Sign inSign up

1595225018/openldap

By 1595225018

•Updated about 8 years ago

osixia/openldap:1.2.1

Image
0

98

1595225018/openldap repository overview

⁠openldap

⁠相关链接

⁠服务器ldap设置

ou=groups

  • 市场部：Marketing Department （MRD）
  • 研发部：Research and Development (RND)
  • 算法部：Algorithm Department (ALD)
  • 知产部：Intelligent Property Department (IPD)
  • 人力资源部：Human Resources Department (HRD)
  • 财务部：General Accounting Department (GAD)
  • 运营部：General Operation Department (GOD)

公司ldap组织架构配置如下

dn: cn=admin,dc=longma,dc=com
    dn: ou=groups,cn=admin,dc=longma,dc=com
        dn: cn=ALD,ou=groups,cn=admin,dc=longma,dc=com
        dn: cn=GAD,ou=groups,cn=admin,dc=longma,dc=com
        dn: cn=gitlab,ou=groups,cn=admin,dc=longma,dc=com
        dn: cn=GOD,ou=groups,cn=admin,dc=longma,dc=com
        dn: cn=HRD,ou=groups,cn=admin,dc=longma,dc=com
        dn: cn=IPD,ou=groups,cn=admin,dc=longma,dc=com
        dn: cn=MRD,ou=groups,cn=admin,dc=longma,dc=com
        dn: cn=RND,ou=groups,cn=admin,dc=longma,dc=com
    dn: ou=users,cn=admin,dc=longma,dc=com
        dn: cn=zenglingyu,ou=users,cn=admin,dc=longma,dc=com
        dn: cn=liangyongjie,ou=users,cn=admin,dc=longma,dc=com

设置说明

ou=groups中配置

  • gitlab的objectClass为groupOfNames
  • 各部门的objectClass为posixGroup
  • 给各部门增加atribute，选gidnumber，将各个成员分配到各组中去
  • 每组gid间隔为100

ou=users中配置

  • 每个成员objectClass为inetOrgPerson
  • 添加email，在add new attribute中
  • 设置gidnumber、loginshell、uidnumber、homeDirectory（/home/zenglingyu）

添加新用户需要初始化sam，

 smbpasswd -a $username

⁠ldap配置

⁠一：制作pwserver镜像

搭建OpenLDAP自助修改密码系统Self Service Password⁠

参考链接搭建过程编写dockerfile，相关的dockerfile和配置文件在pwserver文件夹中，修改相应的配置，执行一下命令即可制作镜像

docker build -t pwserver .

⁠二：开启ldap服务

建立文件docker-compose.yml

version: '2'
services:
  openldap:
    image: osixia/openldap:1.2.1
    container_name: openldap
    restart: always
    environment:
      LDAP_LOG_LEVEL: "256"
      LDAP_ORGANISATION: "ALing Inc."
      LDAP_DOMAIN: "aling.com"
#      LDAP_BASE_DN: ""
      LDAP_ADMIN_PASSWORD: "daxue31105"
#      LDAP_CONFIG_PASSWORD: "config"
#      LDAP_READONLY_USER: "false"
#      LDAP_READONLY_USER_USERNAME: "readonly"
#      LDAP_READONLY_USER_PASSWORD: "readonly"
#      LDAP_RFC2307BIS_SCHEMA: "false"
#      LDAP_BACKEND: "mdb"
      LDAP_TLS: "true"
      LDAP_TLS_CRT_FILENAME: "ldap.crt"
      LDAP_TLS_KEY_FILENAME: "ldap.key"
      LDAP_TLS_CA_CRT_FILENAME: "ca.crt"
      LDAP_TLS_ENFORCE: "false"
      LDAP_TLS_CIPHER_SUITE: "SECURE256:-VERS-SSL3.0"
      LDAP_TLS_PROTOCOL_MIN: "3.1"
      LDAP_TLS_VERIFY_CLIENT: "demand"
      LDAP_REPLICATION: "false"
#      LDAP_REPLICATION_CONFIG_SYNCPROV: "binddn="cn=admin,cn=config" bindmethod=simple credentials=$LDAP_CONFIG_PASSWORD searchbase="cn=config" type=refreshAndPersist retry="60 +" timeout=1 starttls=critical"
#      LDAP_REPLICATION_DB_SYNCPROV: "binddn="cn=admin,$LDAP_BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$LDAP_BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="60 +" timeout=1 starttls=critical"
#      LDAP_REPLICATION_HOSTS: "#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']"
      KEEP_EXISTING_CONFIG: "false"
      LDAP_REMOVE_CONFIG_AFTER_SETUP: "true"
      LDAP_SSL_HELPER_PREFIX: "ldap"
    tty: true
    stdin_open: true
    volumes:
      - "/aling/docker/ldap/ldap:/var/lib/ldap"
      - "/aling/docker/ldap/slapd.d:/etc/ldap/slapd.d"
      - "/aling/docker/ldap/certs:/container/service/slapd/assets/certs"
    ports:
      - "389:389"
      - "636:636"
    domainname: "aling.com" # important: same as hostname
    hostname: "aling.com"

  phpldapadmin:
    image: osixia/phpldapadmin:latest
    container_name: phpldapadmin
    restart: always
    environment:
      PHPLDAPADMIN_LDAP_HOSTS: "openldap"
      PHPLDAPADMIN_HTTPS: "false"
    ports:
      - "8080:80"
    depends_on:
      - openldap

  pwserver:
    image: pwserver
    container_name: pwserver
    restart: always
    ports:
      - "8082:80"
    depends_on:
      - openldap

开启服务docker-compose up -d

⁠osixia/openldap:1.2.1
⁠osixia/phpldapadmin

⁠LDAP 与 linux login users 集成⁠

Install Client Packages

sudo apt-get update
sudo apt-get install libpam-ldap nscd

配置如下

  • LDAP server Uniform Resource Identifier ldap://10.0.0.117:389
  • Distinguished name of the search base:dc=aling,dc=com
  • LDAP version to use: 3
  • Make local root Database admin: Yes
  • Does the LDAP database require login? No
  • LDAP account for root:cn=admin,dc=aling,dc=com
  • LDAP root account password: Your-LDAP-root-password Configure Client Software
sudo vim  /etc/nsswitch.conf

passwd: ldap compat group: ldap compat shadow: ldap compat

sudo vim /etc/pam.d/common-session

session required pam_mkhomedir.so skel=/etc/skel umask=0022

We have to restart a service for these changes to be implemented:sudo /etc/init.d/nscd restart

Permissions The LDAP users that you added to the "admin" group will have access to the sudo command sudo vim /etc/sudoers

%admin ALL=(ALL) ALL

Log In as an LDAP User ssh LDAP_user@LDAP_client_IP_Address

Tag summary

Content type

Image

Digest

Size

-

Last updated

about 8 years ago

docker pull 1595225018/openldap:1.2.1