![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231900494-390779836.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231900806-474010325.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231901025-813415793.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231901369-96288261.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231901681-1910337547.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231901931-597376332.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231902385-1835882832.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231902666-1515855592.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231902947-441226326.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231903213-1353227814.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231903510-1487907791.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231903931-1051326147.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231904260-1649858772.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231904510-1875476167.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231904791-397125213.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231905103-377896150.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231905431-868330612.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231905681-1543202759.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231905963-1588039011.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231906228-1134093580.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231906510-1823862717.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231906791-1209058579.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231907072-409789475.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231907603-1965279553.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231908010-1186987047.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231908322-601912446.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231908619-945914484.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231908947-372285000.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231909322-41647009.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231909838-565541215.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231910353-978326000.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231911041-810700205.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231911447-508531031.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231911697-2065880883.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231911916-2084220578.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231912228-1331167616.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231912494-579426234.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231912775-200000877.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231913025-1421106406.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231913697-43288504.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231914010-2121790727.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231914306-1098604527.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231914525-650938160.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231914822-1025817870.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231915119-2096004521.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231915385-1499328019.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231915666-1698967938.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231916150-622227790.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231916416-161447240.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231917041-728271420.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231917353-279283933.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231917619-1465821711.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231917916-1954285312.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231918244-1948294169.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231918728-1803420629.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231919025-1143336983.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231919447-291862264.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231919681-981072864.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231920041-1150330316.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231920353-1894043234.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231920588-1022361791.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231920806-1264582589.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231921025-145160391.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231921385-1595997282.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231921635-353567156.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231922166-1229674366.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231922728-798240165.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231923072-1005661482.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231923306-633987413.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231923666-415465583.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231924181-725864165.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231924431-1563540908.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231924681-1272408806.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231924978-434143576.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231925244-1951455407.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231925494-307063263.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231925791-648259845.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231926400-1877942653.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231926635-1339424210.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231926963-739872058.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231927228-585243971.png)
1.安装和设置数据库
在CentOS7下,默认安装的数据库为MariaDB,属于MySQL数据库的一个分支,所以我还是使用了MariaDB。安装命令为:
[root@localhost ~]# yum install mariadb-server -y
安装时间不长,安装完成后的样子如下:
然后启动数据库服务:
[root@localhost ~]# systemctl start mariadb [root@localhost ~]# systemctl enable mariadb //设置开机自启
对数据库进行一些基本设置:
[root@localhost ~]# mysql_secure_installation
初始情况下没有密码,直接回车,它会自动提示你重新设置密码,这时就可以设置自己的数据库密码了。设置完密码之后是一些其他的基本设置,都是直接'y'或者'n'就能解决的,对照着它给出的提示就可以完成设置。然后设置字符集,字符集的设置在/etc下:
[root@localhost ~]# vim /etc/my.cnf #在[mysqld]标签下添加如下内容: default-storage-engine = innodb innodb_file_per_table max_connections = 4096 collation-server = utf8_general_ci character-set-server = utf8 [root@localhost ~]# vim /etc/my.cnf.d/client.cnf #在[client]标签下添加如下内容: default-character-set=utf8 [root@localhost ~]# vim /etc/my.cnf.d/mysql-clients.cnf #在[mysql]标签下添加如下内容: default-character-set=utf8
接着重启服务:
[root@localhost ~]# systemctl restart mariadb
此时就大概完成了数据库的安装和设置。因为要将该数据库做完LDAP的后端数据库,所以先新建一个用户ldap和数据库ldap作为连接LDAP的数据库:
[root@localhost ~]# mysql -uroot -p
添加ldap用户,设置密码为ldap,添加权限给ldap用户并新建数据库ldap:
MariaDB [(none)]> CREATE USER 'ldap'@'%' IDENTIFIED BY 'ldap'; MariaDB [(none)]> GRANT ALL PRIVILEGES ON ldap.* TO 'ldap'@'%'; MariaDB [(none)]> CREATE USER 'ldap'@'localhost' IDENTIFIED BY 'ldap'; MariaDB [(none)]> GRANT ALL PRIVILEGES ON ldap.* TO 'ldap'@'localhost'; MariaDB [(none)]> show databases;
然后退出数据库,进行第二步。
2.安装ODBC并配置ldap数据库
直接yum安装:
[root@localhost ~]# yum install unixODBC mysql-connector-odbc
创建连接配置文件odbc.ini:
[root@localhost ~]# vim /etc/odbc.ini #添加如下内容 [ldap] Description = LdapToMysql Driver = MySQL Database = ldap Server = 127.0.0.1 User = ldap Password = ldap Port = 3306
验证是否连接成功:
[root@localhost ~]# isql -v ldap
进入如下界面:
输入查看数据库的命令:
SQL> show databases;
连接成功!
3.下载安装并配置OpenLDAP
安装LDAP到/opt目录下:
[root@localhost ~]# yum install wget make gcc mysql-devel unixODBC-devel groff -y [root@localhost ~]# cd /opt [root@localhost opt]# wget ftp://mirror.switch.ch/mirror/OpenLDAP/openldap-release/openldap-2.4.43.tgz [root@localhost opt]# tar zxvf openldap-*.tgz [root@localhost opt]# rm -rf openldap-*.tgz [root@localhost opt]# mv openldap-* openldap [root@localhost opt]# cd /opt/openldap [root@localhost openldap]# ./configure --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --localstatedir=/var --mandir=/usr/share/man --infodir=/usr/share/info --enable-sql --disable-bdb --disable-ndb --disable-hdb [root@localhost openldap]# make depend [root@localhost openldap]# make [root@localhost openldap]# make install
此时安装已经完成,接着配置LDAP,首先生成自己的LDAP密码:
[root@localhost openldap]# slappasswd
输入密码之后它会返回给一个加密的密码,类似于“{SSHA}XDEtT6s3MTzrSbHeJl7OlRoqk0w1By1X”。然后打开LDAP配置文件,该文件在/etc/openldap目录下:
[root@localhost openldap]# vim /etc/openldap/slapd.conf #在第5行下面添加如下内容 include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema #修改第55行内容 database sql #修改第56、57行的dc值(这里最好设置为example,因为后面要用ldap的数据库数据,如果这里使用别的值,那么对应的要把数据库中的所有dn都改掉) suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" #修改第61行rootpw的值,就是之前获取到的加密密码 rootpw {SSHA}XDEtT6s3MTzrSbHeJl7OlRoqk0w1By1X #注释掉第65、67行的内容 #directory /var/openldap-data #index objectClass eq #在第61行rootpw下面添加如下内容 rootpw {SSHA}XDEtT6s3MTzrSbHeJl7OlRoqk0w1By1X dbname ldap dbuser ldap dbpasswd ldap has_ldapinfo_dn_ru no subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)"
关于dc(domainComponent)的问题,在https://www.bbsmax.com/A/WpdKKPaodV/这篇文章里面讲解的很好,我的安装配置也是从这里学的。
到此,OpenLDAP的安装与配置完成,但此时还不能运行LDAP,因为数据库中没有对应的表结构,LDAP虽然可以使用除BDB之外的数据库,但必须要使用它定义的表结构。对应的表结构在/opt/openldap/servers/slapd/back-sql/rdbms_depend/目录下,该目录下有多种数据库的表结构,包括MySQL、Oracle和PGSQL等,进入mysql目录下,有如下几个sql文件:
backsql_create.sql是基础的表结构,不论其它表有没有,这几个表必须有;testdb_create.sql是测试的表结构,包含几个像person表之类的表结构;testdb_data.sql是测试表中的数据;testdb_metadata.sql是基础表中的数据。进入数据库中执行这几个sql文件:
[root@localhost ~]# mysql -uldap -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 8 Server version: 5.5.52-MariaDB MariaDB Server Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> use ldap MariaDB [ldap]> source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/backsql_create.sql MariaDB [ldap]> source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/testdb_create.sql MariaDB [ldap]> source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/testdb_data.sql MariaDB [ldap]> source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/testdb_metadata.sql
此时运行LDAP:
[root@localhost ~]# /opt/openldap/servers/slapd/slapd -d 5 -h 'ldap:/// ldapi:///' -f /etc/openldap/slapd.conf &
4.安装和配置LDAP管理工具PHPldapadmin
首先安装Apache和PHP:
[root@localhost ~]# yum -y install httpd php php-ldap php-gd php-mbstring php-pear php-bcmath php-xml
然后安装phpldapadmin:
[root@localhost ~]# yum -y install epel-release [root@localhost ~]# yum --enablerepo=epel -y install phpldapadmin
接着修改配置文件:
[root@localhost ~]# vim /etc/phpldapadmin/config.php #397行取消注释,398行添加注释 $servers->setValue('login','attr','dn'); // $servers->setValue('login','attr','uid'); [root@localhost ~]# vim /etc/httpd/conf.d/phpldapadmin.conf // 修改配置 <IfModule mod_authz_core.c> # Apache 2.4 Require local #添加一行内容,指定可访问的ip段(虽然我也不知道为什么,但不填不能运行这个管理工具,我就直接写的本地ip) Require ip 192.168.85.132 </IfModule>
设置开机自启并启动Apache:
[root@localhost ~]# systemctl enable httpd [root@localhost ~]# systemctl start httpd
此时phpldapadmin可以访问但可能不能登录,这个和系统SELinux有关,如果SELinux关闭的话登录时候会有一个错误:
error Unable to connect to LDAP server Cloud-Lab.Com error: Can't contact LDAP server (-1) for user error Failed to Authenticate to server Invalid Username or Password.
打开这个配置:
[root@localhost ~]# getsebool httpd_can_connect_ldap httpd_can_connect_ldap --> off [root@localhost ~]# setsebool -P httpd_can_connect_ldap on [root@localhost ~]# getsebool httpd_can_connect_ldap httpd_can_connect_ldap --> on
浏览器访问phpldapadmin:
http://(localhost或服务器地址)/phpldapadmin/
登录phpldapadmin,用户名密码可以在数据库ldap的表persons中查找。
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231900494-390779836.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231900806-474010325.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231901025-813415793.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231901369-96288261.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231901681-1910337547.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231901931-597376332.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231902385-1835882832.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231902666-1515855592.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231902947-441226326.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231903213-1353227814.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231903510-1487907791.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231903931-1051326147.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231904260-1649858772.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231904510-1875476167.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231904791-397125213.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231905103-377896150.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231905431-868330612.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231905681-1543202759.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231905963-1588039011.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231906228-1134093580.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231906510-1823862717.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231906791-1209058579.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231907072-409789475.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231907603-1965279553.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231908010-1186987047.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231908322-601912446.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231908619-945914484.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231908947-372285000.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231909322-41647009.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231909838-565541215.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231910353-978326000.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231911041-810700205.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231911447-508531031.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231911697-2065880883.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231911916-2084220578.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231912228-1331167616.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231912494-579426234.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231912775-200000877.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231913025-1421106406.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231913697-43288504.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231914010-2121790727.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231914306-1098604527.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231914525-650938160.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231914822-1025817870.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231915119-2096004521.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231915385-1499328019.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231915666-1698967938.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231916150-622227790.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231916416-161447240.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231917041-728271420.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231917353-279283933.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231917619-1465821711.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231917916-1954285312.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231918244-1948294169.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231918728-1803420629.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231919025-1143336983.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231919447-291862264.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231919681-981072864.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231920041-1150330316.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231920353-1894043234.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231920588-1022361791.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231920806-1264582589.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231921025-145160391.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231921385-1595997282.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231921635-353567156.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231922166-1229674366.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231922728-798240165.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231923072-1005661482.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231923306-633987413.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231923666-415465583.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231924181-725864165.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231924431-1563540908.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231924681-1272408806.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231924978-434143576.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231925244-1951455407.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231925494-307063263.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231925791-648259845.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231926400-1877942653.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231926635-1339424210.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231926963-739872058.png)
![](https://images2015.cnblogs.com/blog/746846/201701/746846-20170109231927228-585243971.png)
1.安装和设置数据库
在CentOS7下,默认安装的数据库为MariaDB,属于MySQL数据库的一个分支,所以我还是使用了MariaDB。安装命令为:
[root@localhost ~]# yum install mariadb-server -y
安装时间不长,安装完成后的样子如下:
然后启动数据库服务:
[root@localhost ~]# systemctl start mariadb [root@localhost ~]# systemctl enable mariadb //设置开机自启
对数据库进行一些基本设置:
[root@localhost ~]# mysql_secure_installation
初始情况下没有密码,直接回车,它会自动提示你重新设置密码,这时就可以设置自己的数据库密码了。设置完密码之后是一些其他的基本设置,都是直接'y'或者'n'就能解决的,对照着它给出的提示就可以完成设置。然后设置字符集,字符集的设置在/etc下:
[root@localhost ~]# vim /etc/my.cnf #在[mysqld]标签下添加如下内容: default-storage-engine = innodb innodb_file_per_table max_connections = 4096 collation-server = utf8_general_ci character-set-server = utf8 [root@localhost ~]# vim /etc/my.cnf.d/client.cnf #在[client]标签下添加如下内容: default-character-set=utf8 [root@localhost ~]# vim /etc/my.cnf.d/mysql-clients.cnf #在[mysql]标签下添加如下内容: default-character-set=utf8
接着重启服务:
[root@localhost ~]# systemctl restart mariadb
此时就大概完成了数据库的安装和设置。因为要将该数据库做完LDAP的后端数据库,所以先新建一个用户ldap和数据库ldap作为连接LDAP的数据库:
[root@localhost ~]# mysql -uroot -p
添加ldap用户,设置密码为ldap,添加权限给ldap用户并新建数据库ldap:
MariaDB [(none)]> CREATE USER 'ldap'@'%' IDENTIFIED BY 'ldap'; MariaDB [(none)]> GRANT ALL PRIVILEGES ON ldap.* TO 'ldap'@'%'; MariaDB [(none)]> CREATE USER 'ldap'@'localhost' IDENTIFIED BY 'ldap'; MariaDB [(none)]> GRANT ALL PRIVILEGES ON ldap.* TO 'ldap'@'localhost'; MariaDB [(none)]> show databases;
然后退出数据库,进行第二步。
2.安装ODBC并配置ldap数据库
直接yum安装:
[root@localhost ~]# yum install unixODBC mysql-connector-odbc
创建连接配置文件odbc.ini:
[root@localhost ~]# vim /etc/odbc.ini #添加如下内容 [ldap] Description = LdapToMysql Driver = MySQL Database = ldap Server = 127.0.0.1 User = ldap Password = ldap Port = 3306
验证是否连接成功:
[root@localhost ~]# isql -v ldap
进入如下界面:
输入查看数据库的命令:
SQL> show databases;
连接成功!
3.下载安装并配置OpenLDAP
安装LDAP到/opt目录下:
[root@localhost ~]# yum install wget make gcc mysql-devel unixODBC-devel groff -y [root@localhost ~]# cd /opt [root@localhost opt]# wget ftp://mirror.switch.ch/mirror/OpenLDAP/openldap-release/openldap-2.4.43.tgz [root@localhost opt]# tar zxvf openldap-*.tgz [root@localhost opt]# rm -rf openldap-*.tgz [root@localhost opt]# mv openldap-* openldap [root@localhost opt]# cd /opt/openldap [root@localhost openldap]# ./configure --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --localstatedir=/var --mandir=/usr/share/man --infodir=/usr/share/info --enable-sql --disable-bdb --disable-ndb --disable-hdb [root@localhost openldap]# make depend [root@localhost openldap]# make [root@localhost openldap]# make install
此时安装已经完成,接着配置LDAP,首先生成自己的LDAP密码:
[root@localhost openldap]# slappasswd
输入密码之后它会返回给一个加密的密码,类似于“{SSHA}XDEtT6s3MTzrSbHeJl7OlRoqk0w1By1X”。然后打开LDAP配置文件,该文件在/etc/openldap目录下:
[root@localhost openldap]# vim /etc/openldap/slapd.conf #在第5行下面添加如下内容 include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema #修改第55行内容 database sql #修改第56、57行的dc值(这里最好设置为example,因为后面要用ldap的数据库数据,如果这里使用别的值,那么对应的要把数据库中的所有dn都改掉) suffix "dc=example,dc=com" rootdn "cn=Manager,dc=example,dc=com" #修改第61行rootpw的值,就是之前获取到的加密密码 rootpw {SSHA}XDEtT6s3MTzrSbHeJl7OlRoqk0w1By1X #注释掉第65、67行的内容 #directory /var/openldap-data #index objectClass eq #在第61行rootpw下面添加如下内容 rootpw {SSHA}XDEtT6s3MTzrSbHeJl7OlRoqk0w1By1X dbname ldap dbuser ldap dbpasswd ldap has_ldapinfo_dn_ru no subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)"
关于dc(domainComponent)的问题,在https://www.bbsmax.com/A/WpdKKPaodV/这篇文章里面讲解的很好,我的安装配置也是从这里学的。
到此,OpenLDAP的安装与配置完成,但此时还不能运行LDAP,因为数据库中没有对应的表结构,LDAP虽然可以使用除BDB之外的数据库,但必须要使用它定义的表结构。对应的表结构在/opt/openldap/servers/slapd/back-sql/rdbms_depend/目录下,该目录下有多种数据库的表结构,包括MySQL、Oracle和PGSQL等,进入mysql目录下,有如下几个sql文件:
backsql_create.sql是基础的表结构,不论其它表有没有,这几个表必须有;testdb_create.sql是测试的表结构,包含几个像person表之类的表结构;testdb_data.sql是测试表中的数据;testdb_metadata.sql是基础表中的数据。进入数据库中执行这几个sql文件:
[root@localhost ~]# mysql -uldap -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 8 Server version: 5.5.52-MariaDB MariaDB Server Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> use ldap MariaDB [ldap]> source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/backsql_create.sql MariaDB [ldap]> source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/testdb_create.sql MariaDB [ldap]> source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/testdb_data.sql MariaDB [ldap]> source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/testdb_metadata.sql
此时运行LDAP:
[root@localhost ~]# /opt/openldap/servers/slapd/slapd -d 5 -h 'ldap:/// ldapi:///' -f /etc/openldap/slapd.conf &
4.安装和配置LDAP管理工具PHPldapadmin
首先安装Apache和PHP:
[root@localhost ~]# yum -y install httpd php php-ldap php-gd php-mbstring php-pear php-bcmath php-xml
然后安装phpldapadmin:
[root@localhost ~]# yum -y install epel-release [root@localhost ~]# yum --enablerepo=epel -y install phpldapadmin
接着修改配置文件:
[root@localhost ~]# vim /etc/phpldapadmin/config.php #397行取消注释,398行添加注释 $servers->setValue('login','attr','dn'); // $servers->setValue('login','attr','uid'); [root@localhost ~]# vim /etc/httpd/conf.d/phpldapadmin.conf // 修改配置 <IfModule mod_authz_core.c> # Apache 2.4 Require local #添加一行内容,指定可访问的ip段(虽然我也不知道为什么,但不填不能运行这个管理工具,我就直接写的本地ip) Require ip 192.168.85.132 </IfModule>
设置开机自启并启动Apache:
[root@localhost ~]# systemctl enable httpd [root@localhost ~]# systemctl start httpd
此时phpldapadmin可以访问但可能不能登录,这个和系统SELinux有关,如果SELinux关闭的话登录时候会有一个错误:
error Unable to connect to LDAP server Cloud-Lab.Com error: Can't contact LDAP server (-1) for user error Failed to Authenticate to server Invalid Username or Password.
打开这个配置:
[root@localhost ~]# getsebool httpd_can_connect_ldap httpd_can_connect_ldap --> off [root@localhost ~]# setsebool -P httpd_can_connect_ldap on [root@localhost ~]# getsebool httpd_can_connect_ldap httpd_can_connect_ldap --> on
浏览器访问phpldapadmin:
http://(localhost或服务器地址)/phpldapadmin/
登录phpldapadmin,用户名密码可以在数据库ldap的表persons中查找。