1. 程式人生 > >搭建OPENLDAP代理服務無縫訪問AD伺服器

搭建OPENLDAP代理服務無縫訪問AD伺服器

 tar -xvzf db-4.6.21.tar.gz
 cd db-4.6.21
 cd build_unix
 ../dist/configure --prefix=/usr/local/berkeleydb
 make
 make install

2、安裝openldap
下載openldap安裝包:此處我用的版本號為2.4.43,下面配置也僅依據該版本 ,其他版本未做研究,而且差別很大。
安裝包:openldap-2.4.43.tgz
第一步,解開安裝包
第二步,設定編譯環境變數

CPPFLAGS="-I/usr/local/berkeleydb/include"
 export
CPPFLAGS LDFLAGS="-L/usr/local/lib -L/usr/local/berkeleydb/lib" export LDFLAGS LD_LIBRARY_PATH="/usr/local/berkeleydb/lib" export LD_LIBRARY_PATH

第三步,配置openldap:

cd openldap-2.4.43
 ./configure --prefix=/usr/local/ldapproxy --enable-bdb=mod --enable-ldap=mod --enable-meta=mod --enable-rewrite=yes --with-proxycache
=yes --enable-rwm=yes

沒有報錯即可下一步。若有報錯優先解決滿足配置要求。
如下警告:configure: WARNING: unrecognized options: –with-proxycache
可以不理會,繼續

make depend

第四步,編譯安裝:

make
make install

第五步,配置openldap:
vi /usr/local/ldapproxy/etc/openldap/slapd.conf
1、包入所有的schema

include     /usr/local/ldapproxy/etc/openldap/schema/core.schema
include
/usr/local/ldapproxy/etc/openldap/schema/ppolicy.schema include /usr/local/ldapproxy/etc/openldap/schema/misc.schema include /usr/local/ldapproxy/etc/openldap/schema/corba.schema include /usr/local/ldapproxy/etc/openldap/schema/collective.schema include /usr/local/ldapproxy/etc/openldap/schema/cosine.schema include /usr/local/ldapproxy/etc/openldap/schema/dyngroup.schema include /usr/local/ldapproxy/etc/openldap/schema/nis.schema

2、load模組:

moduleload  meta
overlay     rwm
rewriteEngine   on

3、增加ldap代理配置:

database    ldap
suffix      "dc=server,dc=org"
rebind-as-user  yes
uri "ldap://server.org"
chase-referrals yes

4、增加本地伺服器的配置:

lastmod     off
database    bdb
suffix  "dc=testadvdbg,dc=org"
rootdn  "cn=user,dc=testserver,dc=org"
rootpw  user

5、公共配置:

directory   /usr/local/ldapproxy/var/openldap-data
index   objectClass eq,pres
index   ou,cn,mail,surname,givenname    eq,pres,sub
index   uid eq,pres,sub

配置完成,slapd.conf配置檔案中內容均以tab鍵分割,否則報錯。
第六步,測試openldap配置

[root@mailmeta1 libexec]# /usr/local/ldapproxy/libexec/slapd -T test -u
config file testing succeeded

說明測試通過
第七步,啟動openldap代理服務

[root@mailmeta1 libexec]# /usr/local/ldapproxy/libexec/slapd -d 256&
[1] 20493
[root@mailmeta1 libexec]# 568c8098 @(#) $OpenLDAP: slapd 2.4.43 (Jan  6 2016 10:31:01) $
        root@mailmeta1.synihefei.com:/home/ldap/openldap-2.4.43/servers/slapd
568c8098 bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/ldapproxy/var/openldap-data: (2).
Expect poor performance for suffix "dc=testadvdbg,dc=org".
568c8098 bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
568c8098 slapd starting

沒有報錯說明啟動成功。
第八步,配置域名解析

vi /etc/hosts
192.168.28.183   server.org

第八步,測試代理是否可用
1、登入本地openldap伺服器是否成功

/usr/local/ldapproxy/bin/ldapsearch -H "ldap://127.0.0.1:389" -D "cn=user,dc=testserver,dc=org" -w '111111' -b "ou=People,DC=testserver,DC=org"

2、通過代理登入AD查詢是否成功

/usr/local/ldapproxy/bin/ldapsearch -H "ldap://127.0.0.1:389" -D "cn=Administrator,cn=users,dc=server,dc=org" -w '111111' -b "cn=users,DC=server,DC=org" -x

提示如下表示成功查詢:
# search result
search: 2
result: 0 Success

# numResponses: 42
# numEntries: 41