LDAP轻量目录访问协议
Lightweight Directory Access Protocol 轻量级目录访问协议
Centos7安装与配置LDAP
# 安装OpenLDAP
yum install -y openldap.x86_64 openldap-clients.x86_64 openldap-servers.x86_64 openldap-devel.x86_64 migrationtools.noarch compat-openldap.x86_64
配置LDAP Server
vim /etc/openldap/slapd.d/cn\=config/olcDatabase\={2}hdb.ldif
# 修改第8、9行,添加第10行
# olcSuffix: dc=bloodzer0,dc=com
olcSuffix: dc=my-domain,dc=com
# olcRootDN: cn=Manager,dc=my-domain,dc=com
olcRootDN: cn=Manager,dc=bloodzer0,dc=com
olcRootPW: bloodzer0
配置Monitoring Database
vim /etc/openldap/slapd.d/cn\=config/olcDatabase\={1}monitor.ldif
# 修改第6、7行
# olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
# al,cn=auth" read by dn.base="cn=Manager,dc=my-domain,dc=com" read by * none
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth" read by dn.base="cn=Manager,dc=bloodzer0,dc=com" read by * none
配置LDAP数据库
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -R ldap.ldap /var/lib/ldap/
测试LDAP
slaptest -u
启动服务
systemctl enable slapd.service
systemctl start slapd.service
导入schemas
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/collective.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/corba.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/core.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/duaconf.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/dyngroup.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/inetorgperson.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/java.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/misc.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/openldap.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/pmi.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/ppolicy.ldif
配置basedomain
vim /usr/share/migrationtools/migrate_common.ph
# 修改第71、74、90三行文件
$DEFAULT_MAIL_DOMAIN = "bloodzer0.com";
$DEFAULT_BASE = "dc=bloodzer0,dc=com";
$EXTENDED_SCHEMA = 1;
/usr/share/migrationtools/migrate_base.pl > /etc/openldap/basedomain.ldif
# 导入basedomain文件
ldapadd -x -D cn=Manager,dc=bloodzer0,dc=com -W -f /etc/openldap/basedomain.ldif
# 要求输入olcRootPW的密码
配置phpldapadmin
# 安装phpldapadmin
yum install epel-release -y
yum install phpldapadmin.noarch -y
systemctl enable httpd.service
systemctl start httpd.service
- 修改httpd配置:vim /etc/httpd/conf.d/phpldapadmin.conf
# 添加Require all granted
# 访问http://10.10.10.14/phpldapadmin/cmd.php
- 修改phpldapadmin配置:vim /etc/phpldapadmin/config.php
# 注释398,取消注释397
登录LDAP,账号:cn=Manager,dc=bloodzer0,dc=com 密码:olcRootPW的密码
配置完成。