openldap安装指南

#ldapserver
#安装openldap

setenforce 0 && systemctl stop firewalld && iptables -F

yum install -y epel-release

yum install -y openldap openldap-clients openldap-servers


systemctl start slapd
systemctl enable slapd
systemctl status slapd

#ldapServer root密码

adminpd='Huawei@123'

DomainName="huawei"

DomainSuffix="com"

###########################################################

PassWord="$(slappasswd -s $adminpd)"

cat >/etc/openldap/schema/changepwd.ldif<<EOF
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: $PassWord
EOF

#导入自定义配置文件
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/changepwd.ldif

#导入基础schema
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/collective.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/corba.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/duaconf.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/dyngroup.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/java.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/misc.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/openldap.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/pmi.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/ppolicy.ldif


#定义修改域名和后缀
DomainName="huawei"

DomainSuffix="com"


# 修改域名，新增changedomain.ldif, 这里我自定义的域名为 huawei.com，管理员用户账号为admin。
# 如果要修改，则修改文件中相应的dc=huawei,dc=com为自己的域名

cat >/etc/openldap/schema/changedomain.ldif<<EOFA
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=admin,dc=${DomainName},dc=${DomainSuffix}" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=${DomainName},dc=${DomainSuffix}

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=${DomainName},dc=${DomainSuffix}

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootPW
olcRootPW: ${PassWord}

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=${DomainName},dc=${DomainSuffix}" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=admin,dc=${DomainName},dc=${DomainSuffix}" write by * read
EOFA


ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/changedomain.ldif


# 启用memberof功能
cat >/etc/openldap/schema/add-memberof.ldif<<EOFC
dn: cn=module{0},cn=config
cn: modulle{0}
objectClass: olcModuleList
objectclass: top
olcModuleload: memberof.la
olcModulePath: /usr/lib64/openldap

dn: olcOverlay={0}memberof,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfUniqueNames
olcMemberOfMemberAD: uniqueMember
olcMemberOfMemberOfAD: memberOf
EOFC

cat >/etc/openldap/schema/refint1.ldif<<EOFD
dn: cn=module{0},cn=config
add: olcmoduleload
olcmoduleload: refint
EOFD

cat >/etc/openldap/schema/refint2.ldif<<EOFE
dn: olcOverlay=refint,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: refint
olcRefintAttribute: memberof uniqueMember manager owner
EOFE

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/add-memberof.ldif

ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/refint1.ldif

ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/refint2.ldif




#定义修改域名和后缀
DomainName="huawei"

DomainSuffix="com"

cat >/etc/openldap/schema/base.ldif<<EOFF
dn: dc=${DomainName},dc=${DomainSuffix}
objectClass: top
objectClass: dcObject
objectClass: organization
o: ${DomainName} Company
dc: ${DomainName}

dn: cn=admin,dc=${DomainName},dc=${DomainSuffix}
objectClass: organizationalRole
cn: admin

dn: ou=People,dc=${DomainName},dc=${DomainSuffix}
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=${DomainName},dc=${DomainSuffix}
objectClass: organizationalRole
cn: Group
EOFF

# 执行命令，添加配置, 这里要注意修改域名为自己配置的域名，然后需要输入上面我们生成的密码
ldapadd -x -D cn=admin,dc=${DomainName},dc=${DomainSuffix} -w ${adminpd} -f /etc/openldap/schema/base.ldif




yum install -y phpldapadmin
sed -i 's#Require local#Require all granted#g' /etc/httpd/conf.d/phpldapadmin.conf

# 启动apache
systemctl start httpd
systemctl enable httpd

sed -i '/\'login\'\,\'attr\'\,\'uid\/ s#uid#cn#g'