Wener Notes

LADP

约 3 分钟阅读
标签：LDAP
LDAPDB
dnprimary key
object classtable
entryrow
schemaconstraint

github/github-ldapGitHubgithub/github-ldap

www.manageengine.com/products/ad-manager/help/csv-import-management/active-directory-ldap-attributes.html

Kerberos 5 searchsecurity.techtarget.com/definition/Kerberos Wikipedia:Authentication serverWikipediaAuthentication server Change Password Protocol directory.apache.orgLinkdirectory.apache.orgApache Directory™ · LDAP 实现 · Kerberos 实现 · 后端为自定义 DB - 需要磁盘空间存储，不支持 DB · 阿里云镜像下载 http://mirrors.aliyun.com/apache/directory/笔记：Apache Directory

Pryz/terraform-provider-ldapGitHubPryz/terraform-provider-ldap

bash
# 以简化操作
alias ldapsearch="ldapsearch -H ldap://127.0.0.1:10389 -D 'uid=admin,ou=system' -w secret"
# 检测用户是否在组中
ldapsearch -b 'cn=developer,ou=groups,dc=example,dc=com' '(&(member=uid=wener,ou=users,dc=example,dc=com))'

cn=developer,ou=groups,dc=wener,dc=me

fortress

bash
# 下载并加载 schema
wget https://raw.githubusercontent.com/apache/directory-fortress-core/master/ldap/schema/apacheds-fortress.ldif
ldapmodify -h localhost -p 10389 -D uid=admin,ou=system -w secret -a -f apacheds-fortress.ldif

# 可以直接使用 jetty-runner 来执行 war
wget http://maven.aliyun.com/nexus/content/groups/public/org/eclipse/jetty/jetty-runner/9.4.6.v20170531/jetty-runner-9.4.6.v20170531.jar -O jetty-runner.jar

java -jar jetty-runner.jar --port 8081 fortress-rest.war

Usecase

  • OpenVPN
  • Jenkins
  • Kubernetes
  • Docker
  • Atlassian Jira & Confluence
  • Linux Samba

常见结构

  • dc=wener,dc=me
    • ou=users
      • cn=USERNAME - 用户 - inetOrgPerson,organizationalPerson,person
        • MUST cn, sn
        • uid 唯一标识符
        • cn 名称
        • sn 姓
        • givenName
        • mail
      • cn= - Linux 用户 - posixAccount
        • MUST uidNumber, gidNumber
    • ou=groups
      • cn=GROUPNAME - 分组 - groupOfNames
        • member - 成员
        • entryDN - 组成员属性、组 DN 属性
        • displayName - 如果不想显示 cn 可以考虑使用该属性
      • cn=admin - Linux 分组 posixGroup
        • MUST gidNumber
    • ou=rules
      • cn=NAME - groupOfNames
    • ou=service - Service Account
      • uid=keycloak - simpleSecurityObject,account
        • MUST uid, userPassword
    • ou=policies - 策略
      • cn=default - pwdPolicy,namedPolicy,top
  • c=国家
    • o=组织
bash
# 以简化操作
alias ldapsearch="ldapsearch -H ldap://127.0.0.1:10389 -D 'uid=admin,ou=system' -w admin"
# 检测用户是否在组中
ldapsearch -b 'cn=developer,ou=groups,dc=example,dc=com' '(&(member=uid=wener,ou=users,dc=example,dc=com))'

ldapsearch -b 'ou=users,dc=wener,dc=me' '(uid=wener.cyw)'

关联信息

反向链接、本文链接的其他页面和外部资料。

References

GitHub8 条
Wikipedia4 条
标准文档1 条
  • RFC 2830datatracker.ietf.org/doc/html/rfc2830
    RFC

    IETF Request for Comments standard document.

其他外链43 条
最近更新commit 7e97bf3Edit

Louketo Proxy

Previous Page

ApacheDS Kerberos

Next Page

On this page

LADPfortressUsecase常见结构