LDAP安装

一、安装OpenLDAP

1、用root账号yum安装OpenLDAP所需的程序包

yum install -y openldap-servers openldap-clients httpd

2、拷贝配置文件

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

3、修改配置文件属主，并启动服务

chown ldap. /var/lib/ldap/DB_CONFIG
systemctl enable slapd
systemctl start slapd

4、使用 slappasswd 命令来生成一个密码，并使用 LDIF（LDAP 数据交换格式）文件将其导入到 LDAP 中来配置管理员密码

[root@openldap ~]# slappasswd
New password: 
Re-enter new password: 
{SSHA}csXPnXWscdV8rxsDTj/LhlEz8bGAyeQC


[root@openldap ~]# cat chrootpw.ldif
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}csXPnXWscdV8rxsDTj/LhlEz8bGAyeQC


[root@openldap ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"

5、LDAP 中导入一些基本的 Schema。这些 Schema 文件位于 /etc/openldap/schema/ 目录中，定义了我们以后创建的条目可以使用哪些属性：

[root@openldap ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"

[root@openldap ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"

[root@openldap ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"

6、配置 LDAP 的顶级域（以 dc=anchnet,dc=com 为例）及其管理域

[root@openldap ~]# slappasswd
New password: 
Re-enter new password: 
{SSHA}csXPnXWscdV8rxsDTj/LhlEz8bGAyeQC

#修改DC=anchnet，dc=com olcRootPW: 为上面生成的密码字符串
[root@openldap ~]# cat chdomain.ldif
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
  read by dn.base="cn=Manager,dc=anchnet,dc=com" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=anchnet,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=anchnet,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}csXPnXWscdV8rxsDTj/LhlEz8bGAyeQC

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
  dn="cn=Manager,dc=anchnet,dc=com" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=anchnet,dc=com" write by * read


[root@openldap ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}monitor,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"

7、在上述基础上，我们来创建一个叫做 anchnet News Agency 的组织，并在其下创建一个 Manager 的组织角色（该角色内的用户具有管理整个 LDAP 的权限）和 People 和 Group 两个组织单元

[root@openldap ~]# cat basedomain.ldif
dn: dc=anchnet,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: Anchnet News Agency
dc: anchnet

dn: cn=Manager,dc=anchnet,dc=com
objectClass: organizationalRole
cn: Manager

dn: ou=People,dc=anchnet,dc=com
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=anchnet,dc=com
objectClass: organizationalUnit
ou: Group



[root@openldap ~]# ldapadd -x -D cn=Manager,dc=anchnet,dc=com -W -f basedomain.ldif

8、使用 ldapsearch 命令来查看 LDAP 目录服务中的所有条目信息

[root@openldap ~]# ldapsearch -x -b "dc=anchnet,dc=com" -H ldap://127.0.0.1
# extended LDIF
#
# LDAPv3
# base <dc=anchnet,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# anchnet.com
dn: dc=anchnet,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: Anchnet News Agency
dc: anchnet

# Manager, anchnet.com
dn: cn=Manager,dc=anchnet,dc=com
objectClass: organizationalRole
cn: Manager

# People, anchnet.com
dn: ou=People,dc=anchnet,dc=com
objectClass: organizationalUnit
ou: People

# Group, anchnet.com
dn: ou=Group,dc=anchnet,dc=com
objectClass: organizationalUnit
ou: Group

# h036, People, anchnet.com
dn: cn=h036,ou=People,dc=anchnet,dc=com
cn: h036
gidNumber: 500
objectClass: posixGroup
objectClass: top

# testuser, h036, People, anchnet.com
dn: cn=testuser,cn=h036,ou=People,dc=anchnet,dc=com
sn: testuser
cn:: IHRlc3R1c2Vy
uid: testuser
uidNumber: 1000
gidNumber: 500
homeDirectory: /home/users/testuser
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top

# admin, h036, People, anchnet.com
dn: cn=admin,cn=h036,ou=People,dc=anchnet,dc=com
sn: admin
cn:: IGFkbWlu
uid: admin
uidNumber: 1001
gidNumber: 500
homeDirectory: /home/users/admin
loginShell: /bin/sh
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top

# search result
search: 2
result: 0 Success

# numResponses: 8
# numEntries: 7

二、使用 phpLDAPadmin 来管理 LDAP 服务

1、下载phpLDAPadmin

wget https://nchc.dl.sourceforge.net/project/phpldapadmin/phpldapadmin-php5/1.2.3/phpldapadmin-1.2.3.tgz

2、解压phpldapadmin-1.2.3.tgz，并更改名称。

[root@openldap ~] tar zxvf phpldapadmin-1.2.3.tgz 
[root@openldap ~] mv phpldapadmin-1.2.3  phpldapadmin

3、移动phpldapadmin目录到httpd默认目录

[root@openldap ~] mv phpldapadmin /var/www/html/

4、修改配置文件

[root@openldap ~]  cd /var/www/html/phpldapadmin/config
[root@openldap ~]  mv config.php.example config.php
[root@openldap ~]  vim config.php

#修改如下选项
$servers->newServer('ldap_pla');
$servers->setValue('server','host','127.0.0.1');
$servers->setValue('server','port',389);
$servers->setValue('server','base',array('dc=anchnet,dc=com'));
$servers->setValue('login','auth_type','session');
$servers->setValue('login','bind_id','cn=Manager,dc=anchnet,dc=com');
#下面选项中“slap.com”为密码。请根据实际情况填写
$servers->setValue('login','bind_pass','slap.com');
$servers->setValue('server','tls',false);

5、安装php依赖

yum install php-ldap -y

6、然后就可以访问http://ip/phpldapadmin管理LDAP。