jenkins中集成LDAP，管控不同組用戶看到不同內容

jenkins中集成LDAP，管控不同組用戶看到不同內容

1. 安裝ldap服務器,並指定用戶名密碼、指定域

1-1. 安裝

sudo apt-get install slapd ldap-utils

1-2. 配置

sudo dpkg-reconfigure slapd

a

會彈框讓你填寫DNS Domain Name,

The DNS domain name is used to construct the base DN of the LDAP directory. 
For example, 'foo.example.org' will create the directory with 'dc=foo, dc=example, dc=org' as base DN.
DNS domain name:    

這裏我的domain是’love3q.tech’,

b

會彈框讓你填寫組織名

Please enter the name of the organization to use in the base DN of your LDAP directory.
Organization name:  

輸入組織名，隨便填寫

c

會彈框讓你設置密碼

我這裏給admin設置密碼’adminpwd’

d. slapcat命令查看初始配置

用slapcat命令查看初始設置

$ sudo slapcat |grep -n -e ""
1:dn: dc=love3q,dc=tech
2:objectClass: top
3:objectClass: dcObject
4:objectClass: organization
5:o: peggy
6:dc: love3q
7:structuralObjectClass: organization
8:entryUUID: 8bb9f7da-995b-1039-9c64-b77ca7797a9b
9:creatorsName: cn=admin,dc=love3q,dc=tech
10:createTimestamp: 20191112054641Z
11:entryCSN: 20191112054641.280128Z#000000#000#000000
12:modifiersName: cn=admin,dc=love3q,dc=tech
13:modifyTimestamp: 20191112054641Z
14:
15:dn: cn=admin,dc=love3q,dc=tech
16:objectClass: simpleSecurityObject
17:objectClass: organizationalRole
18:cn: admin
19:description: LDAP administrator
20:userPassword:: e1NTSEF9ZTBiT2NpN3BTOUFPVE51ZXYwVStEQlZ4Y2dyLzR3RXY=
21:structuralObjectClass: organizationalRole
22:entryUUID: 8bbfb224-995b-1039-9c65-b77ca7797a9b
23:creatorsName: cn=admin,dc=love3q,dc=tech
24:createTimestamp: 20191112054641Z
25:entryCSN: 20191112054641.317700Z#000000#000#000000
26:modifiersName: cn=admin,dc=love3q,dc=tech
27:modifyTimestamp: 20191112054641Z

可以看到o: peggy對應之前我填寫的組織名。

ldapadmin輔助工具查看ldap的配置

請自行安裝ldapadmin.exe.

雙擊ldapadmin.exe->Start->‘New Connection’,
配置如圖所示

其中
Host:填寫ldap服務器所在的地址，可以填寫域名，可以填寫ip
Port:389
Account.username:填寫‘cn=admin,dc=love3q,dc=tech’，就是slapcat命令結果中的一條cn
Account.password:填寫配置ldap服務器時設定的密碼，這裏我的是’adminpwd’
此時點擊’Fetch DNs’,再在’Base’的下拉框中選擇’dc=love3q,dc=tech’
這個時候點擊’Test Connection’,沒問題的話test ok。
連接！

2. ldap服務器增加組和用戶

2-1. ldap服務器增加ou=group & ou=people

編寫ldif文件’ldap_jenkins_ou_people_group.ldif’,此文件可放任意位置

dn: ou=user,dc=love3q,dc=tech
objectClass:organizationalUnit
ou: user

dn: ou=group,dc=love3q,dc=tech
objectClass: organizationalUnit
ou: group

用ldapadd命令增加新的dn

$ sudo ldapadd -x -D 'cn=admin,dc=love3q,dc=tech' -w adminpwd -f ldap_jenkins_ou_people_group.ldif 
adding new entry "ou=user,dc=love3q,dc=tech"
adding new entry "ou=group,dc=love3q,dc=tech"

用slapcat命令查看增加的內容

$ sudo slapcat
...(省略)...

dn: ou=user,dc=love3q,dc=tech
objectClass: organizationalUnit
ou: user
structuralObjectClass: organizationalUnit
entryUUID: a76d11ae-995d-1039-8343-ed16fa7cf653
creatorsName: cn=admin,dc=love3q,dc=tech
createTimestamp: 20191112060146Z
entryCSN: 20191112060146.745854Z#000000#000#000000
modifiersName: cn=admin,dc=love3q,dc=tech
modifyTimestamp: 20191112060146Z

dn: ou=group,dc=love3q,dc=tech
objectClass: organizationalUnit
ou: group
structuralObjectClass: organizationalUnit
entryUUID: a77558aa-995d-1039-8344-ed16fa7cf653
creatorsName: cn=admin,dc=love3q,dc=tech
createTimestamp: 20191112060146Z
entryCSN: 20191112060146.800109Z#000000#000#000000
modifiersName: cn=admin,dc=love3q,dc=tech
modifyTimestamp: 20191112060146Z

2-2. ldap服務器增加三個組

我這裏計劃把所有用戶分成三個組，一個是amdin，可以對jenkins做任何事，一個是manager,可以配置任務，一個是tester，可以執行manager配置好的任務。

a. 增加分組jenkins-admin

編輯ldif文件’ldap_jenkins_cn_jenkins.ldif’

dn: cn=jenkins-admin,ou=group,dc=love3q,dc=tech
objectClass: posixGroup
cn: jenkins-admin
gidNumber: 5000

$ sudo ldapadd -x -D 'cn=admin,dc=love3q,dc=tech' -w adminpwd -f ldap_jenkins_cn_jenkins.ldif 
adding new entry "cn=jenkins-admin,ou=group,dc=love3q,dc=tech"

b. 增加分組jenkins-manager

編輯ldif文件’ldap_jenkins_cn_jenkins.ldif’

dn: cn=jenkins-manager,ou=group,dc=love3q,dc=tech
objectClass: posixGroup
cn: jenkins-manager
gidNumber: 5000

$ sudo ldapadd -x -D 'cn=admin,dc=love3q,dc=tech' -w adminpwd -f ldap_jenkins_cn_jenkins.ldif 
adding new entry "cn=jenkins-manager,ou=group,dc=love3q,dc=tech"

c. 增加分組jenkins-tester

編輯ldif文件’ldap_jenkins_cn_jenkins.ldif’

dn: cn=jenkins-tester,ou=group,dc=love3q,dc=tech
objectClass: posixGroup
cn: jenkins-tester
gidNumber: 5000

$ sudo ldapadd -x -D 'cn=admin,dc=love3q,dc=tech' -w adminpwd -f ldap_jenkins_cn_jenkins.ldif 
adding new entry "cn=jenkins-tester,ou=group,dc=love3q,dc=tech"

d. 查看新增加的三個分組

$ sudo slapcat
...(省略)...
dn: cn=jenkins-admin,ou=group,dc=love3q,dc=tech
objectClass: posixGroup
cn: jenkins-admin
gidNumber: 5000
structuralObjectClass: posixGroup
entryUUID: ad54981a-995f-1039-947e-655c7f81cbef
creatorsName: cn=admin,dc=love3q,dc=tech
createTimestamp: 20191112061615Z
entryCSN: 20191112061615.645239Z#000000#000#000000
modifiersName: cn=admin,dc=love3q,dc=tech
modifyTimestamp: 20191112061615Z

dn: cn=jenkins-manager,ou=group,dc=love3q,dc=tech
objectClass: posixGroup
cn: jenkins-manager
gidNumber: 5000
structuralObjectClass: posixGroup
entryUUID: d99c2370-995f-1039-947f-655c7f81cbef
creatorsName: cn=admin,dc=love3q,dc=tech
createTimestamp: 20191112061729Z
entryCSN: 20191112061729.933876Z#000000#000#000000
modifiersName: cn=admin,dc=love3q,dc=tech
modifyTimestamp: 20191112061729Z

dn: cn=jenkins-tester,ou=group,dc=love3q,dc=tech
objectClass: posixGroup
cn: jenkins-tester
gidNumber: 5000
structuralObjectClass: posixGroup
entryUUID: ee37ec88-995f-1039-9480-655c7f81cbef
creatorsName: cn=admin,dc=love3q,dc=tech
createTimestamp: 20191112061804Z
entryCSN: 20191112061804.509265Z#000000#000#000000
modifiersName: cn=admin,dc=love3q,dc=tech
modifyTimestamp: 20191112061804Z

2-3. ldap增加幾個用戶，

增加用戶j_admin_01

設置一個用戶j_admin_01，將來它會屬於組jenkins-admin
編輯ldif文件’ldap_jenkins_uid.ldif ’

dn: uid=j_admin_01,ou=user,dc=love3q,dc=tech
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: j_admin_01
sn: jenkins
givenName: j_admin_01
cn: jenkins-user
displayName: j_admin_01
uidNumber: 10000
gidNumber: 5000
userPassword: 123456
gecos: j_admin_01
loginShell: /bin/bash
homeDirectory: /data/vsftpd/j_admin_01
mail: [email protected]

$ sudo ldapadd -x -D 'cn=admin,dc=love3q,dc=tech' -w adminpwd -f ldap_jenkins_uid.ldif 
adding new entry "uid=j_admin_01,ou=user,dc=love3q,dc=tech"

增加用戶j_manager_01

設置一個用戶j_manager_01，將來它會屬於組jenkins-manager
編輯ldif文件’ldap_jenkins_uid.ldif ’

dn: uid=j_manager_01,ou=user,dc=love3q,dc=tech
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: j_manager_01
sn: jenkins
givenName: j_manager_01
cn: jenkins-user
displayName: j_manager_01
uidNumber: 10000
gidNumber: 5000
userPassword: 123456
gecos: j_manager_01
loginShell: /bin/bash
homeDirectory: /data/vsftpd/j_manager_01
mail: [email protected]

$ sudo ldapadd -x -D 'cn=admin,dc=love3q,dc=tech' -w adminpwd -f ldap_jenkins_uid.ldif 
adding new entry "uid=j_manager_01,ou=user,dc=love3q,dc=tech"

增加用戶j_tester_01

設置一個用戶j_tester_01，將來它會屬於組jenkins-tester
編輯ldif文件’ldap_jenkins_uid.ldif ’

$ cat ldap_jenkins_uid.ldif
dn: uid=j_tester_01,ou=user,dc=love3q,dc=tech
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: j_tester_01
sn: jenkins
givenName: j_tester_01
cn: jenkins-user
displayName: j_tester_01
uidNumber: 10000
gidNumber: 5000
userPassword: 123456
gecos: j_tester_01
loginShell: /bin/bash
homeDirectory: /data/vsftpd/j_tester_01
mail: [email protected]

$ sudo ldapadd -x -D 'cn=admin,dc=love3q,dc=tech' -w adminpwd -f ldap_jenkins_uid.ldif 
adding new entry "uid=j_tester_01,ou=user,dc=love3q,dc=tech"

查看新增加的3個用戶:

$ sudo slapcat
...(省略)...
dn: uid=j_admin_01,ou=user,dc=love3q,dc=tech
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: j_admin_01
sn: jenkins
givenName: j_admin_01
cn: jenkins-user
displayName: j_admin_01
uidNumber: 10000
gidNumber: 5000
userPassword:: MTIzNDU2
gecos: j_admin_01
loginShell: /bin/bash
homeDirectory: /data/vsftpd/j_admin_01
mail: [email protected]
structuralObjectClass: inetOrgPerson
entryUUID: 40a1ee96-9961-1039-9482-655c7f81cbef
creatorsName: cn=admin,dc=love3q,dc=tech
createTimestamp: 20191112062732Z
entryCSN: 20191112062732.273899Z#000000#000#000000
modifiersName: cn=admin,dc=love3q,dc=tech
modifyTimestamp: 20191112062732Z

dn: uid=j_manager_01,ou=user,dc=love3q,dc=tech
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: j_manager_01
sn: jenkins
givenName: j_manager_01
cn: jenkins-user
displayName: j_manager_01
uidNumber: 10000
gidNumber: 5000
userPassword:: MTIzNDU2
gecos: j_manager_01
loginShell: /bin/bash
homeDirectory: /data/vsftpd/j_manager_01
mail: [email protected]
structuralObjectClass: inetOrgPerson
entryUUID: a5090752-9961-1039-9483-655c7f81cbef
creatorsName: cn=admin,dc=love3q,dc=tech
createTimestamp: 20191112063020Z
entryCSN: 20191112063020.721714Z#000000#000#000000
modifiersName: cn=admin,dc=love3q,dc=tech
modifyTimestamp: 20191112063020Z

dn: uid=j_tester_01,ou=user,dc=love3q,dc=tech
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: j_tester_01
sn: jenkins
givenName: j_tester_01
cn: jenkins-user
displayName: j_tester_01
uidNumber: 10000
gidNumber: 5000
userPassword:: MTIzNDU2
gecos: j_tester_01
loginShell: /bin/bash
homeDirectory: /data/vsftpd/j_tester_01
mail: [email protected]
structuralObjectClass: inetOrgPerson
entryUUID: c6b69b76-9961-1039-9484-655c7f81cbef
creatorsName: cn=admin,dc=love3q,dc=tech
createTimestamp: 20191112063117Z
entryCSN: 20191112063117.224092Z#000000#000#000000
modifiersName: cn=admin,dc=love3q,dc=tech
modifyTimestamp: 20191112063117Z

用ldapadmin.exe查看

把幾個用戶分配給三個組

把j_admin_01用戶加入到級jenkins-admin組中，

$ cat ldap_modify.ldif 
dn: cn=jenkins-admin,ou=group,dc=love3q,dc=tech
changetype: modify
add: memberUid
memberUid: j_admin_01

develop@develop-Z97-HD3:/etc/ldap/slapd.d$ sudo ldapmodify -x -D 'cn=admin,dc=love3q,dc=tech' -w adminpwd -f ldap_modify.ldif 
modifying entry "cn=jenkins-admin,ou=group,dc=love3q,dc=tech"

把j_manager_01用戶加入到級jenkins-manager組中，

$ cat ldap_modify.ldif 
dn: cn=jenkins-manager,ou=group,dc=love3q,dc=tech
changetype: modify
add: memberUid
memberUid: j_manager_01

$ sudo ldapmodify -x -D 'cn=admin,dc=love3q,dc=tech' -w adminpwd -f ldap_modify.ldif 
modifying entry "cn=jenkins-manager,ou=group,dc=love3q,dc=tech"

把j_tester_01用戶加入到級jenkins-tester組中，

$ cat ldap_modify.ldif 
dn: cn=jenkins-tester,ou=group,dc=love3q,dc=tech
changetype: modify
add: memberUid
memberUid: j_tester_01

$ sudo ldapmodify -x -D 'cn=admin,dc=love3q,dc=tech' -w adminpwd -f ldap_modify.ldif 
modifying entry "cn=jenkins-tester,ou=group,dc=love3q,dc=tech"

查看發現組中有新增的用戶

$ sudo slapcat
...
51:dn: cn=jenkins-admin,ou=group,dc=love3q,dc=tech
52:objectClass: posixGroup
53:cn: jenkins-admin
54:gidNumber: 5000
55:structuralObjectClass: posixGroup
56:entryUUID: ad54981a-995f-1039-947e-655c7f81cbef
57:creatorsName: cn=admin,dc=love3q,dc=tech
58:createTimestamp: 20191112061615Z
59:memberUid: j_admin_01
60:entryCSN: 20191112063608.133792Z#000000#000#000000
61:modifiersName: cn=admin,dc=love3q,dc=tech
62:modifyTimestamp: 20191112063608Z
63:
64:dn: cn=jenkins-manager,ou=group,dc=love3q,dc=tech
65:objectClass: posixGroup
66:cn: jenkins-manager
67:gidNumber: 5000
68:structuralObjectClass: posixGroup
69:entryUUID: d99c2370-995f-1039-947f-655c7f81cbef
70:creatorsName: cn=admin,dc=love3q,dc=tech
71:createTimestamp: 20191112061729Z
72:memberUid: j_manager_01
73:entryCSN: 20191112063656.229771Z#000000#000#000000
74:modifiersName: cn=admin,dc=love3q,dc=tech
75:modifyTimestamp: 20191112063656Z
76:
77:dn: cn=jenkins-tester,ou=group,dc=love3q,dc=tech
78:objectClass: posixGroup
79:cn: jenkins-tester
80:gidNumber: 5000
81:structuralObjectClass: posixGroup
82:entryUUID: ee37ec88-995f-1039-9480-655c7f81cbef
83:creatorsName: cn=admin,dc=love3q,dc=tech
84:createTimestamp: 20191112061804Z
85:memberUid: j_tester_01
86:entryCSN: 20191112063727.008609Z#000000#000#000000
87:modifiersName: cn=admin,dc=love3q,dc=tech
88:modifyTimestamp: 20191112063727Z

發現多了

memberUid: j_admin_01
memberUid: j_manager_01
memberUid: j_tester_01

這幾行。
用ldapadmin.exe查看

配置jenkins LDAP

備份配置

在/var/lib/jenkins/config.xml

  <authorizationStrategy class="hudson.security.FullControlOnceLoggedInAuthorizationStrategy">
    <denyAnonymousReadAccess>true</denyAnonymousReadAccess>
  </authorizationStrategy>
  <securityRealm class="hudson.security.HudsonPrivateSecurityRealm">
    <disableSignup>true</disableSignup>
    <enableCaptcha>false</enableCaptcha>
  </securityRealm>

其中

  <securityRealm class="hudson.security.HudsonPrivateSecurityRealm">
    <disableSignup>true</disableSignup>
    <enableCaptcha>false</enableCaptcha>
  </securityRealm>

對應’管理Jenkins’->‘Configure Global Security’->‘訪問控制’->‘安全域’中選擇了’Jenkins專有數據庫’，且沒有勾選’允許用戶註冊’

  <authorizationStrategy class="hudson.security.FullControlOnceLoggedInAuthorizationStrategy">
    <denyAnonymousReadAccess>true</denyAnonymousReadAccess>
  </authorizationStrategy>

對應’管理Jenkins’->‘Configure Global Security’->‘訪問控制’->‘授權策略’中選擇了’Logged-in users can do anything’ 、‘任何用戶可以做任何事(沒有任何限制)’

如果一旦配置了ldap，但是配置錯了，導致無法再登錄進jenkins，
則改config.xml
把<securityRealm></securityRealm>內容和<authorizationStrategy></authorizationStrategy>內容換成以上備份的內容，並sudo service jenkins restart重啓jenkins，則jenkins可恢復成非ldap配置的狀態，可用正常用戶名密碼登錄jenkins.(賬號密碼就是當年安裝jenkins時的賬號密碼)

開啓jenkins安全配置，按group配置。

‘管理Jenkins’->‘Configure Global Security’->‘訪問控制’->‘安全域’
選擇’LDAP’，其中

Server: ldap://192.168.150.218:389
User search base: ou=user,dc=love3q,dc=tech
Group search base: ou=group,dc=love3q,dc=tech

點擊Test LDAP settings測試一下我們配置的有沒有問題。
輸入用戶名和密碼
user:j_admin_01
password:123456
發現測試通過。

‘管理Jenkins’->‘Configure Global Security’->‘訪問控制’->授權策略’中，
選擇’項目矩陣授權策略’.

配置就完成了，保存配置。

此時jenkins註銷登錄，再用j_admin_01 或者 j_user_01 或者 j_manager_01，都可以登錄成功，並且它們三種用戶登錄進去能看到的頁面是不一樣的。