Win ldap php 改密码,搭建ldap自助修改密码系统--Self Service Password

搭建ldap自助修改密码系统--Self Service Password

choulanlan

关注

0人评论

2382人阅读

2019-08-15 20:52:31

服务安装：

安装依赖：yum install php70-ldap.x86_64 -y (版本尽量大于5.3，否则会提示更新php程序)

yum install httpd -y

安装Self Service Password：yum install https://ltb-project.org/rpm/6Server/noarch/self-service-password-1.1-1.el6.noarch.rpm

配置apache: /etc/httpd/conf.d/self-service-password.conf

NameVirtualHost *:80

ServerName ssp.xinniu.com

DocumentRoot /usr/share/self-service-password

DirectoryIndex index.php

AddDefaultCharset UTF-8

AllowOverride None

Allow from all

LogLevel warn

ErrorLog /var/log/httpd/ssp_error_log

CustomLog /var/log/httpd/ssp_access_log combined

配置Self Service Password,支持密码修改和邮件重置： vim /usr/share/self-service-password/conf/config.inc.php

这个文件配置项太多了，只写一下改动的

$ldap_url = "ldap://172.xx.xx.xx:389";

$ldap_starttls = false;

$ldap_binddn = "cn=admin,dc=xxxx,dc=com";

$ldap_bindpw = "****";

$ldap_base = "dc=xxxx,dc=com";

$ldap_login_attribute = "uid";

$ldap_fullname_attribute = "cn";

$ldap_filter = "(&(objectClass=person)($ldap_login_attribute={login}))";

$mail_from = "msg_data@xxxx.com";

$mail_from_name = "Self Service Password";

$mail_signature = "";

$notify_on_change = true;

https://github.com/PHPMailer/PHPMailer)

$mail_sendmailpath = '/usr/sbin/sendmail';

$mail_protocol = 'smtp';

$mail_smtp_debug = 0;

$mail_debug_format = 'html';

$mail_smtp_host = 'localhost';

$mail_smtp_auth = true;

$mail_smtp_user = 'msg_data@xxxxx.com';

$mail_smtp_pass = 'xxxxx;

$mail_smtp_port = 25;

keyphrase = "secret";

配完后

systemctl restart httpd

完成之后，测试系统是否可以使用

打开页面

搭建ldap自助修改密码系统--Self Service Password

d搭建ldap自助修改密码系统--Self Service Password

修改密码时不用输入整个dn，直接输入前缀就可以了

测试修改密码时，报错，ldap服务器拒绝我们修改的密码，经过查看日志加上自己手动验证，发现普通用户没有修改密码的权限。

然后查看ldap官方的手册：http://www.openldap.org/doc/admin24/access-control.html

研究后发现需要修改ldap的条目

文件添加ACL 信息，问题解决，添加命令如下：

ldapmodify -Y EXTERNAL -H ldapi:/// -f updatepass.ldif

updatepass.ldif 文件内容如下：

dn: olcDatabase={2}hdb,cn=config

changetype: modify

add: olcAccess

olcAccess: to attrs=userPassword

by self =xw

by anonymous auth

by * none

olcAccess: to by self write

by users read

by none

然后试下真的可以修改密码了