OPENLDAP
程序员文章站
2022-06-08 10:13:42
...
之前用一周时间为上品折扣公司搭建了CAS+APACHEDS的SSO，后来发现，APACHEDS在很多方面存在不足，尤其是集群方面，故又花了一周时间安装了openldap集群。
下面是遇到的一些问题及解决方案：
安装OPENLDAP步骤
下载OPENLDAP并安装
下载地址：http://www.openldap.org/software/download/
下载版本包括发布版本和稳定版本
安装OPENLDAP遇到的问题
在/usr/local目录下执行如下命令：
tar -zxf openldap-2.4.26
cd openldap2.4.26
./configure
出现configure error
configure: error: MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location)
上述error表示表示编译OPENLDAP需要其他依赖库，即OPENSSL和BerkeleyDB
下载OPENSSL，目前版本最新的SSL地址为http://www.openssl.org/source/openssl-1.0.0e.tar.gz
下载BerkeleyDB
安装OPENSSL 查看openssl版本信息openssl version -a
1，解压到/usr/local目录下tar -zxf openssl-1.0.0e.tar.gz
，cd openssl-1.0.0e
3，./config（注意：执行./Configure提示执行./config）
4，make
5，sudo make install
6，ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
安装BerkeleyDB
tar -zxvf db-5.2.36.tar.gz
1，cd db-5.2.36??
2，cd build_unix
3，../dist/configure
4，make
5，sudo make install
配置/etc/ld.so.conf文件
ld.so.conf文件配置了需要读入告诉缓存中的动态函数库所在目录
重新配置ld.so.conf后，在命令行执行ldconfig命令生效
注意：如果编译OPENLDAP的时候依然出现BDB错误，可以使用如下方式：
sudo cp /usr/local/BerkeleyDB.5.2/include/* /usr/include
sudo cp /usr/local/BerkeleyDB.5.2/lib/* /usr/lib
重新安装OPENLDAP
il IL
CD openldap-2.4.26
export LD_LIBRARY_PATH="/usr/local/db-5.2.36/build_unix/.libs"
export CPPFLAGS="-I/usr/local/BerkeleyDB.5.2/include"
export LDFLAGS="-L/usr/local/BerkeleyDB.5.2/lib"
export CPPFLAGS="-I/usr/local/ssl/include"
export LDFLAGS="-L/usr/local/ssl/lib"
sudo ./configure --with-tls=openssl –enable-dynamic
sudo make depend?? ??(??构建依赖关系??)
sudo make
sudo make install (su root -c 'make install')
OPENLDAP启动
/usr/local/libexec/slapd -d 256
注意：如果报找不到openssl的以来类库的错误，请将安装的openssl的lib中的libssl.so.1.0.0 libcrypto.so.1.0.0拷贝到/usr/lib中
OPENLDAP关闭
kill -INT ' cat /usr/local/var/run/slapd.pid'
创建OPENLDAP服务
出现:
解决方式:cd /usr/local/var/openldap-data/
cp DB_CONFIG.example DB_CONFIG
在/etc/init.d下创建slapd文件，slapd文件主要包含start、stop命令，内容如下:
chkconfig --add slapd
cd /etc/init.d/
chmod 755 slapd
./slapd
service slapd stop
service slapd start
此外大家需要根据公司业务的需要进行基于openldap的schema的扩展，来适应公司业务。
本人自己扩展的schema，/usr/local/etc/openldap/schema/user.schema内容如下：
目前使用的集群方式为mirror mode方式，也即使用了openldap自身的HA，当然最好在前端使用lvs进行负载均衡。
/usr/local/etc/openldap/slapd.conf文件内容如下：
下面是遇到的一些问题及解决方案：
安装OPENLDAP步骤
下载OPENLDAP并安装
下载地址：http://www.openldap.org/software/download/
下载版本包括发布版本和稳定版本
安装OPENLDAP遇到的问题
在/usr/local目录下执行如下命令：
tar -zxf openldap-2.4.26
cd openldap2.4.26
./configure
出现configure error
configure: error: MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location)
上述error表示表示编译OPENLDAP需要其他依赖库，即OPENSSL和BerkeleyDB
下载OPENSSL，目前版本最新的SSL地址为http://www.openssl.org/source/openssl-1.0.0e.tar.gz
下载BerkeleyDB
安装OPENSSL 查看openssl版本信息openssl version -a
1，解压到/usr/local目录下tar -zxf openssl-1.0.0e.tar.gz
，cd openssl-1.0.0e
3，./config（注意：执行./Configure提示执行./config）
4，make
5，sudo make install
6，ln -s /usr/local/ssl/bin/openssl /usr/bin/openssl
安装BerkeleyDB
tar -zxvf db-5.2.36.tar.gz
1，cd db-5.2.36??
2，cd build_unix
3，../dist/configure
4，make
5，sudo make install
配置/etc/ld.so.conf文件
ld.so.conf文件配置了需要读入告诉缓存中的动态函数库所在目录
重新配置ld.so.conf后，在命令行执行ldconfig命令生效
注意：如果编译OPENLDAP的时候依然出现BDB错误，可以使用如下方式：
sudo cp /usr/local/BerkeleyDB.5.2/include/* /usr/include
sudo cp /usr/local/BerkeleyDB.5.2/lib/* /usr/lib
重新安装OPENLDAP
il IL
CD openldap-2.4.26
export LD_LIBRARY_PATH="/usr/local/db-5.2.36/build_unix/.libs"
export CPPFLAGS="-I/usr/local/BerkeleyDB.5.2/include"
export LDFLAGS="-L/usr/local/BerkeleyDB.5.2/lib"
export CPPFLAGS="-I/usr/local/ssl/include"
export LDFLAGS="-L/usr/local/ssl/lib"
sudo ./configure --with-tls=openssl –enable-dynamic
sudo make depend?? ??(??构建依赖关系??)
sudo make
sudo make install (su root -c 'make install')
OPENLDAP启动
/usr/local/libexec/slapd -d 256
注意：如果报找不到openssl的以来类库的错误，请将安装的openssl的lib中的libssl.so.1.0.0 libcrypto.so.1.0.0拷贝到/usr/lib中
OPENLDAP关闭
kill -INT ' cat /usr/local/var/run/slapd.pid'
创建OPENLDAP服务
出现:
515002de @(#) $OpenLDAP: slapd 2.4.28 (Mar 25 2013 15:53:52) $
root@web133:/usr/local/openldap-2.4.28/servers/slapd
515002de bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/var/openldap-data: (2).
Expect poor performance for suffix "dc=my-domain,dc=com".
515002de bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
515002de slapd starting
解决方式:cd /usr/local/var/openldap-data/
cp DB_CONFIG.example DB_CONFIG
在/etc/init.d下创建slapd文件，slapd文件主要包含start、stop命令，内容如下:
#!/bin/bash
# chkconfig: 2345 85 15
# description: OpenLdap Service
start() {
echo "Starting OPENLDAP..."
COMMAND_LINE="/usr/local/libexec/slapd -d 256"
nohup $COMMAND_LINE &
}
case "$1" in
'start')
start
echo "Usage: ..."
exit 1
;;
'stop')
echo Stop OpenLdap .....
for i in ` ps -ef | grep -w slapd |grep -v grep |awk '{print $2}'`;do
kill -9 $i
done
echo Stop OpenLdap Secuessed....
;;
esac
exit 0
chkconfig --add slapd
cd /etc/init.d/
chmod 755 slapd
./slapd
service slapd stop
service slapd start
此外大家需要根据公司业务的需要进行基于openldap的schema的扩展，来适应公司业务。
本人自己扩展的schema，/usr/local/etc/openldap/schema/user.schema内容如下：
attributeType ( shopinAttributeType:1 NAME 'displayOrder'
DESC 'sort a list'
EQUALITY integerMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
attributeType ( shopinAttributeType:2 NAME 'status'
EQUALITY integerMatch
DESC 'sign status of a person or department normal or others'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
SINGLE-VALUE )
attributeType ( shopinAttributeType:3 NAME 'erpId'
DESC 'the code of the dept in ERP-HR'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributeType ( shopinAttributeType:4 NAME 'parentNo'
DESC 'the number of the parent orgnization'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
#attributeType ( shopinAttributeType:5 NAME 'titleName'
# DESC 'the name of title'
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
attributeType ( shopinAttributeType:6 NAME 'belongTitleDN'
DESC 'the distinguishedName of title'
SUP distinguishedName )
attributetype ( shopinAttributeType:7 NAME 'systemOccupant'
DESC 'occupant of shopin system'
SUP distinguishedName )
objectclass ( shopinObjectClass:1
NAME 'shopin-inetOrgPerson'
DESC 'shopin Internet Organizational Person'
SUP inetOrgPerson
STRUCTURAL
MAY (
audio $ businessCategory $ carLicense $ departmentNumber $
displayName $ employeeNumber $ employeeType $ givenName $
homePhone $ homePostalAddress $ initials $ jpegPhoto $
labeledURI $ mail $ manager $ mobile $ o $ pager $
photo $ roomNumber $ secretary $ uid $ userCertificate $
x500uniqueIdentifier $ preferredLanguage $
userSMIMECertificate $ userPKCS12 $ status $
displayOrder $ belongTitleDN)
)
objectclass ( shopinObjectClass:2
NAME 'shopin-organization'
DESC 'an shopin organization'
SUP organization
MUST ( o $ displayName )
MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $
x121Address $ registeredAddress $ destinationIndicator $
preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $
telephoneNumber $ internationaliSDNNumber $
facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $
postalAddress $ physicalDeliveryOfficeName $ st $ l $ description $ status $
displayOrder $ erpId $ parentNo) )
objectclass ( shopinObjectClass:3 NAME 'shopin-groupOfNames'
DESC 'a group of names (DNs)'
SUP top STRUCTURAL
MUST ( cn $ displayName)
MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description
$ member $ status ) )
objectclass ( shopinObjectClass:4 NAME 'shopin-duty'
DESC 'duty info in shopin'
SUP top STRUCTURAL
MUST ( cn $ title )
MAY ( description $ status $ o) )
objectclass ( shopinObjectClass:5 NAME 'shopin-organizationalRole'
DESC 'an orgnizational role of shopin'
SUP organizationalRole
MUST ( cn $ displayName)
MAY ( x121Address $ registeredAddress $ destinationIndicator $
preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $
telephoneNumber $ internationaliSDNNumber $ facsimileTelephoneNumber $
seeAlso $ roleOccupant $ preferredDeliveryMethod $ street $
postOfficeBox $ postalCode $ postalAddress $
physicalDeliveryOfficeName $ ou $ st $ l $ description $ status) )
objectclass ( shopinObjectClass:6 NAME 'shopin-system'
DESC 'system info in shopin'
SUP top STRUCTURAL
MUST ( cn $ displayName )
MAY ( description $ status $ systemOccupant) )
目前使用的集群方式为mirror mode方式，也即使用了openldap自身的HA，当然最好在前端使用lvs进行负载均衡。
/usr/local/etc/openldap/slapd.conf文件内容如下：
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /usr/local/etc/openldap/schema/core.schema
include /usr/local/etc/openldap/schema/corba.schema
include /usr/local/etc/openldap/schema/cosine.schema
include /usr/local/etc/openldap/schema/inetorgperson.schema
include /usr/local/etc/openldap/schema/java.schema
include /usr/local/etc/openldap/schema/nis.schema
include /usr/local/etc/openldap/schema/misc.schema
#include /usr/local/etc/openldap/schema/mail.schema
include /usr/local/etc/openldap/schema/openldap.schema
#define user's oid and schema
objectIdentifier shopinOID 1.1
objectIdentifier shopinSNMP shopinOID:1
objectIdentifier shopinLDAP shopinOID:2
objectIdentifier shopinAttributeType shopinLDAP:1
objectIdentifier shopinObjectClass shopinLDAP:2
include /usr/local/etc/openldap/schema/user.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile /usr/local/var/run/slapd.pid
argsfile /usr/local/var/run/slapd.args
# Load dynamic backend modules:
# modulepath /usr/local/libexec/openldap
# moduleload back_bdb.la
# moduleload back_hdb.la
# moduleload back_ldap.la
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
#######################################################################
# BDB database definitions
#######################################################################
database bdb
suffix "dc=shopin,dc=net"
rootdn "cn=Manager,dc=shopin,dc=net"
# Cleartext passwords, especially for the rootdn, should
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw secret
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /usr/local/var/openldap-data
# Indices to maintain
index objectClass eq
overlay syncprov
syncprov-checkpoint 100 10
syncprov-sessionlog 100
# 全球部分
serverID 3
# 数据库部分
# syncrepl参数
syncrepl rid=001
provider=ldap://172.16.103.190:389
bindmethod=simple
binddn="cn=Manager,dc=shopin,dc=net"
credentials=secret
searchbase="dc=shopin,dc=net"
schemachecking=on
type=refreshAndPersist
retry="60 +"
syncrepl rid=002
provider=ldap://172.16.100.26:389
bindmethod=simple
binddn="cn=Manager,dc=shopin,dc=net"
credentials=secret
searchbase="dc=shopin,dc=net"
schemachecking=on
type=refreshAndPersist
retry="60 +"
syncrepl rid=003
provider=ldap://172.16.200.55:389
bindmethod=simple
binddn="cn=Manager,dc=shopin,dc=net"
credentials=secret
searchbase="dc=shopin,dc=net"
schemachecking=on
type=refreshAndPersist
retry="60 +"
mirrormode on
上一篇： php生成Excel文件 实现代码
下一篇： php基础 一（20150925）
推荐阅读
-
Django集成OpenLDAP认证的实现
-
基于OPENldap搭建postfix 虚拟用户
-
openldap 之 客户端部署
-
openldap数据备份还原
-
openldap数据双向同步
-
linux安装openldap步骤
-
[原创] CentOS7 下 OpenLDAP Server 安装和配置及使用 phpLDAPadmin 和 Java LDAP 访问 LDAP Server
-
OpenLDAP、什么是目录服务、OpenLDAP简介、LDAP的基本模型、目录树概念、（DC、UID、OU、CN、SN、DN、RDN、c、o）、LDAP的使用
-
OpenLdap配置ssl连接
-
samba + OPENldap 搭建文件共享服务器