openldap 搭建

环境构建

1）软件安装：

yum -y install openldap-servers openldap-clients openldap openldap-devel migrationtools

2）修改配置文件

/etc/openldap/slapd.conf (可以从 /usr/share/openldapservers/ 下面获取模板）,去掉注释，就剩下面这些了：

include        /etc/openldap/schema/corba.schema
include        /etc/openldap/schema/core.schema
include        /etc/openldap/schema/cosine.schema
include        /etc/openldap/schema/duaconf.schema
include        /etc/openldap/schema/dyngroup.schema
include        /etc/openldap/schema/inetorgperson.schema
include        /etc/openldap/schema/java.schema
include        /etc/openldap/schema/misc.schema
include        /etc/openldap/schema/nis.schema
include        /etc/openldap/schema/openldap.schema
include        /etc/openldap/schema/ppolicy.schema
include        /etc/openldap/schema/collective.schema
allow bind_v2
pidfile        /var/run/openldap/slapd.pid
argsfile    /var/run/openldap/slapd.args
loglevel
TLSCACertificatePath /etc/openldap/certs
TLSCertificateFile "\"OpenLDAP Server\""
TLSCertificateKeyFile /etc/openldap/certs/password
database config
access to *
    by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
    by * none
database monitor
access to *
    by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
        by dn.exact="cn=Manager,dc=my-domain,dc=com" read
        by * none
database    bdb
suffix        "dc=dns,dc=com,dc=cn"
checkpoint
rootdn        "cn=Manager,dc=dns,dc=com,dc=cn"
rootpw        secret
directory    /var/lib/ldap
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub

3）复制数据库文件

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG;chown ldap:ldap /var/lib/ldap -R

　　

初始化数据

1）配置迁移工具 

去 /usr/share/migrationtools/ , 修改 migrate_common.ph

2）生成 base.ldif文件

执行脚本： perl migrate_base.pl > base.ldif

3）编辑 base.ldif

dn: dc=dns,dc=com,dc=cn
dc: dns
objectClass: top
objectClass: domain

dn: ou=People,dc=dns,dc=com,dc=cn
ou: People
objectClass: top
objectClass: organizationalUnit

dn: ou=Group,dc=dns,dc=com,dc=cn
ou: Group
objectClass: top
objectClass: organizationalUnit
dn: ou=Hosts,dc=dns,dc=com,dc=cn
ou: Hosts
objectClass: top
objectClass: organizationalUnit

4）导入 ldap

执行：

ldapadd -D "cn=Manager,dc=dns,dc=com,dc=cn" -w secret -c -x -f base.lldif

　

导入数据

导入 ldap 的数据，只要定义的属性在 ldap 系统中存在即可。