openldap-2.4.44 安装

一、安装base-repo

## 根据自己的OS版本安装对应的base repo

rpm -Uvh http://mirror.centos.org/centos/7/os/x86_64/Packages/centos-release-7-6.1810.2.el7.centos.x86_64.rpm


ls -l /etc/yum.repo/
total 44
-rw-r--r--. 1 root root 1664 Nov 23  2018 CentOS-Base.repo
-rw-r--r--. 1 root root 1309 Nov 23  2018 CentOS-CR.repo
-rw-r--r--. 1 root root  649 Nov 23  2018 CentOS-Debuginfo.repo
-rw-r--r--. 1 root root  314 Nov 23  2018 CentOS-fasttrack.repo
-rw-r--r--. 1 root root  630 Nov 23  2018 CentOS-Media.repo
-rw-r--r--. 1 root root 1331 Nov 23  2018 CentOS-Sources.repo
-rw-r--r--. 1 root root 5701 Nov 23  2018 CentOS-Vault.repo
-rw-r--r--. 1 root root  951 Oct  2  2017 epel.repo
-rw-r--r--. 1 root root 1050 Oct  2  2017 epel-testing.repo
-rw-r--r--. 1 root root 2003 Jul  8 07:44 README


yum install epel-release*

二、安装openldap-server/devel/clients

yum install -y openldap-servers openldap-clients openldap-devel


rpm -qa|grep openldap*
openldap-servers-sql-2.4.44-21.el7_6.x86_64
openldap-2.4.44-21.el7_6.x86_64
openldap-clients-2.4.44-21.el7_6.x86_64
openldap-devel-2.4.44-21.el7_6.x86_64
openldap-servers-2.4.44-21.el7_6.x86_64

三、配置openldap-server

配置slappasswd

slappasswd -s 123456
{SSHA}NRWg5Ig47XVGHZq0eX/ayx8NSCSbiIw8

修改basedn

vi /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}hdb.ldif
...

olcSuffix: dc=harry,dc=com
olcRootDN: cn=Manager,dc=harry,dc=com
olcRootPW: {SSHA}NRWg5Ig47XVGHZq0eX/ayx8NSCSbiIw8
...


vi /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}monitor.ldif
...
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
 al,cn=auth" read by dn.base="cn=Manager,dc=harry,dc=com" read by * none
...

配置SSL

cd /etc/openldap/certs/
rm -rf /etc/openldap/certs/*



openssl genrsa -out cert.key 1024
openssl req -new -key cert.key -out cert.csr
openssl x509 -req -days 3650 -in cert.csr -signkey cert.key -out cert.crt



vi SLAPD_URLS="ldapi:/// ldap:///"
...
olcTLSCACertificatePath: /etc/openldap/certs
olcTLSCertificateFile: /etc/openldap/certs/cert.crt
olcTLSCertificateKeyFile: /etc/openldap/certs/cert.key
...

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

chown ldap:ldap -R /etc/openldap



### 

vi /etc/sysconfig/slapd

...
SLAPD_URLS="ldapi:/// ldap:/// ldaps:///"
...

启用memberof

vi add_module_group.ldif
...
dn: cn=module{0},cn=config
cn: module{0}
objectClass: olcModuleList
objectClass: top
olcModuleLoad: memberof.la
olcModulePath: /usr/lib64/openldap
...



vi add_module_group-2.ldif
...
dn: olcOverlay={0}memberof,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfUniqueNames
olcMemberOfMemberAD: uniqueMember
olcMemberOfMemberOfAD: memberOf
...



vi add-refin1.ldif
...
dn: cn=module{0},cn=config
add: olcmoduleload
olcmoduleload: refint
...


vi add-refin2.ldif
...
dn: olcOverlay=refint,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: refint
olcRefintAttribute: memberof uniqueMember  manager owner
...

检测配置并启动

slaptest -u

service slapd restart

netstat -tunpl | grep 389
netstat -tunpl | grep 636

四、安装phpldapadmin

yum install phpldapadmin*

配置phpldapadmin

vi /etc/httpd/conf.d/phpldapadmin.conf
...

	<IfModule mod_authz_core.c>
    # Apache 2.4
    # Require local
    Require all granted
  </IfModule>

...

vi /etc/phpldapadmin/config.php
...
#$servers->setValue('login','attr','uid');

$servers->setValue('server','host','127.0.0.1');
$servers->setValue('server','port',389);
$servers->setValue('server','base',array('dc=harry,dc=com'));
$servers->setValue('login','auth_type','session');
$servers->setValue('login','bind_id','cn=Manager,dc=harry,dc=com');
$servers->setValue('login','bind_pass','123456');
...

添加base.ldif

###This base cannot be created with PLA.

vi base.ldif
dn: dc=harry,dc=com
o: ldap
objectclass: dcObject
objectclass: organization

ldapadd -f base.ldif -x -D 'cn=Manager,dc=harry,dc=com' -W 

添加memberof

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE template SYSTEM "template.dtd">

<template>
<askcontainer>1</askcontainer>
<description>New Group of UniqueNames</description>
<icon>ldap-ou.png</icon>
<invalid>0</invalid>
<rdn>cn</rdn>
<title>Generic: Group of UniqueNames</title>
<visible>1</visible>

<objectClasses>
<objectClass id="groupOfUniqueNames"></objectClass>
</objectClasses>

<attributes>
<attribute id="cn">
	<display>GroupOf UniqueNames</display>
	<order>1</order>
	<page>1</page>
</attribute>
</attributes>

</template>

五、

转载于:https://my.oschina.net/u/204498/blog/3089539