LDAP基础安装与简单入门使用.md

WeiyiGeek.

WeiyiGeek.

PHPLdapAdmin

描述:phpLDAPadmin（也称为PLA）是一个基于Web的LDAP客户端。它为LDAP服务器提供简单，随处可访问的多语言管理。phpLDAPadmin是LDAP专业人员和新手的完美LDAP浏览器。其分层树查看器和高级搜索功能使您可以直观地浏览和管理LDAP目录。由于它是一个Web应用程序，因此该LDAP浏览器可在许多平台上运行，使您可以从任何位置轻松管理LDAP服务器。

官网：http://phpldapadmin.sourceforge.net/wiki/index.php/Main_Page

比如采用Docker进行安装:`如果开启HTTPS，需要配置443端口映射：-p 8443:443，并采用https访问

docker run -d --privileged -p 10004:80 --name phpldapadmin --env PHPLDAPADMIN_HTTPS=false --env PHPLDAPADMIN_LDAP_HOSTS=172.17.0.6 --detach osixia/phpldapadmin

基础配置 Step1. 访问phpldapAdmin打开浏览器访问：http://192.168.172.245:6080

账号：cn=admin,dc=weiyigeek,dc=top
密码：weiyigeek

WeiyiGeek.

Step2.登录phpLdapAdmin添加组以及ldap账号流程步骤如下:

Step3.采用创建的账号进行登陆LDAP;

DN:cn=WeiyiGeek,ou=Development,dc=weiyigeek,dc=com,dc=cn
密码:123456

WeiyiGeek.

LDAPAdmin

描述:Ldap Admin是一个用于LDAP目录管理的免费Windows LDAP客户端和管理工具。此应用程序允许您在LDAP服务器上浏览，搜索，修改，创建和删除对象。它还支持更复杂的操作，例如目录复制和在远程服务器之间移动，并扩展常用编辑功能以支持特定对象类型（例如组和帐户）, 支持多类型系统：Winndows&Linux 官网：http://www.ldapadmin.org/

下载安装LDAP Admin客户端，新增连接如下：

WeiyiGeek.

Apache Directory Studio

描述: 设计用来和各种LDAP服务器进行交互操作，提供了一个使用方便的客户端操作平台。除了Apache DS之外，诸如OpenLdap也可以很好地进行交互，对于不习惯不喜欢命令行方式的用户，Apache Directory Studio也是选择之一。

官方网址：http://directory.apache.org/studio/ 支持OS：跨平台，支持MacOS/Windows/Linux 下载地址：http://directory.apache.org/studio/downloads.html

WeiyiGeek.

导入与导出

WeiyiGeek.

入坑解决:

Migrationtools

描述:采用migrationtools工具包，实现导入系统账号的相关信息;

#下载工具包
yum -y install migrationtools

#修改migrationtools的配置文件
vim /usr/share/migrationtools/migrate_common.ph 
70 # Default DNS domain
71 $DEFAULT_MAIL_DOMAIN = "weiyigeek.top";
72
73 # Default base
74 $DEFAULT_BASE = "dc=WeiyiGeek,dc=com,dc=cn";

#生成基础的数据文件(可以根据需求把不需要的去掉)
/usr/share/migrationtools/migrate_base.pl > base.ldif
$more base.ldif
# dn: dc=WeiyiGeek,dc=com,dc=cn
# dc: WeiyiGeek
# objectClass: top
# objectClass: domain

# dn: ou=Hosts,dc=WeiyiGeek,dc=com,dc=cn
# ou: Hosts
# objectClass: top
# objectClass: organizationalUnit


#把base.ldif导入OpenLDAP的数据文件(-c 强制导入)
$ldapadd -x -c -H ldap://127.0.0.1 -D "cn=admin,dc=WeiyiGeek,dc=com,dc=cn" -w WeiyiGeek -f /root/base.ldif
# adding new entry "dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "ou=Hosts,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "ou=Rpc,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "ou=Services,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "nisMapName=netgroup.byuser,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "ou=Mounts,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "ou=Networks,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "ou=People,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "ou=Group,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "ou=Netgroup,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "ou=Protocols,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "ou=Aliases,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "nisMapName=netgroup.byhost,dc=WeiyiGeek,dc=com,dc=cn"

WeiyiGeek.导入系统账号的相关信息

创建两个测试用户及用户组，并修改密码

groupadd ldaptest1
groupadd ldaptest2
useradd -g ldaptest1 ldaptest1
useradd -g ldaptest2 ldaptest2
echo 123456 | passwd --stdin ldaptest1
echo password | passwd --stdin ldaptest2

将刚创建的两个用户导入至openldap数据文件

grep ldaptest /etc/passwd > users
grep ldaptest /etc/group > groups

$cat users groups
ldaptest1:x:1001:1001::/home/ldaptest1:/bin/bash
ldaptest2:x:1002:1002::/home/ldaptest2:/bin/bash
ldaptest1:x:1001:
ldaptest2:x:1002:

使用migrationtools将两个临时用户生成ldif文件

/usr/share/migrationtools/migrate_passwd.pl users > users.ldif
cat users.ldif
# dn: uid=ldaptest1,ou=People,dc=WeiyiGeek,dc=com,dc=cn
# uid: ldaptest1
# cn: ldaptest1
# objectClass: account
# objectClass: posixAccount
# objectClass: top
# objectClass: shadowAccount
# userPassword: {crypt}$6$Rr.3Z1X8$fmyCvoFFaTw74GVO.G3okx765i3K2CUaEK/Uu0cyNc8/Xn2HHM1DelVM3nmgDNsQWEZGpLCNUtp.faXvspiff1
# shadowLastChange: 18363
# shadowMin: 0
# shadowMax: 99999
# shadowWarning: 7
# loginShell: /bin/bash
# uidNumber: 1001
# gidNumber: 1001
# homeDirectory: /home/ldaptest1

/usr/share/migrationtools/migrate_group.pl groups > groups.ldif
cat groups.ldif
# dn: cn=ldaptest1,ou=Group,dc=WeiyiGeek,dc=com,dc=cn
# objectClass: posixGroup
# objectClass: top
# cn: ldaptest1
# userPassword: {crypt}x
# gidNumber: 1001

4.把用户导入至openLDAP的数据文件并查询导入的数据

ldapadd -x -H ldap://127.0.0.1 -D "cn=admin,dc=WeiyiGeek,dc=com,dc=cn" -w WeiyiGeek -f users.ldif
# adding new entry "uid=ldaptest1,ou=People,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "uid=ldaptest2,ou=People,dc=WeiyiGeek,dc=com,dc=cn"

ldapadd -x -H ldap://127.0.0.1 -D "cn=admin,dc=WeiyiGeek,dc=com,dc=cn" -w WeiyiGeek -f groups.ldif
# adding new entry "cn=ldaptest1,ou=Group,dc=WeiyiGeek,dc=com,dc=cn"
# adding new entry "cn=ldaptest2,ou=Group,dc=WeiyiGeek,dc=com,dc=cn"

WeiyiGeek.

JNDI方式

描述:我们可以使用Java中使用javax.naming可以对Ldap用户信息进行验证，使用这点可以完成SSO之类功能的集成;

简单的基础示例:

//登陆与验证LDAP
package top.weiyigeek.other;

import java.util.Enumeration;
import java.util.Hashtable;

import javax.naming.Binding;
import javax.naming.Context;
import javax.naming.NameClassPair;
import javax.naming.NamingEnumeration;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;

/**
 * @Descr 使用Javax.naming验证LDAP登录
 * @author WeiyiGeek
 * javac ldaptest.java
 * java ldaptest
 */
public class LDAPDemo {
    public static void main(String[] args) {
        String IP = "10.10.107.245";
        String PORT = "389";
        String BASEDN = "dc=WeiyiGeek,dc=com,dc=cn";
        String MANAGER = "cn=admin";
        String PASS = "WeiyiGeek";
        String USERNAME = "cn=WeiyiGeek,ou=Development";
        String LDAP_URL = "ldap://"+IP+":"+PORT+"/"+BASEDN;
        String[] attrIDs = {"mail","displayName","uidNumber","sn" };
        
        //基于哈希表实现的是线程安全的，能用于多线程环境中
        Hashtable<String, String> tbl = new Hashtable<String, String>();
        
        //JNDI 
        //为初始化上下文选择服务提供者
        tbl.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
        //提供初始化上下文需要的信息
        tbl.put(Context.PROVIDER_URL, LDAP_URL);
        tbl.put(Context.SECURITY_AUTHENTICATION, "simple");
        tbl.put(Context.SECURITY_PRINCIPAL, MANAGER+","+BASEDN);
        tbl.put(Context.SECURITY_CREDENTIALS, PASS);
        
        System.out.println("--------------Show Env Setting --------------");
        Enumeration<String> keys = tbl.keys();
        while(keys.hasMoreElements()) {
            System.out.println(tbl.get(keys.nextElement()));
        }
        System.out.println("");
        System.out.println("--------------Login Verification LDAP    ---------- ");
        
        
        //上下文对象
        DirContext context = null;
        try {
            //创建初始化上下文
            context = new InitialDirContext(tbl);
            System.out.println("Login Successful! 登录成功");
            System.out.println("Login Verification LDAP 
");
            
            //举上下文有两个方法
            System.out.println("-------------- 枚举 查询对象 ---------- ");
            //方式1:
//            NamingEnumeration list = context.list("ou=Development");  //指定对象
//            while (list.hasMore()) {
//                NameClassPair nc = (NameClassPair)list.next();
//                System.out.println(nc);
//            }
            
            //方式2:
            NamingEnumeration<?> bindings = context.listBindings(""); //不指定对象则显示全部
            while (bindings.hasMore()) {
                Binding bd = (Binding)bindings.next();
                System.out.println(bd.getName() + ": "  + bd.getNameInNamespace() + ": " + bd.getObject() );
            }
            bindings.close();
            
          //对象属性全部读取
            try {
                Attributes answer = context.getAttributes(USERNAME);
                System.out.println("
-----------------获取 "+ USERNAME + " 对象属性-----------------");
                for (NamingEnumeration ae = answer.getAll(); ae.hasMore();) {
                    Attribute attr = (Attribute)ae.next();
                    System.out.print(attr.getID());
                    for (NamingEnumeration e = attr.getAll(); e.hasMore(); System.out.println(" : " + e.next()));
                }
            } catch (Exception e) {
               System.out.println("Read Fail : " + USERNAME + " Object 对象不存在!");
            } 
            
           
          //指定对象属性读取
            try {
                Attributes answer = context.getAttributes(USERNAME, attrIDs);
                System.out.println("
----------------- 获取对象指定属性 -----------------");
                for (NamingEnumeration ae = answer.getAll(); ae.hasMore();) {
                    Attribute attr = (Attribute)ae.next();
                    System.out.print(attr.getID());
                    for (NamingEnumeration e = attr.getAll(); e.hasMore(); System.out.println(" : " + e.next()));
                }
            } catch (Exception e) {
               System.out.println("Read Fail : " + USERNAME + " Object 对象不存在!");
            } 
            
            
        } catch (Exception e) {
            System.out.println("Login failed : " + e.getMessage());
        } finally {
            //销毁context上下文对象
            try {
                if (context != null) {
                    context.close();
                    context = null;
                }
                tbl.clear();
            } catch (Exception e) {
                System.out.println("Exception happened." + e.getMessage());
            }
        }
    }
}

执行结果:

--------------Show Env Setting --------------
ldap://10.10.107.245:389/dc=WeiyiGeek,dc=com,dc=cn
com.sun.jndi.ldap.LdapCtxFactory
cn=admin,dc=WeiyiGeek,dc=com,dc=cn
simple
WeiyiGeek

--------------Login Verification LDAP    ---------- 
Login Successful! 登录成功
Login Verification LDAP 

-------------- 枚举 查询对象 ---------- 
cn=User: cn=User,dc=WeiyiGeek,dc=com,dc=cn: com.sun.jndi.ldap.LdapCtx@5e9f23b4
cn=admin: cn=admin,dc=WeiyiGeek,dc=com,dc=cn: com.sun.jndi.ldap.LdapCtx@4783da3f
ou=Development: ou=Development,dc=WeiyiGeek,dc=com,dc=cn: com.sun.jndi.ldap.LdapCtx@378fd1ac

-----------------获取 cn=WeiyiGeek,ou=Development 对象属性-----------------
sn : WeiyiGeek
userPassword : [B@49097b5d
loginShell : /bin/bash
uidNumber : 1000
gidNumber : 500
displayName : 唯一极客
mail : test@weiyigeek.top
objectClass : inetOrgPerson
 : posixAccount
 : top
uid : weiyigeek
cn :  WeiyiGeek
homeDirectory : /home/users/weiyigeek

----------------- 获取对象指定属性 -----------------
mail : test@weiyigeek.top
displayName : 唯一极客
uidNumber : 1000
sn : WeiyiGeek

其它博主的代码:

package com.example.ldap;
 
import java.util.Hashtable;
import java.util.Random;
 
import javax.naming.AuthenticationException;  
import javax.naming.Context;  
import javax.naming.NamingEnumeration;  
import javax.naming.NamingException;  
import javax.naming.directory.BasicAttribute;  
import javax.naming.directory.BasicAttributes;  
import javax.naming.directory.SearchControls;  
import javax.naming.directory.SearchResult;  
import javax.naming.ldap.Control;  
import javax.naming.ldap.InitialLdapContext;  
import javax.naming.ldap.LdapContext;
 
/**
 * @author monkey
 * @date 2019-06-28
 * @desc ldap demo
 */
public class LDAPAuthentication {  
 
    private final String URL = "ldap://10.0.43.206:389/";
    private final String BASEDN = "ou=people,dc=youedata,dc=com";  // 根据自己情况进行修改
    private final String FACTORY = "com.sun.jndi.ldap.LdapCtxFactory";
    private LdapContext ctx = null;  
    private final Control[] connCtls = null;  
    
    private void LDAP_connect() {  
        Hashtable<String, String> env = new Hashtable<String, String>();  
        env.put(Context.INITIAL_CONTEXT_FACTORY, FACTORY);  
        env.put(Context.PROVIDER_URL, URL + BASEDN);  
        env.put(Context.SECURITY_AUTHENTICATION, "simple");  
            
        String root = "cn=admin,dc=youedata,dc=com";  //根据自己情况修改
        env.put(Context.SECURITY_PRINCIPAL, root);   // 管理员  
        env.put(Context.SECURITY_CREDENTIALS, "youedata520");  // 管理员密码
           
        try {  
            ctx = new InitialLdapContext(env, connCtls);  
            System.out.println( "LDAP_connect连接成功" );
               
        } catch (javax.naming.AuthenticationException e) {  
            System.out.println("连接失败：");  
            e.printStackTrace();  
        } catch (Exception e) {  
            System.out.println("连接出错：");  
            e.printStackTrace();  
        }  
           
    }  
  private void closeContext(){  
    if (ctx != null) {  
    try {  
        ctx.close();  
    }  
    catch (NamingException e) {  
        e.printStackTrace();  
    }  
  
}  
  }  
    private String getUserDN(String uid) {  
        String userDN = "";  
        LDAP_connect();  
        try {  
            SearchControls constraints = new SearchControls();  
            constraints.setSearchScope(SearchControls.SUBTREE_SCOPE);  
              
            NamingEnumeration<SearchResult> en = ctx.search("", "uid=" + uid, constraints);  
              
            if (en == null || !en.hasMoreElements()) {  
                System.out.println("未找到该用户");  
            }  
            // maybe more than one element  
            while (en != null && en.hasMoreElements()) {  
                Object obj = en.nextElement();  
                if (obj instanceof SearchResult) {  
                    SearchResult si = (SearchResult) obj;  
                    userDN += si.getName();  
                    userDN += "," + BASEDN;  
                } else {  
                    System.out.println(obj);  
                }  
            }  
        } catch (Exception e) {  
            System.out.println("查找用户时产生异常。");  
            e.printStackTrace();  
        }  
    
        return userDN;  
    }  
    
    public boolean authenricate(String UID, String password) {  
        boolean valide = false;  
        String userDN = getUserDN(UID);  
    
        try {  
            ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, userDN);  
            ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password);  
            ctx.reconnect(connCtls);  
            System.out.println(userDN + " 验证通过");  
            valide = true;  
        } catch (AuthenticationException e) {  
            System.out.println(userDN + " 验证失败");  
            System.out.println(e.toString());  
            valide = false;  
        } catch (NamingException e) {  
            System.out.println(userDN + " 验证失败");  
            valide = false;  
        }  
        closeContext();  
        return valide;  
    }  
    private  boolean addUser(String usr, String pwd) {  
        
        try {  
            LDAP_connect();  
            BasicAttributes attrsbu = new BasicAttributes();  
            BasicAttribute objclassSet = new BasicAttribute("objectclass");
            //可以和数据库关联，做一个自增，比如mysql存起来
            String str = new Random().nextInt(10000) + "";
            objclassSet.add("inetOrgPerson");  
            objclassSet.add("top");
            objclassSet.add("posixAccount");
            attrsbu.put(objclassSet);
            attrsbu.put("sn", usr);  
            attrsbu.put("cn", usr);  
            attrsbu.put("uid", usr);  
            //邮箱不能重复，不然账号无法登陆
            attrsbu.put("mail", "450416064@QQ.com");
            attrsbu.put("gidNumber", str);
            attrsbu.put("uidNumber", str);
            attrsbu.put("homeDirectory", "/home/account");
 
            attrsbu.put("userPassword", pwd);
            ctx.createSubcontext("uid="+ usr , attrsbu);
 
            System.out.println("======================>" + usr + "添加成功");
            return true;  
        } catch (NamingException ex) {  
           ex.printStackTrace();  
        }  
        closeContext();  
        return false;  
    }   
    public static void main(String[] args) {  
        LDAPAuthentication ldap = new LDAPAuthentication();  
          
        ldap.LDAP_connect();  
   
        ldap.addUser("qq1111","123456");
        if(ldap.authenricate("qq1111", "123456") == true){
            System.out.println( "该用户认证成功" );
        }
    }  
}

Java连接LDAP-JNDI参考: