Skip to content

LDAP轻量目录访问协议

Lightweight Directory Access Protocol 轻量级目录访问协议

Centos7安装与配置LDAP

# 安装OpenLDAP
yum install -y openldap.x86_64 openldap-clients.x86_64 openldap-servers.x86_64 openldap-devel.x86_64 migrationtools.noarch compat-openldap.x86_64

配置LDAP Server

vim /etc/openldap/slapd.d/cn\=config/olcDatabase\={2}hdb.ldif

# 修改第8、9行,添加第10行

# olcSuffix: dc=bloodzer0,dc=com
olcSuffix: dc=my-domain,dc=com
# olcRootDN: cn=Manager,dc=my-domain,dc=com
olcRootDN: cn=Manager,dc=bloodzer0,dc=com
olcRootPW: bloodzer0

ldap_1

配置Monitoring Database

vim /etc/openldap/slapd.d/cn\=config/olcDatabase\={1}monitor.ldif

# 修改第6、7行

# olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
#  al,cn=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none

olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
 al,cn=auth" read by dn.base="cn=Manager,dc=bloodzer0,dc=com" read by * none

ldap_2

配置LDAP数据库

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -R ldap.ldap /var/lib/ldap/

测试LDAP

slaptest -u

ldap_3

启动服务

systemctl enable slapd.service
systemctl start slapd.service

导入schemas

ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/cosine.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/nis.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/collective.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/corba.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/core.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/duaconf.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/dyngroup.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/inetorgperson.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/java.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/misc.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/openldap.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/pmi.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/ppolicy.ldif

配置basedomain

vim /usr/share/migrationtools/migrate_common.ph

# 修改第71、74、90三行文件
$DEFAULT_MAIL_DOMAIN = "bloodzer0.com";
$DEFAULT_BASE = "dc=bloodzer0,dc=com";
$EXTENDED_SCHEMA = 1;

/usr/share/migrationtools/migrate_base.pl > /etc/openldap/basedomain.ldif

# 导入basedomain文件
ldapadd -x -D cn=Manager,dc=bloodzer0,dc=com -W -f /etc/openldap/basedomain.ldif
# 要求输入olcRootPW的密码

ldap_4

ldap_5

配置phpldapadmin

# 安装phpldapadmin
yum install epel-release -y
yum install phpldapadmin.noarch -y
systemctl enable httpd.service
systemctl start httpd.service
  • 修改httpd配置:vim /etc/httpd/conf.d/phpldapadmin.conf
# 添加Require all granted

# 访问http://10.10.10.14/phpldapadmin/cmd.php

ldap_6

  • 修改phpldapadmin配置:vim /etc/phpldapadmin/config.php
# 注释398,取消注释397

ldap_7

登录LDAP,账号:cn=Manager,dc=bloodzer0,dc=com 密码:olcRootPW的密码配置完成。

ldap_8