跳到主要内容

LADP

LDAPDB
dnprimary key
object classtable
entryrow
schemaconstraint

https://github.com/github/github-ldap

https://www.manageengine.com/products/ad-manager/help/csv-import-management/active-directory-ldap-attributes.html

Kerberos 5 http://searchsecurity.techtarget.com/definition/Kerberos https://en.wikipedia.org/wiki/Authentication_server Change Password Protocol http://directory.apache.org/

https://github.com/Pryz/terraform-provider-ldap

# 以简化操作
alias ldapsearch="ldapsearch -H ldap://127.0.0.1:10389 -D 'uid=admin,ou=system' -w secret"
# 检测用户是否在组中
ldapsearch -b 'cn=developer,ou=groups,dc=example,dc=com' '(&(member=uid=wener,ou=users,dc=example,dc=com))'

cn=developer,ou=groups,dc=wener,dc=me

fortress​

# 下载并加载 schema
wget https://raw.githubusercontent.com/apache/directory-fortress-core/master/ldap/schema/apacheds-fortress.ldif
ldapmodify -h localhost -p 10389 -D uid=admin,ou=system -w secret -a -f apacheds-fortress.ldif

# 可以直接使用 jetty-runner 来执行 war
wget http://maven.aliyun.com/nexus/content/groups/public/org/eclipse/jetty/jetty-runner/9.4.6.v20170531/jetty-runner-9.4.6.v20170531.jar -O jetty-runner.jar

java -jar jetty-runner.jar --port 8081 fortress-rest.war

Usecase​

  • OpenVPN
  • Jenkins
  • Kubernetes
  • Docker
  • Atlassian Jira & Confluence
  • Linux Samba

常见结构​

  • dc=wener,dc=me
    • ou=users
      • cn=USERNAME - 用户 - inetOrgPerson,organizationalPerson,person
        • MUST cn, sn
        • uid 唯一标识符
        • cn 名称
        • sn 姓
        • givenName
        • mail
      • cn= - Linux 用户 - posixAccount
        • MUST uidNumber, gidNumber
    • ou=groups
      • cn=GROUPNAME - 分组 - groupOfNames
        • member - 成员
        • entryDN - 组成员属性、组 DN 属性
        • displayName - 如果不想显示 cn 可以考虑使用该属性
      • cn=admin - Linux 分组 posixGroup
        • MUST gidNumber
    • ou=rules
      • cn=NAME - groupOfNames
    • ou=service - Service Account
      • uid=keycloak - simpleSecurityObject,account
        • MUST uid, userPassword
    • ou=policies - 策略
      • cn=default - pwdPolicy,namedPolicy,top
  • c=国家
    • o=组织
# 以简化操作
alias ldapsearch="ldapsearch -H ldap://127.0.0.1:10389 -D 'uid=admin,ou=system' -w admin"
# 检测用户是否在组中
ldapsearch -b 'cn=developer,ou=groups,dc=example,dc=com' '(&(member=uid=wener,ou=users,dc=example,dc=com))'

ldapsearch -b 'ou=users,dc=wener,dc=me' '(uid=wener.cyw)'