OpenLdap配置mysql作为后台数据库&phpldapadmin搭建

一、安装依赖包

yum -y install unixODBC.x86_64 unixODBC-devel.x86_64 libdbi-devel.x86_64 libdbi.x86_64 libdbi-dbd-mysql.x86_64 openssl openssl-devel

二、安装mysql

1. 下载和安裝mysql源

//下载源
wget https://repo.mysql.com//mysql80-community-release-el7-1.noarch.rpm
//安装源
yum -y localinstall mysql80-community-release-el7-1.noarch.rpm

1. 在线安装Mysql

yum -y install mysql-community-server

1. 启动Mysql

//启动mysql服务
systemctl start mysqld
//查看进程
ps -ef |grep mysql
//设置开机自启动
systemctl enable mysqld

1. 修改root登录密码，设置Mysql可远程访问
   mysql安裝完成之後，在/var/log/mysqld.log文件中給root生成了一个临时的默认密码，用grep命令搜一下

   grep -R "password" /var/log/mysqld.log
   //2019-08-14T07:15:07.717147Z 5 [Note] [MY-010454] [Server] A temporary password is generated for root@localhost: yourpassword

   通过root临时密码进入数据库：

   mysql -u root -p yourpassword

   修改密码：

   alter user 'root'@'localhost' identified by 'newpassword';

   开启远程访问：

   update mysql.user set host='%' where user='root';
   flush privileges;

2. 创建openldap所需的mysql数据库

   mysql> create database ldap;
   mysql> CREATE USER 'ldap'@'%' IDENTIFIED BY 'ldap';
   mysql> GRANT ALL PRIVILEGES ON ldap.* TO 'ldap'@'%';
   //查看创建的数据库
   mysql> show databases;

三、安装配置ODBC驱动

1. 安装 ODBC

yum install unixODBC mysql-connector-odbc

1. 配置ODBC
   打开配置文件

vim /etc/odbc.ini

//添加如下内容：
[ldap]
Description = LdapToMysql
Driver = MySQL
Database = ldap
Server = localhost
User = ldap
Password = ldap
Port = 3306
charset = UTF8

vim /etc/odbcinst.ini

//内容如下：
[PostgreSQL]
Description=ODBC for PostgreSQL
Driver=/usr/lib/psqlodbcw.so
Setup=/usr/lib/libodbcpsqlS.so
Driver64=/usr/lib64/psqlodbcw.so
Setup64=/usr/lib64/libodbcpsqlS.so
FileUsage=1

[MySQL]
Description=ODBC for MySQL
Driver=/usr/lib64/libmyodbc8w.so
Setup=/usr/libi64/libodbcmyS.so
Driver64=/usr/lib64/libmyodbc8a.so
Setup64=/usr/lib64/libodbcmyS.so
FileUsage=1

[MySQL ODBC 8.0 Unicode Driver]
Driver=/usr/lib64/libmyodbc8w.so
UsageCount=1

[MySQL ODBC 8.0 ANSI Driver]
Driver=/usr/lib64/libmyodbc8a.so
UsageCount=1

1. 验证是否连接成功

isql -v ldap

连接成功页面如下：

四、安装openldap

使用yum安装过程更方便，但不带slapd.conf配置，后续配置较麻烦，因此选择离线编译安装：

1. 安装 LDAP 到/opt 目录下：

1、cd /opt
2、wget ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.4.47.tgz
3、tar zxvf openldap-*.tgz
4、mv openldap-2.4.47 openldap
5、cd /opt/openldap
6、./configure --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc
--datadir=/usr/share --localstatedir=/var --mandir=/usr/share/man --infodir=/usr/share/info
--enable-sql --disable-bdb --disable-ndb --disable-hdb
7、make depend
8、make
9、make install

1. 生成ldap账户密码

slappasswd
//返回“{SSHA}XDEtT6s3MTzrSbHeJl7OlRoqk0w1By1X”

1. 修改ldap配置文件

vim /etc/openldap/slapd.conf
//内容：
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include		/etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

pidfile		/var/run/slapd.pid
argsfile	/var/run/slapd.args

# Load dynamic backend modules:
# modulepath	/usr/libexec/openldap
# moduleload	back_mdb.la
# moduleload	back_ldap.la

# Sample security restrictions
#	Require integrity protection (prevent hijacking)
#	Require 112-bit (3DES or better) encryption for updates
#	Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#	Root DSE: allow anyone to read it
#	Subschema (sub)entry DSE: allow anyone to read it
#	Other DSEs:
#		Allow self write access
#		Allow authenticated users read access
#		Allow anonymous users to authenticate
#	Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#	by self write
#	by users read
#	by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

#######################################################################
# MDB database definitions
#######################################################################

database	sql
#maxsize		1073741824
suffix		"dc=example,dc=com"
rootdn		"cn=Manager,dc=example,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw		{SSHA}7SRnkG7G0epO/p+3BdGrmc3gflJiY6A4
dbname ldap
dbuser ldap
dbpasswd ldap
has_ldapinfo_dn_ru no
subtree_cond "ldap_entries.dn LIKE CONCAT('%',?)"
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
#directory	/var/openldap-data
# Indices to maintain
#index	objectClass	eq

1. 为ldap后台数据库添加对应表结构：
   对应的表结构在/opt/openldap/servers/slapd/back-sql/rdbms_depend/目录下

cd /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql

导入表结构：

[root@localhost ~]# mysql -u ldap -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 32
Server version: 8.0.17 MySQL Community Server - GPL

Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> use ldap
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed

mysql> source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/backsql_create.sql
mysql> source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/testdb_create.sql
mysql> source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/testdb_data.sql
mysql>source /opt/openldap/servers/slapd/back-sql/rdbms_depend/mysql/testdb_metadata.sql

1. 运行ldap：

/opt/openldap/servers/slapd/slapd -d 5 -h 'ldap:/// ldapi:///' -f /etc/openldap/slapd.conf &

五、安装和配置 LDAP 管理工具 PHPldapadmin

1. 安装 Apache 和 PHP：

yum -y install httpd php php-ldap php-gd php-mbstring php-pear php-bcmath php-xml

1. 安装 phpldapadmin：

yum --enablerepo=epel -y install phpldapadmin

1. 修改配置文件：

1、vim /etc/phpldapadmin/config.php
//397 行取消注释，398 行添加注释
$servers->setValue('login','attr','dn');
// $servers->setValue('login','attr','uid');

2、vim /etc/httpd/conf.d/phpldapadmin.conf
// 修改配置
<IfModule mod_authz_core.c>
# Apache 2.4
Require local
Require ip 10.X.X.X   //添加远程访问主机ip
</IfModule>

1. 设置开机自启并启动 Apache：

systemctl enable httpd
systemctl start httpd

1. 访问PHPldapadmin：
   在浏览器输入：http://your-serverip/phpldapadmin/ 访问PHPldapadmin

用户名：cn=Manager,dc=example,dc=com
密码：yourpassword

登录页面：

• 点赞
• 收藏
• 分享
• 文章举报