Centos7搭建原生LDAP服务

Centos7安装OpenLDAP

# 安装OpenLDAP
yum install -y openldap.x86_64 openldap-clients.x86_64 openldap-servers.x86_64 openldap-devel.x86_64 migrationtools.noarch compat-openldap.x86_64

LDAP Server配置

vim /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif

# 修改第8、9行，添加第10行
olcSuffix: dc=bloodzer0,dc=com
olcRootDN: cn=Manager,dc=bloodzer0,dc=com
olcRootPW: bloodzer0

Monitoring Database配置

vim /etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif

# 修改第7行
 al,cn=auth" read by dn.base="cn=Manager,dc=bloodzer0,dc=com" read by * none

LDAP数据库配置

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -R ldap.ldap /var/lib/ldap/

LDAP测试

slaptest -u

启动LDAP服务

systemctl enable slapd.service
systemctl start slapd.service

导入schemas

ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/cosine.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/nis.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/collective.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/corba.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/core.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/duaconf.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/dyngroup.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/inetorgperson.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/java.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/misc.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/openldap.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/pmi.ldif 
ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/ppolicy.ldif

basedomain配置

vim /usr/share/migrationtools/migrate_common.ph

# 修改第71、74、90三行文件
$DEFAULT_MAIL_DOMAIN = "bloodzer0.com";
$DEFAULT_BASE = "dc=bloodzer0,dc=com";
$EXTENDED_SCHEMA = 1;

/usr/share/migrationtools/migrate_base.pl > /etc/openldap/basedomain.ldif

# 导入basedomain文件
ldapadd -x -D cn=Manager,dc=bloodzer0,dc=com -W -f /etc/openldap/basedomain.ldif
# 要求输入olcRootPW的密码

phpldapadmin配置

# 安装phpldapadmin
yum install epel-release -y
yum install phpldapadmin.noarch -y
systemctl enable httpd.service
systemctl start httpd.service

修改httpd的配置

vim /etc/httpd/conf.d/phpldapadmin.conf
# 添加Require all granted

修改phpldapadmin的配置

vim /etc/phpldapadmin/config.php
# 注释398，取消注释397
# 在397行下面添加以下3行

$servers->setValue('server','host','127.0.0.1');
$servers->setValue('server','port',389);
$servers->setValue('server','base',array('dc=bloodzer0,dc=com'));

重启httpd服务器

systemctl restart httpd.service

访问LDAP：http://10.10.10.10/phpldapadmin/，账号：cn=Manager,dc=bloodzer0,dc=com，密码：olcRootPW的密码

refer

花了一个五一终于搞懂了OpenLDAP：https://juejin.im/entry/5aec6ac46fb9a07ac3635884