Apache使用LDAP认证



 Apache使用LDAP认证

client(firefox,curl) -----(http|https)--→ http server auth_basic_module (ldap client) -----(ldap | ldaps)---→ ldap server

基于用户的身份认证
[root@uplook ~]# mkdir /var/www/html/download
[root@uplook ~]# echo "ldap test" > /var/www/html/download/index.html

方法一：使用传统的无格式文本文件认证
[root@uplook ~]# htpasswd -cm /etc/httpd/htpasswd user1  ［本地］
[root@uplook ~]# vim /etc/httpd/conf/httpd.conf
<Directory "/var/www/html/download"> 
   AuthType basic
   AuthName "local passwd auth test"
   AuthUserFile /etc/httpd/htpasswd
   Require valid-user
</Directory>

方法二：使用LDAP实现身份认证
<Directory "/var/www/html/download">
   AuthName "ldap auth test"
   AuthType basic
   AuthBasicProvider ldap
   AuthLDAPUrl "ldap://192.168.0.2/dc=uplook,dc=com"
   Require valid-user
</Directory>

方法三：使用LDAP实现身份认
[root@uplook ~]# wget http://ldap.uplook.com/ca.crt -P /etc/httpd

LDAPTrustedGlobalCert CA_BASE64 /etc/httpd/ca.crt

<Directory "/var/www/html/download">
    AuthName "welcome..."
    AuthType Basic
    AuthBasicProvider ldap
    AuthLDAPUrl "ldap://ldap.uplook.com/dc=uplook,dc=com" TLS
    #AuthLDAPUrl "ldap://ldap.uplook.com/ou=sichuan,dc=uplook,dc=com" TLS
    Require valid-user
</Directory>

LDAP 客户：

浏览器认证提示输入ldapuser1 --->123

PAM, Apache, Nginx ......

Server:     ldap.uplook.com
DN:         dc=uplook,dc=com
CACERT:   ftp://ldap.uplook.com/ca.crt