系统架构师从入门到精通1.0 OpenLDAP与Rancher无缝集成，看这一篇就够了

前言

随着项目数量不断增长，每个项目一个rancher管理平台这样的部署架构，在登录认证方面的缺点变得越来越明显，假如使用默认管理员账号再配合不同的密码，那么记录密码和维护平台的时候查阅密码就显得十分繁琐，假如同样使用默认管理员账号同时使用一样的密码，显然安全性又太低，所以老黑希望借助外部登录认证软件系统，来实现账户和密码都是独立创建和管理的这样一套模式，既方便又具备一定的安全性。

一、OpenLDAP是什么

轻量级的目录访问协议的一个软件程序，以目录的结构来管理组织、组、用户等信息。

二、OpenLDAP用在哪里

常见使用场景：

公司里有各种各样的软件平台，使用openldap只要创建一套账户，并且把openldap与各个软件的集成调试好，就能实现一个账号登录多个软件。

全国各地有大大小小几十上百个项目，每个项目一套Rancher管理平台，每套都有管理员账户和密码需要记录和定时更新，那么使用openldap就可以实现一个账号登录所有项目的Rancher管理平台。

三、OpenLDAP如何搭建

#编辑openldap的yaml文件
cat > /root/openldap/docker-compose.yaml << EOF
version: '2'
services:
  ldap-openldap:
    container_name: ldap-openldap
    image: dinkel/openldap
    restart: always
    ports:
      - "389:389"
    environment:
      - SLAPD_PASSWORD=rancher123  # 自定义 admin 的密码
      - SLAPD_DOMAIN=rancher.com   # 自定义 LDAP 的域名，admin 账号cn=admin,dc=rancher,dc=com
    volumes:
      - /mnt/ldap/db:/var/lib/ldap
      - /mnt/ldap/config:/etc/ldap
  ldap-phpldapadmin:
    container_name: ldap-phpldapadmin
    image: dinkel/phpldapadmin
    restart: always
    ports:
      - "8080:80"
    environment:
      - LDAP_SERVER_HOST=ldap-openldap    # 使用 compose 启动容器，可以直接使用服务名
EOF

#启动openldap容器服务
docker-compose up -d

四、OpenLDAP如何与Rancher对接

4.1 OpenLDAP初始设置

创建2个OU，一个名称是groups，一个名称是users

4.2 创建登录rancher的用户

以zhangsan用户举例创建

鼠标点击顺序为："点击ou=users"---->"Create a child entry"---->"Default"---->"ObjectClasses里选inetOrgPerson"---->"Proceed"---->"RDN里选User Name(uid)"---->"cn里输入zhangsan"---->"sn里输入zhangsan"---->"displayName里输入zhangsan"---->"givenName里输入zhangsan"---->"Password里输入rancher123"---->"User Name里输入zhangsan"---->"Create Object"---->"Commit"

4.3 创建rancher专用的管理员

以ceshi用户举例创建

鼠标点击顺序为："Create a child entry"---->"Default"---->"ObjectClasses里选inetOrgPerson"---->"Proceed"---->"RDN里选cn(cn)"---->"cn里输入ceshi"---->"sn里输入ceshi"---->"displayName里输入ceshi"---->"givenName里输入ceshi"---->"Password里输入rancher123"---->"User Name里输入ceshi"---->"Create Object"---->"Commit"

4.4 Rancher集成OpenLDAP的设置

登录Rancher页面

点击安全菜单的认证选项

点击OpenLDAP

在配置OpenLDAP服务器模块中需要设置

主机名或IP地址：192.168.0.100（此处填写实验环境或者正式环境的openldap服务器IP）

服务账户专有名称：cn=rancher,dc=rancher,dc=com

服务账号密码：rancher123

用户搜索起点：ou=users,dc=rancher,dc=com

在测试并启动认证模块中需要设置

用户名：zhangsan

密码：rancher123

点击启用OpenLDAP认证，点击保存

4.5 对OpenLDAP中的用户进行集群权限分配

使用"测试并启动认证"的用户，本案例是zhangsan登录Rancher，选择要分配权限的集群，点编辑，点成员角色，点添加成员，输入openldap中的账户，选择合适的权限，页面最下面点保存即可。

 

4.6 如何使用组来集中分配rancher的管理权限

openldap里面的groups下面创建admins组

添加需要rancher管理员权限的用户到admins组里面

rancher页面添加admins组，同时在全局角色里选择管理员

五、实现自助修改密码

5.1 修改config.inc.php文件
$ldap_url = "ldap://192.168.61.100:389";         #openldap服务器地址
$ldap_binddn = "cn=manager,dc=frognew,dc=com";   #专属连接的账户
$ldap_bindpw = "password of manager";            #专属连接账户的密码
$ldap_base = "dc=frognew,dc=com";                #域名

$hash = "SSHA";
$pwd_min_length = 8;
$pwd_max_length = 12;
$pwd_min_lower = 1;                              #密码最少的小写字符数
$pwd_min_upper = 1;                              #密码最少的大写字符数
$pwd_min_digit = 1;                              #密码最少的数字字符数

$use_questions = false;

$mail_from = "xxx@163.com";                       #163邮箱账户
$notify_on_change = true;                         #打开邮件通知
$mail_smtp_host = 'smtp.163.com';
$mail_smtp_auth = true;                           #开启smtp认证
$mail_smtp_user = 'xxx@163.com';                  #163邮箱账户
$mail_smtp_pass = 'smtppass';     #使用163邮箱时，此处是授权密码
$mail_smtp_port = 25;
$mail_smtp_timeout = 30;

$use_sms = false;

#完整的config.inc.php可以从软件作者的github上面获取，以下给出链接地址
#https://github.com/grams/docker-LTB-self-service-password/blob/master/assets/config.inc.php

5.2 Self-Service-Password软件部署
docker run -d -p 8765:80 --restart=unless-stopped \
-v /root/config.inc.php:/usr/share/self-service-password/conf/config.inc.php \
--name ldap-ssp grams/ltb-self-service-password

5.3 打开浏览器访问http://IP:8765
测试自助密码服务，注意账户是uid的值，无需填写完整的openldap账户
测试Email功能，注意邮箱是在openldap中uid账户配置的邮箱，输入其他邮箱是不可以的

config.inc.php原文件内容
<?php
#==============================================================================
# LTB Self Service Password
#
# Copyright (C) 2009 Clement OUDOT
# Copyright (C) 2009 LTB-project.org
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# GPL License: http://www.gnu.org/licenses/gpl.txt
#
#==============================================================================

#==============================================================================
# Configuration
#==============================================================================
# LDAP
$ldap_url = "ldap://localhost";
$ldap_starttls = false;
$ldap_binddn = "cn=manager,dc=example,dc=com";
$ldap_bindpw = "secret";
$ldap_base = "dc=example,dc=com";
$ldap_login_attribute = "uid";
$ldap_fullname_attribute = "cn";
$ldap_filter = "(&(objectClass=person)($ldap_login_attribute={login}))";

# Active Directory mode
# true: use unicodePwd as password field
# false: LDAPv3 standard behavior
$ad_mode = false;
# Force account unlock when password is changed
$ad_options['force_unlock'] = false;
# Force user change password at next login
$ad_options['force_pwd_change'] = false;
# Allow user with expired password to change password
$ad_options['change_expired_password'] = false;

# Samba mode
# true: update sambaNTpassword and sambaPwdLastSet attributes too
# false: just update the password
$samba_mode = false;
# Set password min/max age in Samba attributes
#$samba_options['min_age'] = 5;
#$samba_options['max_age'] = 45;

# Shadow options - require shadowAccount objectClass
# Update shadowLastChange
$shadow_options['update_shadowLastChange'] = false;

# Hash mechanism for password:
# SSHA
# SHA
# SMD5
# MD5
# CRYPT
# clear (the default)
# auto (will check the hash of current password)
# This option is not used with ad_mode = true
$hash = "clear";

# Prefix to use for salt with CRYPT
$hash_options['crypt_salt_prefix'] = "$6$";

# Local password policy
# This is applied before directory password policy
# Minimal length
$pwd_min_length = 0;
# Maximal length
$pwd_max_length = 0;
# Minimal lower characters
$pwd_min_lower = 0;
# Minimal upper characters
$pwd_min_upper = 0;
# Minimal digit characters
$pwd_min_digit = 0;
# Minimal special characters
$pwd_min_special = 0;
# Definition of special characters
$pwd_special_chars = "^a-zA-Z0-9";
# Forbidden characters
#$pwd_forbidden_chars = "@%";
# Don't reuse the same password as currently
$pwd_no_reuse = true;
# Check that password is different than login
$pwd_diff_login = true;
# Complexity: number of different class of character required
$pwd_complexity = 0;
# Show policy constraints message:
# always
# never
# onerror
$pwd_show_policy = "never";
# Position of password policy constraints message:
# above - the form
# below - the form
$pwd_show_policy_pos = "above";

# Who changes the password?
# Also applicable for question/answer save
# user: the user itself
# manager: the above binddn
$who_change_password = "user";

## Standard change
# Use standard change form?
$use_change = true;

## Questions/answers
# Use questions/answers?
# true (default)
# false
$use_questions = true;

# Answer attribute should be hidden to users!
$answer_objectClass = "extensibleObject";
$answer_attribute = "info";

# Extra questions (built-in questions are in lang/$lang.inc.php)
#$messages['questions']['ice'] = "What is your favorite ice cream flavor?";

## Token
# Use tokens?
# true (default)
# false
$use_tokens = true;
# Crypt tokens?
# true (default)
# false
$crypt_tokens = true;
# Token lifetime in seconds
$token_lifetime = "3600";

## Mail
# LDAP mail attribute
$mail_attribute = "mail";
# Who the email should come from
$mail_from = "admin@example.com";
$mail_from_name = "Self Service Password";
# Notify users anytime their password is changed
$notify_on_change = false;
# PHPMailer configuration (see https://github.com/PHPMailer/PHPMailer)
$mail_sendmailpath = '/usr/sbin/sendmail';
$mail_protocol = 'smtp';
$mail_smtp_debug = 0;
$mail_debug_format = 'html';
$mail_smtp_host = 'localhost';
$mail_smtp_auth = false;
$mail_smtp_user = '';
$mail_smtp_pass = '';
$mail_smtp_port = 25;
$mail_smtp_timeout = 30;
$mail_smtp_keepalive = false;
$mail_smtp_secure = 'tls';
$mail_contenttype = 'text/plain';
$mail_charset = 'utf-8';
$mail_priority = 3;
$mail_newline = PHP_EOL;

## SMS
# Use sms
$use_sms = true;
# GSM number attribute
$sms_attribute = "mobile";
# Partially hide number
$sms_partially_hide_number = true;
# Send SMS mail to address
$smsmailto = "{sms_attribute}@service.provider.com";
# Subject when sending email to SMTP to SMS provider
$smsmail_subject = "Provider code";
# Message
$sms_message = "{smsresetmessage} {smstoken}";

# SMS token length
$sms_token_length = 6;

# Max attempts allowed for SMS token
$max_attempts = 3;

# Reset URL (if behind a reverse proxy)
#$reset_url = $_SERVER['HTTP_X_FORWARDED_PROTO'] . "://" . $_SERVER['HTTP_X_FORWARDED_HOST'] . $_SERVER['SCRIPT_NAME'];

# Display help messages
$show_help = true;

# Language
$lang ="en";

# Display menu on top
$show_menu = true;

# Logo
$logo = "images/ltb-logo.png";

# Background image
$background_image = "images/unsplash-space.jpeg";

# Debug mode
$debug = false;

# Encryption, decryption keyphrase
$keyphrase = "secret";

# Where to log password resets - Make sure apache has write permission
# By default, they are logged in Apache log
#$reset_request_log = "/var/log/self-service-password";

# Invalid characters in login
# Set at least "*()&|" to prevent LDAP injection
# If empty, only alphanumeric characters are accepted
$login_forbidden_chars = "*()&|";

## CAPTCHA
# Use Google reCAPTCHA (http://www.google.com/recaptcha)
$use_recaptcha = false;
# Go on the site to get public and private key
$recaptcha_publickey = "";
$recaptcha_privatekey = "";
# Customization (see https://developers.google.com/recaptcha/docs/display)
$recaptcha_theme = "light";
$recaptcha_type = "image";
$recaptcha_size = "normal";

## Default action
# change
# sendtoken
# sendsms
$default_action = "change";

## Extra messages
# They can also be defined in lang/ files
#$messages['passwordchangedextramessage'] = NULL;
#$messages['changehelpextramessage'] = NULL;

# Launch a posthook script after successful password change
#$posthook = "/usr/share/self-service-password/posthook.sh";

?>

六、163邮箱开启SMTP

6.1 登录163邮箱

6.2 点击设置

6.3 点击POP3/SMTP服务的开启

老黑已经操作，所以显示关闭字样，意思是可以执行关闭操作

6.4 弹出自助手机扫码发送验证的网页

根据提示操作即可

6.5 复制授权密码保存与并写入配置文件使用即可

总结

网络上描述命令行创建组、用户的方法比较多，图形化设置的文章比较少，本文经过多次严格测试，验证可以成功集成。老黑写作的每一个案例，都是能够在实验室还原的。老黑已经把这个集成经验用到生产环境，简化并且提供生产环境账号的统一与安全。