OpenLDAP和Kerberos的集成

参考链接：
https://blog.51cto.com/10788142/2167923#h26

LDAP 和Kerberos假设已经安装完成，可以看我前面的博客
LDAP:host1
Kerberos:host2

一、LDAP服务端

1.yum安装krb5-server-ldap

yum install krb5-server-ldap -y

2.配置kerberos的schema

cp /usr/share/doc/krb5-server-ldap-1.15.1/kerberos.schema /etc/openldap/schema/

cd /opt

touch schema_convert.conf

vim schema_convert.conf
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/collective.schema
include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/duaconf.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/java.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/pmi.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/kerberos.schema

注意：上面schema中的顺序要和/etc/openldap/slapd.d/cn=config/cn=schema中ldif文件一致，不然kerberos schema会报错
3.生成kerberos schema，下面命令中的13是上面schema中的索引位置，根据情况而定

slapcat -f schema_convert.conf -F /tmp/ -n 0 -s "cn={13}kerberos,cn=schema,cn=config" > /tmp/cn=kerberos.ldif

4.修改tmp下的kerberos.ldif

vim /tmp/cn\=kerberos.ldif 
并注释掉如下属性
#structuralObjectClass: olcSchemaConfig
#entryUUID: 02b11972-d310-1037-80c6-774a6a5fe133
#creatorsName: cn=config
#createTimestamp: 20180413024211Z
#entryCSN: 20180413024211.191038Z#000000#000#000000
#modifiersName: cn=config
#modifyTimestamp: 20180413024211Z

5.将kerberos schema导入到ldap

ldapadd -x -D "cn=config" -w 123456 -f /tmp/cn\=kerberos.ldif

6.重启ldap

systemctl restart slapd

二、kerberos服务端

1.yum安装krb5-server-ldap

yum install krb5-server-ldap -y

2. 生成LDAP数据库的密码文件

kdb5_ldap_util -D cn=admin,dc=yaobili,dc=com -w 123456 stashsrvpw -f /etc/krb5.ldap cn=admin,dc=yaobili,dc=com
输入密码

3.ldap页面为kerberos创建一个krb 分支

4.修改kerberos

vi /var/kerberos/krb5kdc/kdc.conf

HENGHE.COM = {
……
database_module = openldap_ldapconf
}

增加[dbdefaults]和[dbmodules]字段
[dbdefaults]
    ldap_kerberos_container_dn = cn=krb,dc=yaobili,dc=com

[dbmodules]
    openldap_ldapconf = {
        db_library = kldap
        ldap_servers = ldap://host1IP
        ldap_kerberos_container_dn =   cn=krb,dc=yaobili,dc=com
        ldap_kdc_dn =                cn=admin,dc=yaobili,dc=com
        ldap_kadmind_dn =            cn=admin,dc=yaobili,dc=com
        ldap_service_password_file = /etc/krb5.ldap
        ldap_conns_per_server = 5
}

5. 创建kerberos的LDAP数据库

kdb5_ldap_util -D cn=admin,dc=yaobili,dc=com -w 123456 -H ldap://host1IP:389 create -r HENGHE.COM -s
输入密码

6. 启动kerberos服务

systemctl restart krb5kdc
systemctl restart kadmin

7.登录LDAP页面，可以看到kerberos用户和ldap相互同步