         \/etc\/openldap\/schema\/java.schema
include         \/etc\/openldap\/schema\/misc.schema
include         \/etc\/openldap\/schema\/nis.schema
include         \/etc\/openldap\/schema\/openldap.schema
include         \/etc\/openldap\/schema\/ppolicy.schema
include         \/etc\/openldap\/schema\/collective.schema<\/p>\n

allow bind_v2<\/p>\n

pidfile         \/var\/run\/openldap\/slapd.pid
argsfile        \/var\/run\/openldap\/slapd.args<\/p>\n

 <\/p>\n

TLSCACertificatePath \/etc\/openldap\/certs
TLSCertificateFile “\\”OpenLDAP Server\\””
TLSCertificateKeyFile \/etc\/openldap\/certs\/password<\/p>\n

 <\/p>\n

database config
access to *
        by dn.exact=”gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth” manage
        by * none<\/p>\n

database monitor
access to *
        by dn.exact=”gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth” read
        by dn.exact=”cn=admin,dc=my-domain,dc=com” read
        by * none<\/p>\n

database        bdb
suffix          “dc=test,dc=com”            #\u81ea\u5df1\u5b9a\u4e49\u7684dc
checkpoint      1024 15
rootdn          “cn=admin,dc=test,dc=com” #\u81ea\u5df1\u5b9a\u4e49\u7ba1\u7406\u5458
rootpw  {SSHA}KFAXZdD60RR0I4YmajnX4nQh263Wozh8  #\u81ea\u5df1\u5b9a\u4e49\u5bc6\u7801  \u53ef\u4ee5\u660e\u6587\u6216\u8005\u7528slappasswd\u52a0\u5bc6<\/p>\n

directory       \/var\/lib\/ldap<\/p>\n

index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub<\/p>\n

\u7136\u540e\u542f\u52a8ldap\uff0c\/etc\/init.d\/slapd start<\/code> <\/p>\n

\u7136\u540e\u9700\u8981\u5bfc\u5165\u4e00\u4e2aldif\uff0c\u5426\u5219\u65e0\u6cd5\u4f7f\u7528\uff0c\u6211\u5728\u770b\u7f51\u4e0a\u5f88\u591a\u7684\u4f1a\u5c06admin\u4e5f\u5199\u8fdb\u53bb\u5bfc\u5165\uff0c\u53cd\u800c\u62a5\u9519\uff0c\u540e\u6765\u6211\u4fee\u6539\u4e86\u4e0b\u3002<\/code> <\/p>\n

[root@localhost ldap]# cat test.ldif<\/p>\n

dn:dc=test,dc=com
objectclass:dcObject
objectclass:organization
o:Example, Inc.<\/p>\n

\u7136\u540e\u5bfc\u5165\u65e2\u53ef\u4f7f\u7528<\/p>\n

ldapadd -x -D “cn=admin,dc=test,dc=com” -W -f test.ldif<\/p>\n

\u8fd9\u91cc\u63a8\u83502\u4e2a\u5ba2\u6237\u7aef<\/p>\n

1\uff1aphpldapadmin<\/p>\n

\u5b89\u88c5\u76f4\u63a5yum\u5373\u53ef\uff0c\u914d\u7f6e\u7684\u65f6\u5019\u6ce8\u610f\u4e0bconfig<\/p>\n

$servers->newServer(‘ldap_pla’);
$servers->setValue(‘server’,’name’,’LDAP Server’);
$servers->setValue(‘server’,’host’,’127.0.0.1′);
$servers->setValue(‘server’,’port’,389);
$servers->setValue(‘server’,’base’,array(‘dc=test,dc=com’));
$servers->setValue(‘login’,’auth_type’,’cookie’);
$servers->setValue(‘login’,’bind_id’,’cn=admin,dc=test,dc=com’);
$servers->setValue(‘login’,’bind_pass’,’test’);
$servers->setValue(‘server’,’tls’,false);<\/p>\n

\u6ce8\u610f\u5c06\u6ce8\u91ca\u7b26\u53f7\u53bb\u6389\u3002<\/p>\n

\"image\"<\/a><\/p>\n

2\uff1aSofterra LDAP Administrator<\/a><\/p>\n

\u53bbhttp:\/\/www.ldapbrowser.com\/<\/a>\u4e0b\u8f7d\u5373\u53ef\uff0cwindows\u4e0b\u5f88\u597d\u4f7f\u7528\uff0c\u914d\u7f6e\u4e5f\u7b80\u5355\uff0c\u53ef\u4ee5\u81ea\u5df1\u5c1d\u8bd5\u4e0b\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c2\u8003url\uff1ahttp:\/\/my.oschina.net\/aiguozhe\/blog\/151554<\/a><\/p>\n

\u7f51\u4e0a\u53d1\u73b0\u5f88\u591a\u5b89\u88c5\u7684\u6587\u6863\uff0c\u5f88\u591a\u90fd\u662f\u4e0d\u53ef\u4ee5\u7528\u7684\uff0c\u6240\u4ee5\u81ea\u5df1\u6574\u7406\u4e86\u4e0b\u3002\u6bd4\u8f83\u9760\u8c31\u7684\u5c31\u662f\u8fd9\u4e2a\u53c2\u8003url\u7684\u8bf4\u6cd5\u3002<\/p>\n

centos \u4e3b\u8981\u7684\u5c31\u662fopenldap\uff0c\u8fd9\u4e2a\u5b89\u88c5\u7528yum\u7684\u8bdd\u5f88\u7b80\u5355\u3002<\/p>\n

yum install openldap openldap-servers openldap-clients -y<\/p>\n

\u914d\u7f6e<\/p>\n

cp<\/code> \/usr\/share\/openldap-servers\/slapd<\/code>.conf.obsolete <\/code>\/etc\/openldap\/slapd<\/code>.conf<\/code> <\/p>\n

cp<\/code> \/usr\/share\/openldap-servers\/DB_CONFIG<\/code>.example <\/code>\/var\/lib\/ldap\/DB_CONFIG<\/code> <\/p>\n

mv<\/code> \/etc\/openldap\/slapd<\/code>.d{,.bak}<\/code> <\/p>\n

\u4e5f\u8bb8\u4f60\u5df2\u7ecf\u731c\u5230\uff0cslapd.conf\u662fOpenLDAP\u7684\u914d\u7f6e\u6587\u4ef6\u3002\u4e0b\u9762\u5bf9slapd.conf\u7684\u4e00\u4e9b\u914d\u7f6e\u9879\u505a\u4e9b\u8bf4\u660e\uff1a <\/p>\n

cat \/etc\/openldap\/slapd.conf | grep -v “#” <\/p>\n

############# <\/p>\n

include         \/etc\/openldap\/schema\/corba.schema
include         \/etc\/openldap\/schema\/core.schema
include         \/etc\/openldap\/schema\/cosine.schema
include         \/etc\/openldap\/schema\/duaconf.schema
include         \/etc\/openldap\/schema\/dyngroup.schema
include         \/etc\/openldap\/schema\/inetorgperson.schema
include         \/etc\/openldap\/schema\/java.schema
include         \/etc\/openldap\/schema\/misc.schema
include         \/etc\/openldap\/schema\/nis.schema
include         \/etc\/openldap\/schema\/openldap.schema
include         \/etc\/openldap\/schema\/ppolicy.schema
include         \/etc\/openldap\/schema\/collective.schema<\/p>\n

allow bind_v2<\/p>\n

pidfile         \/var\/run\/openldap\/slapd.pid
argsfile        \/var\/run\/openldap\/slapd.args<\/p>\n

 <\/p>\n

TLSCACertificatePath \/etc\/openldap\/certs
TLSCertificateFile “\\”OpenLDAP Server\\””
TLSCertificateKeyFile \/etc\/openldap\/certs\/password<\/p>\n

 <\/p>\n

database config
access to *
        by dn.exact=”gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth” manage
        by * none<\/p>\n

database monitor
access to *
        by dn.exact=”gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth” read
        by dn.exact=”cn=admin,dc=my-domain,dc=com” read
        by * none<\/p>\n

database        bdb
suffix          “dc=test,dc=com”            #\u81ea\u5df1\u5b9a\u4e49\u7684dc
checkpoint      1024 15
rootdn          “cn=admin,dc=test,dc=com” #\u81ea\u5df1\u5b9a\u4e49\u7ba1\u7406\u5458
rootpw  {SSHA}KFAXZdD60RR0I4YmajnX4nQh263Wozh8  #\u81ea\u5df1\u5b9a\u4e49\u5bc6\u7801  \u53ef\u4ee5\u660e\u6587\u6216\u8005\u7528slappasswd\u52a0\u5bc6<\/p>\n

directory       \/var\/lib\/ldap<\/p>\n

index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub<\/p>\n

\u7136\u540e\u542f\u52a8ldap\uff0c\/etc\/init.d\/slapd start<\/code> <\/p>\n

\u7136\u540e\u9700\u8981\u5bfc\u5165\u4e00\u4e2aldif\uff0c\u5426\u5219\u65e0\u6cd5\u4f7f\u7528\uff0c\u6211\u5728\u770b\u7f51\u4e0a\u5f88\u591a\u7684\u4f1a\u5c06admin\u4e5f\u5199\u8fdb\u53bb\u5bfc\u5165\uff0c\u53cd\u800c\u62a5\u9519\uff0c\u540e\u6765\u6211\u4fee\u6539\u4e86\u4e0b\u3002<\/code> <\/p>\n

[root@localhost ldap]# cat test.ldif<\/p>\n

dn:dc=test,dc=com
objectclass:dcObject
objectclass:organization
o:Example, Inc.<\/p>\n

\u7136\u540e\u5bfc\u5165\u65e2\u53ef\u4f7f\u7528<\/p>\n

ldapadd -x -D “cn=admin,dc=test,dc=com” -W -f test.ldif<\/p>\n

\u8fd9\u91cc\u63a8\u83502\u4e2a\u5ba2\u6237\u7aef<\/p>\n

1\uff1aphpldapadmin<\/p>\n

\u5b89\u88c5\u76f4\u63a5yum\u5373\u53ef\uff0c\u914d\u7f6e\u7684\u65f6\u5019\u6ce8\u610f\u4e0bconfig<\/p>\n

$servers->newServer(‘ldap_pla’);
$servers->setValue(‘server’,’name’,’LDAP Server’);
$servers->setValue(‘server’,’host’,’127.0.0.1′);
$servers->setValue(‘server’,’port’,389);
$servers->setValue(‘server’,’base’,array(‘dc=test,dc=com’));
$servers->setValue(‘login’,’auth_type’,’cookie’);
$servers->setValue(‘login’,’bind_id’,’cn=admin,dc=test,dc=com’);
$servers->setValue(‘login’,’bind_pass’,’test’);
$servers->setValue(‘server’,’tls’,false);<\/p>\n

\u6ce8\u610f\u5c06\u6ce8\u91ca\u7b26\u53f7\u53bb\u6389\u3002<\/p>\n

\"image\"<\/a><\/p>\n

2\uff1aSofterra LDAP Administrator<\/a><\/p>\n

\u53bbhttp:\/\/www.ldapbrowser.com\/<\/a>\u4e0b\u8f7d\u5373\u53ef\uff0cwindows\u4e0b\u5f88\u597d\u4f7f\u7528\uff0c\u914d\u7f6e\u4e5f\u7b80\u5355\uff0c\u53ef\u4ee5\u81ea\u5df1\u5c1d\u8bd5\u4e0b\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[55],"class_list":["post-4190","post","type-post","status-publish","format-standard","hentry","category-5","tag-ladp","category-5-id","post-seq-1","post-parity-odd","meta-position-corners","fix"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/posts\/4190","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4190"}],"version-history":[{"count":2,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/posts\/4190\/revisions"}],"predecessor-version":[{"id":4197,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=\/wp\/v2\/posts\/4190\/revisions\/4197"}],"wp:attachment":[{"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4190"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4190"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hmouse.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4190"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}