openldap安裝指南

#ldapserver
#安裝openldap

setenforce 0 && systemctl stop firewalld && iptables -F

yum install -y epel-release

yum install -y openldap openldap-clients openldap-servers


systemctl start slapd
systemctl enable slapd
systemctl status slapd

#ldapServer root密碼

adminpd='Huawei@123'

DomainName="huawei"

DomainSuffix="com"

###########################################################

PassWord="$(slappasswd -s $adminpd)"

cat >/etc/openldap/schema/changepwd.ldif<<EOF
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: $PassWord
EOF

#導入自定義配置文件
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/changepwd.ldif

#導入基礎schema
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/collective.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/corba.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/duaconf.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/dyngroup.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/java.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/misc.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/openldap.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/pmi.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/ppolicy.ldif


#定義修改域名和後綴
DomainName="huawei"

DomainSuffix="com"


# 修改域名，新增changedomain.ldif, 這裏我自定義的域名爲 huawei.com，管理員用戶賬號爲admin。
# 如果要修改，則修改文件中相應的dc=huawei,dc=com爲自己的域名

cat >/etc/openldap/schema/changedomain.ldif<<EOFA
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=admin,dc=${DomainName},dc=${DomainSuffix}" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=${DomainName},dc=${DomainSuffix}

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=${DomainName},dc=${DomainSuffix}

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: ${PassWord}

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=${DomainName},dc=${DomainSuffix}" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=admin,dc=${DomainName},dc=${DomainSuffix}" write by * read
EOFA


ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/changedomain.ldif


# 啓用memberof功能
cat >/etc/openldap/schema/add-memberof.ldif<<EOFC
dn: cn=module{0},cn=config
cn: modulle{0}
objectClass: olcModuleList
objectclass: top
olcModuleload: memberof.la
olcModulePath: /usr/lib64/openldap

dn: olcOverlay={0}memberof,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfUniqueNames
olcMemberOfMemberAD: uniqueMember
olcMemberOfMemberOfAD: memberOf
EOFC

cat >/etc/openldap/schema/refint1.ldif<<EOFD
dn: cn=module{0},cn=config
add: olcmoduleload
olcmoduleload: refint
EOFD

cat >/etc/openldap/schema/refint2.ldif<<EOFE
dn: olcOverlay=refint,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: refint
olcRefintAttribute: memberof uniqueMember manager owner
EOFE

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/add-memberof.ldif

ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/refint1.ldif

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/refint2.ldif




#定義修改域名和後綴
DomainName="huawei"

DomainSuffix="com"

cat >/etc/openldap/schema/base.ldif<<EOFF
dn: dc=${DomainName},dc=${DomainSuffix}
objectClass: top
objectClass: dcObject
objectClass: organization
o: ${DomainName} Company
dc: ${DomainName}

dn: cn=admin,dc=${DomainName},dc=${DomainSuffix}
objectClass: organizationalRole
cn: admin

dn: ou=People,dc=${DomainName},dc=${DomainSuffix}
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=${DomainName},dc=${DomainSuffix}
objectClass: organizationalRole
cn: Group
EOFF

# 執行命令，添加配置, 這裏要注意修改域名爲自己配置的域名，然後需要輸入上面我們生成的密碼
ldapadd -x -D cn=admin,dc=${DomainName},dc=${DomainSuffix} -w ${adminpd} -f /etc/openldap/schema/base.ldif




yum install -y phpldapadmin
sed -i 's#Require local#Require all granted#g' /etc/httpd/conf.d/phpldapadmin.conf

# 啓動apache
systemctl start httpd
systemctl enable httpd

sed -i '/\'login\'\,\'attr\'\,\'uid\/ s#uid#cn#g'