OpenLDAP Active Directory集成步骤
OpenLDAP Active Directory集成
- 1. centos7 open***安装ldap插件以支持ldap验证
- 2. open***服务端配置文件增加配置
- 3. open***客户端测试
注意 ***三个连续字符替代这三个字：
1. centos7 open***安装ldap插件以支持ldap验证
# 安装open***-auth-ldap
yum install open***-auth-ldap -y
# 进入open***服务器认证配置文件夹
cd /etc/open***/auth/
# 备份默认配置文件
cp ldap.conf ldap.conf.bak
# 开始修改配置，清空内容进行编辑
echo > ldap.conf
# 修改ldap配置文件
vim ldap.conf
# 修改并粘贴配置# 重启
systemctl restart open***@server
ldap.conf
# AD服务器地址URL ldap://192.168.xxx.xxx# 管理员DNBindDN CN=Administrator,CN=Users,DC=GOING-LINK,DC=com# 管理员密码Password YUGU@$%Y45%^F^#GH# Network timeout (in seconds)Timeout 15# Enable Start TLSTLSEnable yes# Follow LDAP Referrals (anonymously)FollowReferrals yes# TLS CA Certificate FileTLSCACertFile /usr/local/etc/ssl/ca.pem# TLS CA Certificate DirectoryTLSCACertDir /etc/ssl/certs# Client Certificate and key# If TLS client authentication is requiredTLSCertFile /usr/local/etc/ssl/client-cert.pemTLSKeyFile /usr/local/etc/ssl/client-key.pem# Cipher Suite# The defaults are usually fine here# TLSCipherSuite ALL:!ADH:@STRENGTH
# 基础DNBaseDN "OU=甄云科技,DC=going-link,DC=com"# 用户搜索过滤条件SearchFilter "(&(sAMAccountName=%u)(accountStatus=active))"# Require Group MembershipRequireGroup false# Add non-group members to a PF table (disabled)#PFTable ips_***_usersBaseDN "ou=Groups,dc=example,dc=com"SearchFilter "(|(cn=developers)(cn=artists))"MemberAttribute uniqueMember# Add group members to a PF table (disabled)#PFTable ips_***_eng
测试连接
# 安装 openldap-clients
yum install -y openldap-clients
# 搜索实验 并输入密码
ldapsearch -x -W -D "CN=Administrator,CN=Users,DC=GOING-LINK,DC=com" -b "DC=GOING-LINK,DC=com" -h 192.168.1.62 -s one dn -LLL
YUGU@$%Y45%^F^#GH
ldapsearch -x -W -D "CN=Administrator,CN=Users,DC=GOING-LINK,DC=com" -b "DC=going-link,DC=com" -h 192.168.1.62
ldapsearch -x -W -D "CN=Administrator,CN=Users,DC=GOING-LINK,DC=com" -b "OU=disabled,DC=going-link,DC=com" -h 192.168.1.62
2. open***服务端配置文件增加配置
plugin /usr/lib64/open***/plugin/lib/open***-auth-ldap.so "/etc/open***/auth/ldap.conf cn=%u"
client-cert-not-required
username-as-common-name
3. open***客户端测试
暂未测试成功
本文来自互联网用户投稿，文章观点仅代表作者本人，不代表本站立场，不承担相关法律责任。如若转载，请注明出处。 如若内容造成侵权/违法违规/事实不符，请点击【内容举报】进行投诉反馈！