centos7安装ldap

yum安装

第一步，安装依赖和软件

yum install -y openldap-servers openldap-clients
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown ldap. /var/lib/ldap/DB_CONFIG
systemctl enable slapd
systemctl start slapd

第二步，使用 slappasswd 命令来生成一个密码，并使用 LDIF（LDAP 数据交换格式）文件将其导入到 LDAP 中来配置管理员密码：

[root@localhost ~]# slappasswd
New password: 
Re-enter new password: 
{SSHA}KS/bFZ8KTmO56khHjJvM97l7zivH1MwG

[root@localhost ~]# vim chrootpw.ldif
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}KS/bFZ8KTmO56khHjJvM97l7zivH1MwG

[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"

第三步，向 LDAP 中导入一些基本的 Schema。这些 Schema 文件位于 /etc/openldap/schema/ 目录中，定义了我们以后创建的条目可以使用哪些属性：

[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"

[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"

[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"

第四步，我们需要配置 LDAP 的顶级域（以 dc=xinhua,dc=org 为例）及其管理域：

[root@localhost ~]# slappasswd
New password: 
Re-enter new password: 
{SSHA}z/rsbmAjVtLlWeUB0xS5itLPI0VA1akD

[root@localhost ~]# vim chdomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
  read by dn.base="cn=Manager,dc=xinhua,dc=org" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=xinhua,dc=org

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=xinhua,dc=org

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}z/rsbmAjVtLlWeUB0xS5itLPI0VA1akD

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
  dn="cn=Manager,dc=xinhua,dc=org" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=xinhua,dc=org" write by * read

[root@localhost ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}monitor,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"

第五步，在上述基础上，我们来创建一个叫做 Xinhua News Agency 的组织，并在其下创建一个 Manager 的组织角色（该角色内的用户具有管理整个 LDAP 的权限）和 People 和 Group 两个组织单元：

[root@localhost ~]# vim basedomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
dn: dc=xinhua,dc=org
objectClass: top
objectClass: dcObject
objectclass: organization
o: Xinhua News Agency
dc: xinhua

dn: cn=Manager,dc=xinhua,dc=org
objectClass: organizationalRole
cn: Manager

dn: ou=People,dc=xinhua,dc=org
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=xinhua,dc=org
objectClass: organizationalUnit
ou: Group

[root@localhost ~]# ldapadd -x -D cn=Manager,dc=xinhua,dc=org -W -f basedomain.ldif 
Enter LDAP Password: # directory manager's password
adding new entry "dc=xinhua,dc=org"
adding new entry "cn=Manager,dc=xinhua,dc=org"
adding new entry "ou=People,dc=xinhua,dc=org"
adding new entry "ou=Group,dc=xinhua,dc=org"

通过以上的所有步骤，我们就设置好了一个 LDAP 目录树：其中基准 dn dc=xinhua,dc=org 是该树的根节点，其下有一个管理域 cn=Manager,dc=xinhua,dc=org 和两个组织单元 ou=People,dc=xinhua,dc=org 及 ou=Group,dc=xinhua,dc=org。

接下来，我们来创建一个叫作 Ada Catherine 的员工并将其分配到 Secretary 组来验证上述配置是否生效。

[root@localhost ~]# slappasswd
New password: 
Re-enter new password: 
{SSHA}HTGqAd4p6fOOIVHm7VZYUSorWGfnrqAA

[root@localhost ~]# vim ldapuser.ldif
# create new
# replace to your own domain name for "dc=***,dc=***" section
dn: uid=ada,ou=People,dc=xinhua,dc=org
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: ada
cn: Ada Catherine
sn: Catherine
userPassword: {SSHA}HTGqAd4p6fOOIVHm7VZYUSorWGfnrqAA
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/users/ada

dn: cn=Secretary,ou=Group,dc=xinhua,dc=org
objectClass: posixGroup
cn: Secretary
gidNumber: 1000
memberUid: ada

[root@localhost ~]# ldapadd -x -D cn=Manager,dc=xinhua,dc=org -W -f ldapuser.ldif
Enter LDAP Password:
adding new entry "uid=ada,ou=People,dc=xinhua,dc=org"
adding new entry "cn=Secretary,ou=Group,dc=xinhua,dc=org"

我们也可以使用 ldapsearch 命令来查看 LDAP 目录服务中的所有条目信息：

[root@localhost ~]# ldapsearch -x -b "dc=xinhua,dc=org" -H ldap://127.0.0.1
# extended LDIF
#
# LDAPv3
# base <dc=xinhua,dc=org> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# xinhua.org
dn: dc=xinhua,dc=org
objectClass: top
objectClass: dcObject
objectClass: organization
o: Xinhua News Agency
dc: xinhua
...

如果要删除一个条目，可以按下面的命令操作：

[root@localhost ~]# ldapdelete -x -W -D 'cn=Manager,dc=xinhua,dc=org' "uid=ada,ou=People,dc=xinhua,dc=org"

参考资料：
https://myanbin.github.io/post/openldap-in-centos-7.html