ldap安装与使用——实战

参考文章

完整版的OpenLDAP搭建全过程
CentOS 6.9下OpenLDAP 的安装与配置
LDAP

环境参数

system: centos8
version: ldap-2.4.46

安装

# yum安装
yum install openldap openldap-clients openldap-servers
# 启动服务
systemctl start slapd

初始化

初始化——配置文件

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -R ldap.ldap /var/lib/ldap

初始化——密码

# 初始化密码  加密后的： {SSHA}E6IFHwzZ9MuPCMjPTXGPOBHaR/tiS1GA
root_password=`slappasswd -s 123456`

cat << EOF | ldapadd -Y EXTERNAL -H ldapi:///
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: $root_password
EOF

初始化——导入schema

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/collective.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/corba.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/duaconf.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/dyngroup.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/java.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/misc.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/openldap.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/pmi.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/ppolicy.ldif

初始化——添加memberof支持

cat <<EOF |ldapadd -Q -Y EXTERNAL -H ldapi:///
# 启用memberof
dn: cn=module{0},cn=config
cn: module{0}
objectClass: olcModuleList
objectClass: top
olcModuleLoad: memberof
olcModulePath:/usr/lib64/openldap

# 新增用户支持memberof
dn: olcOverlay={0}memberof,olcDatabase={2}mdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: {0}memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf
EOF

cat <<EOF |ldapmodify -Q -Y EXTERNAL -H ldapi:///
dn: cn=module{0},cn=config
add: olcmoduleload
olcmoduleload: refint
EOF

cat <<EOF |ldapadd -Q -Y EXTERNAL -H ldapi:///
dn: olcOverlay={1}refint,olcDatabase={2}mdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
ebjectClass: top
olcOverlay: {1}refint
olcRefintAttribute: memberof member owner
EOF

初始化——添加日志支持

查看日志支持

cat /etc/openldap/slapd.d/cn\=config.ldif | grep -i log

若没有，则添加日志支持

cat <<EOF |ldapmodify -Y EXTERNAL -H ldapi:///
dn: cn=config
changetype: modify
add: olcLogLevel
olcLogLevel: 32
EOF

日志添加rsyslog支持

echo "local4.*    /var/log/slapd/slapd.log" >> /etc/rsyslog.conf
systemctl restart rsyslog

初始化——防火墙

firewall-cmd --add-service={ldap,ldaps} --permanent
firewall-cmd --reload

使用

创建域

创建dn域：cn=admin,dc=example,dc=com 组成如下：
域名：example.com （注：与DNS相似，并非同一个东西）
管理员账号：admin
管理员密码：123456

# 创建admin密码
admin_password=`slappasswd -s 123456`
# 添加admin账号
cat <<EOF| ldapmodify -Y EXTERNAL -H ldapi:///
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=admin,dc=example,dc=com" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=example,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=example,dc=com

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: $admin_password    # 注意密码

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=admin,dc=example,dc=com" write by * read
EOF

创建组织

在dn域下，创建组织：
公司名：example
组织角色：admin
组织单元：People,Group

cat <<EOF | ldapadd -x -D cn=admin,dc=example,dc=com -w 123456
dn: dc=example,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
o: example Company
dc: example

dn: cn=admin,dc=example,dc=com
objectClass: organizationalRole
cn: admin

dn: ou=People,dc=example,dc=com
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=example,dc=com
objectClass: organizationalUnit
ou: Group
EOF

创建组

组名：team

cat <<EOF|ldapadd -x -D cn=admin,dc=example,dc=com -w 123456
dn: cn=team,ou=Group,dc=ldap01,dc=hg,dc=com
objectClass: posixGroup
cn: Team
gidNumber: 1000
EOF

创建用户

用户名：shaw
密码：123456

# 创建前的配置
mkdir /root/ldap_user
chmod 755 /root/ldap_user
# 创建用户密码
user_password=`slappasswd -s 111111`
# 添加用户账号
cat <<EOF|ldapadd -x -D cn=admin,dc=example,dc=com -w 123456
dn: uid=shaw,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: shaw
cn: Shaw
sn: Catherine
userPassword: $user_password
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /root/ldap_user/shaw
EOF

验证

python客户端

# 安装ldap3
pip install ldap3
# 编辑验证脚本
vim client.py

#!/usr/bin/env python3
from ldap3 import Server, Connection

def check_auth(user,passwd):
	server=Server(host="127.0.0.1",port=389)
	conn=Connection(server, user=user, password=passwd,check_names=True, lazy=False, raise_exceptions=False)
	try:
		return conn.result["description"] == "success" if conn.bind() else False
	except Exception as e:
		return False

def test_check_auth()
	assert check_auth("uid=shaw,ou=People,dc=example,dc=com","111111")

test_check_auth()

# 运行验证脚本
python3 client.py