實驗環(huán)境：
操作系統(tǒng)：Centos 7.4
服務(wù)器ip:192.168.3.41
運行用戶：root
網(wǎng)絡(luò)環(huán)境：Internet
LDAP（輕量級目錄訪問協(xié)議）是一個能實現(xiàn)提供被稱為目錄服務(wù)的信息服務(wù)，也是一套用戶認證體系系統(tǒng)章贞；一般在大型企業(yè)祥绞、學(xué)校、政府單位使用的比較多鸭限，LDAP是由4部分組成蜕径，這4部分分別是slapd(獨立LDAP守護進程)、slurpd(獨立的LDAP更新復(fù)制守護進程)败京、LDAP協(xié)議庫兜喻、工具軟件和示例客戶端(phpLDAPadmin)，目錄服務(wù)是一種特殊的數(shù)據(jù)庫系統(tǒng)赡麦，用來存儲用戶信息的數(shù)據(jù)庫朴皆，讀寫速度非撑潦叮快，擴展性非常強遂铡，可以實現(xiàn)與地方系統(tǒng)直接對接整合起來統(tǒng)一管理用戶信息肮疗。
LDAP說起來也不簡單，但是ALDP在Linux應(yīng)用范圍是比較廣泛的扒接，如果想要深入的了解LDAP伪货，建議去看下劉遄老師《Linux就該這么學(xué)》這本教程，里面解釋的非常詳細钾怔，也可以在百度輸入此書名去官網(wǎng)看超歌，想要在Linux部署還是推薦這本書去系統(tǒng)的學(xué)習(xí)，對初學(xué)者還是很有版本的蒂教，這篇文章搭建ldap+phpldapadmin也是在Linux環(huán)境下運行的巍举，所以還是需要Linux基礎(chǔ)才能看懂下面的配置步驟。
1凝垛、安裝OpenLDAP
[root@centos7 ~]# yum install openldap-servers openldap-clients -y
[root@centos7 ~]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@centos7 ~]# ll /var/lib/ldap/DB_CONFIG
-rw-r--r--. 1 root root 845 Aug? 1 10:04 /var/lib/ldap/DB_CONFIG
[root@centos7 ~]# chown ldap. /var/lib/ldap/DB_CONFIG //授權(quán)配置文件
[root@centos7 ~]# more /etc/passwd|grep ldap
ldap:x:55:55:OpenLDAP server:/var/lib/ldap:/sbin/nologin
[root@centos7 ~]# systemctl start slapd.service //啟動slapd服務(wù)
[root@centos7 ~]# systemctl enable slapd.service //設(shè)置開機自動啟動slapd服務(wù)
2懊悯、設(shè)置OpenLDAP管理員密碼
[root@centos7 ~]# slappasswd
New password:? //password
Re-enter new password:
{SSHA}d5pkA0TU6b+8/kEoMIxJ59QofCLV
為“olcRootPW”指定上面生成的密碼
[root@centos7 ~]# vim chrootpw.ldif
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}d5pkA0TU6b+8/kEokgQeMIxJ59QofCLV
[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"
3、導(dǎo)入基本模式
[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"
[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"
[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"
4梦皮、在LDAP DB上設(shè)置域名炭分，生成目錄管理器密碼
[root@centos7 ~]# slappasswd
New password:
Re-enter new password:
{SSHA}Oq61fgUFW9+ItZboTaW1+VbLuAYst7zw
注意：下面配置文件這里得注意每一個屬性：?后必須有空格，但是值的后面不能有任何空格
[root@centos7 ~]# vim chdomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
? read by dn.base="cn=Manager,dc=srv,dc=world" read by * none
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=srv,dc=world
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=srv,dc=world
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}Oq61fgUFW9+ItZboTaW1+VbLuAYst7zw
dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
? dn="cn=Manager,dc=srv,dc=world" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=srv,dc=world" write by * read
[root@centos7 ~]# ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}monitor,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
modifying entry "olcDatabase={2}hdb,cn=config"
[root@centos7 ~]# vim basedomain.ldif
# replace to your own domain name for "dc=***,dc=***" section
dn: dc=srv,dc=world
objectClass: top
objectClass: dcObject
objectclass: organization
o: Server World
dc: Srv
dn: cn=Manager,dc=srv,dc=world
objectClass: organizationalRole
cn: Manager
description: Directory Manager
dn: ou=People,dc=srv,dc=world
objectClass: organizationalUnit
ou: People
dn: ou=Group,dc=srv,dc=world
objectClass: organizationalUnit
ou: Group
[root@centos7 ~]# ldapadd -x -D "cn=Manager,dc=srv,dc=world" -W -f basedomain.ldif
Enter LDAP Password:? ? //輸入上面設(shè)置的目錄管理器密碼 password
adding new entry "dc=srv,dc=world"
adding new entry "cn=Manager,dc=srv,dc=world"
adding new entry "ou=People,dc=srv,dc=world"
adding new entry "ou=Group,dc=srv,dc=world"
[root@centos7 ~]# ldapsearch -x -b "cn=Manager,dc=srv,dc=world"
# extended LDIF
#
# LDAPv3
# base <cn=Manager,dc=srv,dc=world> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# Manager, srv.world
dn: cn=Manager,dc=srv,dc=world
objectClass: organizationalRole
cn: Manager
description: Directory Manager
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
5剑肯、設(shè)置Firewalld捧毛，如果未啟用防火墻關(guān)閉，忽略
[root@centos7 ~]# firewall-cmd --add-service=ldap --permanent
[root@centos7 ~]# firewall-cmd --reload
6让网、安裝并配置Apache
[root@centos7 ~]# yum install httpd-devel.x86_64 httpd.x86_64 -y
[root@centos7 ~]# mv /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.d/welcome.conf.bak
[root@centos7 ~]# vim /etc/httpd/conf/httpd.conf
# line 86: change to admin's email address
ServerAdmin root@srv.world
# line 95: change to your server's name
ServerName www.srv.world:80
# line 151: change
AllowOverride All
# line 164: add file name that it can access only with directory's name
DirectoryIndex index.html index.cgi index.php
# add follows to the end? //在尾部新增
# server's response header
ServerTokens Prod
# keepalive is ON
KeepAlive On
[root@centos7 ~]# systemctl start httpd.service
[root@centos7 ~]# systemctl enable httpd.service
[root@centos7 ~]# firewall-cmd --add-service=http --permanent //防火墻排除httpd服務(wù)呀忧，如果沒有啟用防火墻，此步驟可以忽略溃睹。
success
[root@centos7 ~]# firewall-cmd --reload //重新加載firewall
success
[root@centos7 ~]# vim /var/www/html/index.html //測試apache服務(wù)
<html>
<body>
<div style="width: 100%; font-size: 40px; font-weight: bold; text-align: center;">
Test Page
</div>
</body>
</html>
測試：http://192.168.3.41/index.html
7而账、安裝PHP
[root@centos7 ~]# yum -y install php php-mbstring php-pear
[root@centos7 ~]# vim /etc/php.ini
#修改時區(qū)? 878行
date.timezone = Asia/Shanghai
[root@centos7 ~]# systemctl restart httpd.service
[root@centos7 ~]# vim /var/www/html/index.php
<html>
<body>
<div style="width: 100%; font-size: 40px; font-weight: bold; text-align: center;">
<?php
? print Date("Y/m/d");
?>
</div>
</body>
</html>
php打印日期
測試：http://192.168.3.41/index.php
可以不安裝phpLDAPadmin工具，直接下載Windows系統(tǒng)下的LdapAdmin應(yīng)用程序
8因篇、安裝phpLDAPadmin
[root@centos7 ~]# yum install phpldapadmin.noarch -y
[root@centos7 ~]# vim /etc/phpldapadmin/config.php
397? $servers->setValue('login','attr','dn');? #取消397行注釋
398 //$servers->setValue('login','attr','uid');? #注釋398
[root@centos7 ~]# vim /etc/httpd/conf.d/phpldapadmin.conf
#
#? Web-based tool for managing LDAP servers
#
Alias /phpldapadmin /usr/share/phpldapadmin/htdocs
Alias /ldapadmin /usr/share/phpldapadmin/htdocs
<Directory /usr/share/phpldapadmin/htdocs>
? <IfModule mod_authz_core.c>
? ? # Apache 2.4
? ? #只允許本地請求訪問
? ? # Require local
? ? #允許所有的請求訪問
? ? ? Require all granted
? ? ? #允許IP段訪問
? ? ? #Require ip 10.0.0.0/24? ? ? ? ?
? </IfModule>
? <IfModule !mod_authz_core.c>
? ? # Apache 2.2
? ? Order Deny,Allow
? ? Deny from all
? ? Allow from 127.0.0.1
? ? Allow from ::1
? </IfModule>
</Directory>
[root@centos7 ~]# systemctl restart httpd.service
[root@centos7 ~]# systemctl status httpd.service
測試：http://192.168.3.41/ldapadmin/
如果是按照上面配置執(zhí)行的操作泞辐，登錄一直提示失敗，需要執(zhí)行
[root@centos7 ~]# setsebool -P httpd_can_connect_ldap on
cn=Manager,dc=srv,dc=world
9竞滓、基本操作和使用
9.1咐吼、添加組
9.2、添加用戶
9.3商佑、phpldapadmin的網(wǎng)站的apache配置文件
# vim /etc/httpd/conf.d/phpldapadmin.conf
#
#? Web-based tool for managing LDAP servers
#
Alias /phpldapadmin /usr/share/phpldapadmin/htdocs
Alias /ldapadmin /usr/share/phpldapadmin/htdocs
#注意：/usr/share/phpldapadmin/htdocs? 是phpldapadmin根目錄
<Directory /usr/share/phpldapadmin/htdocs>
? <IfModule mod_authz_core.c>
? ? # Apache 2.4
? ? #只允許本地請求訪問
? ? # Require local
? ? #允許所有的請求訪問
? ? Require all granted
? ? ? #允許IP段訪問
? ? ? #Require ip 192.168.3.0/24? ? ? ?
? </IfModule>
? <IfModule !mod_authz_core.c>
? ? # Apache 2.2
? ? Order Deny,Allow
? ? Deny from all
? ? Allow from 127.0.0.1
? ? Allow from ::1
? </IfModule>
</Directory>
這里可以直接訪問phpldapadmin后臺锯茄，最好是通過apache做密碼驗證才能登錄，這樣比較安全莉御。
參考文獻：httpd配置認證才能訪問網(wǎng)站（原創(chuàng)實踐操作）.note
10撇吞、禁止匿名用戶登錄
# vim /root/ldap_disable_bind_anon.ldif
angetype: modify
add: olcDisallows
olcDisallows: bind_anon
dn: cn=config
changetype: modify
add: olcRequires
olcRequires: authc
dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcRequires
olcRequires: authc
[root@centos7 ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f ldap_disable_bind_anon.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
modifying entry "olcDatabase={-1}frontend,cn=config"
[root@centos7 ~]# systemctl restart slapd.service
