一、搭建openLADP环境
1.下载安装
下载插件地址:
https://pkgs.org/search/?q=ldap
下载以下插件
[root@localhost ~]# ll /var/localrepo/
总用量 4388
-rw-r--r-- 1 root root 359796 11月 10 2021 openldap-2.4.46-18.el8.x86_64.rpm
-rw-r--r-- 1 root root 206276 11月 10 2021 openldap-clients-2.4.46-18.el8.x86_64.rpm
-rw-r--r-- 1 root root 829864 11月 10 2021 openldap-devel-2.4.46-18.el8.x86_64.rpm
-rw-r--r-- 1 root root 2263988 11月 10 2021 openldap-servers-2.4.46-18.el8.x86_64.rpm
-rw-r--r-- 1 root root 822872 5月 14 2023 phpldapadmin-1.2.6.6-1.el8.noarch.rpm
注意openldap几个插件之间的版本要一致
下载安装:
将上述插件都安装: yum -y install xx.rpm
2.配置参数
2-1.生成管理员密码
# 执行如下命令后,生成的是对密码进行加密后的字符串
slappasswd -s 123456
{SSHA}k6jzxUPpA9UN0d2VY5NZhqJPwmrLxfYt
2-2.修改monitor.ldif
vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}monitor.ldif
修改后:
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 b3b6f871
dn: olcDatabase={1}monitor
objectClass: olcDatabaseConfig
olcDatabase: {1}monitor
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
al,cn=auth" read by dn.base="cn=root,dc=xb,dc=hou" read by * none
structuralObjectClass: olcDatabaseConfig
entryUUID: 2011ffa8-fc18-103e-8142-d79dad983498
creatorsName: cn=config
createTimestamp: 20240831190817Z
entryCSN: 20240831190817.852578Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20240831190817Z
将红框中的部分改为你自己的配置
2-3.修改mdb.ldif
vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}mdb.ldif
修改后:
# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 0663050d
dn: olcDatabase={2}mdb
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {2}mdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=xb,dc=hou
olcRootDN: cn=root,dc=xb,dc=hou
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
structuralObjectClass: olcMdbConfig
entryUUID: 20120b06-fc18-103e-8143-d79dad983498
creatorsName: cn=config
createTimestamp: 20240831190817Z
entryCSN: 20240831190817.852859Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20240831190817Z
olcRootPW: {SSHA}k6jzxUPpA9UN0d2VY5NZhqJPwmrLxfYt
2-4.拷贝db文件并修改所属组权限
[root@localhost /]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
# 修改文件权限
[root@localhost /]# chown -R ldap:ldap /var/lib/ldap/
2-5配置ldap.conf
vim /etc/openldap/ldap.conf
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
BASE dc=xb,dc=hou
URI ldap://192.168.137.121 ldap://192.168.137.121:666
#BASE dc=example,dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
# When no CA certificates are specified the Shared System Certificates
# are in use. In order to have these available along with the ones specified
# by TLS_CACERTDIR one has to include them explicitly:
#TLS_CACERT /etc/pki/tls/cert.pem
# System-wide Crypto Policies provide up to date cipher suite which should
# be used unless one needs a finer grinded selection of ciphers. Hence, the
# PROFILE=SYSTEM value represents the default behavior which is in place
# when no explicit setting is used. (see openssl-ciphers(1) for more info)
#TLS_CIPHER_SUITE PROFILE=SYSTEM
# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON on
将BASE, URI改为你的实际配置
2-6.启动服务
# 检查配置文件是否正确
[root@localhost schema]# slaptest -u
...略...
config file testing succeeded # 成功
# 启动服务
[root@localhost schema]# systemctl enable --now slapd.service
# 查看服务状态
[root@localhost schema]# systemctl status slapd.service
注意:
若使用phpldapadmin连接的,登陆之后如果遇到下面的错误:
This base cannot be created with PLA.主要是在base.ldif导入的时候出现问题,最好使用自动生成的base.ldif进行导入,不要手动去创建。
[root@localhost ~]# vim base.ldif
#dn项
dn: dc=xb,dc=hou
#组织名
o: ldap
#对象类别
objectclass: dcObject
##对象类别
objectclass: organization
[root@localhost ~]# ldapadd -f /root/base.ldif -x -D cn=root,dc=xb,dc=hou -W
再重新登录试试
2-7.配置日志
[root@localhost ~]# vim log.ldif
# log.ldif内容:
dn: cn=config
changetype: modify
add: olcLogLevel
olcLogLevel: 32
# 导入文件
[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f log.ldif
[root@localhost ~]# systemctl restart rsyslog
[root@localhost ~]# systemctl restart slapd
# 依次执行
[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/cosine.ldif
[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/nis.ldif
[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/inetorgperson.ldif
[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/core.ldif
# 注意: 第一次添加ldapadd, 后面修改使用ldapmodify
ldapmodify -Y EXTERNAL -H ldapi:/// -f log.ldif
systemctl restart rsyslog
systemctl restart slapd
# 依次执行
ldapmodify -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/cosine.ldif
ldapmodify -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/nis.ldif
ldapmodify -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/inetorgperson.ldif
ldapmodify -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/core.ldif
二、使用LDAP admin软件
下载地址: 官网的没注意看,我找了一个其他的下载渠道
LDAP Admin(LDAP管理工具)官方下载_LDAP Admin(LDAP管理工具)最新版v1.8.3.0免费下载_3DM软件
点击New Connection按钮
按下方示例填写
成功后会出现和Connection name名称一致的服务图标
点开,就会出现如下页面:
上面的org1,group,test,test2是连接成功后后新建的
简单的描述一下新建组织:
新建用户,新建组也直接看对应的英文User,Group去选就行了
test用户配置属性:
对用户添加密码
为了方便就写123456
三、Jenkins配置LDAP
Manage Jenkins -> Security
点击[Test LDAP settings]按钮,输入用户名和密码,点击test按钮,
变绿了就表示成功了
退出登录,使用test用户登录