进城务工人员小梅因故用到LDAP，特实现一个LDAP的最小闭环。
零、物料
基于如下版本：
1、CentOS 8.2；
2、389 Directory Server（LDAP服务端）；
3、Apache Directory Studio（LDAP客户端）；
一、安装389 Directory Server（LDAP服务端）
389 Directory Server目前已经取代了OpenLDAP，其配置较OpenLDAP简单，在Cockpit中有对应的插件可以通过UI进行配置，其官网为：http://directory.fedoraproject.org/index.html。在CentOS 8.2中按照官网的描述进行安装即可：
CentOS安装389 Directory Server
安装完成后，依次执行以下命令创建配置模板、修改模板，然后基于模板创建Instance：
|
1 2 3 |
# dscreate create-template /tmp/instance.inf # dscreate from-file /tmp/instance.inf # dsctl YOUR_INSTANCE_NAME status |
CentOS配置389 Directory Server
instance.inf中所有的配置都有默认值，我们主要需要修改其中的：
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
# instance_name (str) # Description: Sets the name of the instance. You can refer to this value in other parameters of this INF file using the "{instance_name}" variable. Note that this name cannot be changed after the installation! # Default value: localhost instance_name = YOUR_INSTANCE_NAME # root_dn (str) # Description: Sets the Distinquished Name (DN) of the administrator account for this instance. # Default value: cn=Directory Manager root_dn = dc=example,dc=com # root_password (str) # Description: Sets the password of the account specified in the "root_dn" parameter. You can either set this parameter to a plain text password dscreate hashes during the installation or to a "{algorithm}hash" string generated by the pwdhash utility. The password must be at least 8 characters long. Note that setting a plain text password can be a security risk if unprivileged users can read this INF file! # Default value: Directory_Manager_Password root_password = YOUR_PASSWORD # sample_entries (str) # Description: Set this parameter to 'yes' to add latest version of sample entries to this database. Or, use '001003006' to use the 1.3.6 version sample entries. Use this option, for example, to create a database for testing purposes. # Default value: no sample_entries = yes # suffix (str) # Description: Sets the root suffix stored in this database. If you do not uncomment and set the suffix attribute the install process will NOT create the backend/suffix. You can also create multiple backends/suffixes by duplicating this section. # Default value: suffix = dc=example,dc=com |
需要注意，root_dn就是Apache Directory Server登陆时使用的用户名。
二、安装Cockpit UI Plugin
使用如下命令安装：
|
1 2 |
# systemctl enable cockpit.socket # systemctl start cockpit.socket |
Cockpit的默认端口为9090，注意需要使用操作系统的用户名和密码登陆：
Cockpit
三、使用Apache Directory Studio（LDAP客户端）
从官网下载并安装Apache Directory Studio，看得出是基于Eclipse实现的：https://directory.apache.org/studio
然后创建连接：
Apache Directory Studio1
Apache Directory Studio-2
其他诸如安全性、证书等的配置不在此讨论。
转载时请保留出处，违法转载追究到底：进城务工人员小梅 » LDAP最小闭环（基于389 Directory Server）