6、openldap的OLC配置

一、将配置转换成使用olc

1、停止LDAP服务器；

2、编辑slapd.conf

在第一个数据库配置之前加如下的配置项

# before the first database definition
database config
# NOTE: the suffix is hardcoded as cn=config and 
# MUST not have a suffix directive
# normal rules apply - rootdn can be anything you want
# but MUST be under cn=config
rootdn "cn=admin,cn=config"
# use any of the supported password formats e.g. {SSHA} etc
# or plaintext as shown
rootpw config

3、转换静态配置到动态配置

   
   

    
    

     
     [bsd]cd /usr/local/openldap
    
    
    
    

     
     # MUST - create standard default directory
    
    
    
    

     
     mkdir slapd.d
    
    
    
    

     
     # convert slapd.conf 
     
     slaptest在sbin下面
    
    
    
    

     
     slaptest -f slapd.conf -F slapd.d
    
    
    
    

     
      
    
    
    
    

     
     # depending on the logged in user when you ran slaptest
    
    
    
    

     
     # you may need to change ownership of slapd.d and all its files
    
    
    
    

     
     chown -R ldap:ldap slapd.d
    
    
    
    

     
     # permissions interestingly seem to need 
    
    
    
    

     
     # a minimum of 0750
    
    
    
    

     
     chmod -R 0750 slapd.d
    
    
    
    

     
      
    
    
    
    

     
     # rename slapd.conf
    
    
    
    

     
     # this step is not necessary but is a useful
    
    
    
    

     
     # precaution to ensure you access slapd.d
    
    
    
    

     
     mv slapd.conf slapd.conf.bak
    
    
    
    

     
      
    
    
    
    

     
     # 用服务的方式启动
    
    
    
    

     
     [fc]/etc/rc.d/init.d/slapd start
    
    
    
    

     
     # 手工启动ldap服务，u表示启动的用户名，-g表示ldap所在的用户组
    
    
    
    

     
     slapd -u ldap -g ldap
    
    
    
    

     
      
    
    
    
    

     
     # [bsd] users need to add
    
    
    
    

     
     # slapd_cn_config="YES" to /etc/rc.conf
    
    
    
    

     
      
    
    
    
    

     
     # 如果上述的命令执行失败，执行如下的指令
    
    
    
    

     
     slapd -d -1 -u ldap -g ldap
    
    
   
   

6、连接config库

用ldap客户端工具进行连接:

二、使用OLC对LDAP进行动态配置

6.1.1.4 使用cn=config段

6.1.1.4.1 OLC (cn=config) 概述

6.1.1.4.2 在OLC中添加/删除Schemas

手工转换

---

1、准备一个要进行转换的schema描述文件

   
   

    
    

     
     # modified java.schema -- Java Object Schema - used for example purposes only
    
    
    
    

     
     # Copyright Notice
    
    
    
    

     
     # 
    
    
    
    

     
     #    Copyright (C) The Internet Society (1999).  All Rights Reserved.
    
    
    
    

     
     # 
    
    
    
    

     
     # Attribute definition
    
    
    
    

     
     attributetype ( 1.3.6.1.4.1.42.2.27.4.1.6
    
    
    
    

     
     	NAME 'javaClassName'
    
    
    
    

     
     	DESC 'Fully qualified name of distinguished Java class or interface'
    
    
    
    

     
     	EQUALITY caseExactMatch
    
    
    
    

     
     	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
    
    
    
    

     
     	SINGLE-VALUE )
    
    
    
    

     
      
    
    
    
    

     
     # Object Class Definition
    
    
    
    

     
     objectclass ( 1.3.6.1.4.1.42.2.27.4.2.1
    
    
    
    

     
     	NAME 'javaContainer'
    
    
    
    

     
     	DESC 'Container for a Java object'
    
    
    
    

     
     	SUP top
    
    
    
    

     
     	STRUCTURAL
    
    
    
    

     
     	MUST cn )
    
    
   
   

上述内容放到一个LDIF文件中，并且新建一个cn={1}test, cn=schema,cn=config的ObjectClass。这个ObjectClass必须使用olcSchemaConfig作为父ObjectClass，必须使用 oldAttributeTypes (用来替换 attributetype) and olcObjectClasses (用来替换 objectclass)。将上述文件用如下的LDIF文件替换

    
    

     
     

      
      # manually edited file
     
     
     
     

      
      # lines in red were added, lines in green were modified
     
     
     
     

      
      # there must be one space at the beginning and end of each line 
     
     
     
     

      
      # in the olcAttributeTypes and olcObjectClasses definitions
     
     
     
     

      
       
     
     
     
     

      
      dn: cn=test,cn=schema,cn=config
     
     
     
     

      
      objectClass: olcSchemaConfig
     
     
     
     

      
      cn: test
     
     
     
     

      
      olcAttributeTypes: ( 1.3.6.1.4.1.42.2.27.4.1.6 
     
     
     
     

      
       NAME 'javaClassName' 
     
     
     
     

      
       DESC 'Fully qualified name of distinguished Java class or interface'
     
     
     
     

      
       EQUALITY caseExactMatch 
     
     
     
     

      
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
     
     
     
     

      
      olcObjectClasses: ( 1.3.6.1.4.1.42.2.27.4.2.1 
     
     
     
     

      
       NAME 'javaContainer' 
     
     
     
     

      
       DESC 'Container for a Java object' 
     
     
     
     

      
       SUP top 
     
     
     
     

      
       STRUCTURAL 
     
     
     
     

      
       MUST cn )
     
     
     
     


     
     
    
    

       
       

        
        

         
         用ldapadd将新的schema加入config库
        
        
        
        

         
         ../bin/ldapadd -x -D "cn=admin,cn=config"  -f /usr/local/openldap/my-schema/java.ldif -w 123456 
        
        
        
        

         
         

        
        
        
        

         
         adding new entry "cn=java,cn=schema,cn=config"
        
        
       
       

 

使用slaptest进行转换

---

 

6.1.1.4.3 使用OLC配置 ACL/ACPs(cn=config) 

通过编辑olcDataBase={Z}config下的olcAccess属性可以来动态修改ACL属性， olcDataBase={Z}config可以有多少个？

6.1.1.4.4 Add/Delete Modules using OLC (cn=config)

6.1.1.4.5 Add/Delete Databases using OLC (cn=config)

    数据库类型定义必须使用 olcDatabaseConfig这个ObjectClass，并且必须有olcDataBase和olcDbDirectory这两个属性。这类实体的命名方式用 “olcDatabase={Z}{olcDataType},cn=config”。