With the increasing use of various research and development tools, it is more and more expensive to maintain an account system separately for each tool, and it is increasingly inconvenient to use multiple account passwords as a user. So need to do a unified account login.
Several methods were queried, and because LDAP was used before, OpenLDAP was chosen to try the implementation.
OpenLDAP Installation System Information:
Ubuntu 14.04.1 Lts/centos Release 6.5
openldap-2.4.39
For more information on how to install, just record some of the configurations that were successfully attempted.
OpenLDAP Commands Example:Ldapsearch-xlll-b "uid=liangji.chen,ou=people,dc=example,dc=com" ldappasswd-x-s-d "cn=Manager,dc=example,dc=com"- W secret "uid=liangji.chen,ou=people,dc=example,dc=com" Ldapsearch-h 10.0.3.140-p 389-x-B "uid=liangji.chen,ou= People,dc=example,dc=com "-D" cn=manager,dc=example,dc=com "-W Secret
Jenkins Configuration Example:
Apache + SVN Configuration Example:<Location/svn> DAV SVN svnparentpath/var/lib/svn
AuthType Basic
AuthName "Subversion Repository" authbasicprovider LDAP file Authldapbinddn "cn=manager,dc=example,dc=com"
Authldapbindpassword Secret
Authldapurl "Ldap://10.0.3.140:389/ou=people,dc=example,dc=com?uid" </Location>
The following script will use the Migrationtools, which is: http://www.padl.com/OSS/MigrationTools.html
Add the LDAP user's script [[email protected] openldap]# cat adduser.sh
#!/bin/sh
#首先创建一个linux帐户
If [-z]; Then echo "Specify username ..."; Exit Fi
Useradd $
passwd $
Export perl5lib=./migration/
#转gid到ldap帐户
Cat/etc/group | grep $ >/tmp/group.in
migration/migrate_group.pl/tmp/group.in >/tmp/group.ldif
Ldapadd-x-D "CN=ROOT,DC=MELOT,DC=CN"-W secret-f/tmp/group.ldif
#转uid到ldap帐户
cat/etc/passwd | grep $ >/tmp/passwd.in
migration/migrate_passwd.pl/tmp/passwd.in >/tmp/passwd.ldif
Ldapadd-x-D "CN=ROOT,DC=MELOT,DC=CN"-W secret-f/tmp/passwd.ldif
#删掉创建的linux帐户 to make the account a purely LDAP account, not a local account
Userdel $
#rm-rf/home/$1
#rm/tmp/group.ldif
#rm/tmp/passwd.ldif
Ldapsearch-x "Uid=$1" #可用于显示刚刚添加到ldap数据库中的用户信息
Reset The LDAP user password script [[email protected] openldap]# cat resetpass.sh
If [-z]; Then echo "Specify username ..."; Exit Fi
Ldappasswd-x-s-d "CN=ROOT,DC=MELOT,DC=CN"-W Secret "UID=$1,OU=PEOPLE,DC=MELOT,DC=CN"
Web page for user self-service password change [[email protected] htdocs]# cat ldap.php
<! DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 strict//en"
"Http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd" >
<title> Reset LDAP password</title>
<style type= "Text/css" >
dt{
Font-weight:bold;
}
</style>
<body>
<?php
$u =!empty ($_request[' u ')? $_request[' u ']: ';
$op =!empty ($_request[' op ')? $_request[' op ']: ';
$NP 1 =!empty ($_request[' np1 ')? $_request[' np1 ': ';
$NP 2 =!empty ($_request[' np2 ')? $_request[' np2 ': ';
$an =!empty ($_request[' an ')? $_request[' an ']: ';
if (!empty ($an)) {
if (empty ($u) or empty ($op) or empty ($NP 1) or Empty ($NP 2)) {
$msg = "Some filed was empty!";
}else{
if ($NP 1! = $NP 2) {
$msg = "Confirm Password error!";
}else{
if ($op = = $np 1) {
$msg = "New password can not is same as Old password!";
}else{
$ldap _host = "ldap://10.0.3.140";
$ldap _port = 389;
$base _dn = "dc=example,dc=com";
$connect = @ldap_connect ($ldap _host, $ldap _port);
if (! $connect) {
$msg = "Could not connect to LDAP server";
}else{
Ldap_set_option ($connect, Ldap_opt_protocol_version, 3);
$user _dn = sprintf ("uid=%s,ou=people,dc=example,dc=com", $u);
$user _pass = $op;
$bind = @ldap_bind ($connect, $user _dn, $user _pass);
if (! $bind) {
$msg = sprintf ("Account%s old password error!", $u);
}else{
$root _dn = "cn=manager,dc=example,dc=com";
$root _pass = ' secret ';
$bind = @ldap_bind ($connect, $root _dn, $root _pass);
if (! $bind) {
$msg = "Programe can not bind to LDAP server!";
}else{
$values ["UserPassword"][0] = "{MD5}". Base64_encode (Pack ("h*", MD5 ($NP 1)));
$rs = @ldap_mod_replace ($connect, $user _dn, $values);
if ($rs) {
$msg = "Password modifed success!";
}else{
$msg = "Password modifed failed!";
}
}
}
}
@ldap_close ($connect);
}
}
}
}
if (!empty ($msg)) {
Print ("}
?>
<form method= "POST" action= "" >
<dl>
<dt> add users, reset passwords, etc. please contact the administrator, thank you! (script in/root/openldap directory) </dt>
<dt> The following is a self-service change Password:</dt>
<dt>user id</dt>
<dd>uid=<input type= "text" name= "U" size= "/>,ou=people,dc=example,dc=com</dd>"
<dt>old password</dt>
<dd><input type= "text" name= "OP"/></dd>
<dt>new password</dt>
<dd><input type= "text" name= "NP1"/></dd>
<dt>confirm password</dt>
<dd><input type= "text" name= "NP2"/></dd>
<dd><input type= "Submit" value= "Submit"/></dd>
</dl>
<input type= "hidden" name= "an" value= "Submit"/>
</form>
</body>
OpenLDAP Configuration information Logging
