This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
авторизация_с_использованием_ldap_сервера [2021/03/11 10:27] val [Microsoft Active Directory] |
авторизация_с_использованием_ldap_сервера [2024/01/26 13:06] (current) val [Установка сертификатов] |
||
---|---|---|---|
Line 3: | Line 3: | ||
===== Установка LDAP клиента ===== | ===== Установка LDAP клиента ===== | ||
- | !!! Не требуется для nss_ldap, удобен для отладки | + | * !!! Не требуется для nss_ldap, удобен для отладки |
==== Debian/Ubuntu ==== | ==== Debian/Ubuntu ==== | ||
Line 26: | Line 26: | ||
* Права на чтение атрибутов LDAP ([[http://support.microsoft.com/kb/976063]]) | * Права на чтение атрибутов LDAP ([[http://support.microsoft.com/kb/976063]]) | ||
+ | * [[https://ldap.com/dns-srv-records-for-ldap/|DNS SRV Records for LDAP]] | ||
<code> | <code> | ||
- | gate# ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -h server -b "dc=corpX,dc=un" "sAMAccountName=user1" | + | gate# ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -H ldap://server -b "dc=corpX,dc=un" "sAMAccountName=user1" |
или через ldaps: | или через ldaps: | ||
Line 36: | Line 37: | ||
или с Kerberos GSSAPI аутентификацией | или с Kerberos GSSAPI аутентификацией | ||
- | # apt install libsasl2-modules-gssapi-mit | + | gate# apt install libsasl2-modules-gssapi-mit |
- | # kinit Administrator | + | gate# kinit Administrator |
- | # ldapsearch -h server -b "dc=corpX,dc=un" "sAMAccountName=user1" | + | gate# ldapsearch -h server -b "dc=corpX,dc=un" "sAMAccountName=user1" |
</code><code> | </code><code> | ||
... | ... | ||
Line 48: | Line 49: | ||
... | ... | ||
</code><code> | </code><code> | ||
- | # ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -h server -b "dc=corpX,dc=un" "sAMAccountName=guser1" | + | # ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -H ldap://server -b "dc=corpX,dc=un" "sAMAccountName=guser1" |
</code><code> | </code><code> | ||
... | ... | ||
Line 59: | Line 60: | ||
==== Debian/Ubuntu ==== | ==== Debian/Ubuntu ==== | ||
<code> | <code> | ||
- | root@gate:~# apt install libnss-ldap | + | root@gate:~# DEBIAN_FRONTEND=noninteractive apt install libnss-ldap |
</code><code> | </code><code> | ||
... | ... | ||
Line 161: | Line 162: | ||
debian# service nscd restart && service nscd reload | debian# service nscd restart && service nscd reload | ||
- | # getent passwd | + | # getent passwd user1 |
# id user1 | # id user1 | ||
Line 168: | Line 169: | ||
===== Установка сертификатов ===== | ===== Установка сертификатов ===== | ||
- | ==== FreeBSD ==== | + | * [[Пакет OpenSSL#Импорт сертификата центра сертификации]] |
<code> | <code> | ||
- | # setenv LDAPTLS_REQCERT never | + | # export LDAPTLS_REQCERT=never |
- | или | + | |
- | # pkg install ca_root_nss | + | |
- | # setenv LDAPTLS_CACERT /usr/local/etc/ssl/cert.pem | + | |
</code> | </code> | ||
- | ==== Linux ==== | + | |
+ | ===== Дополнительные материалы ===== | ||
+ | |||
+ | ==== Изменения в Debian 12 ==== | ||
<code> | <code> | ||
- | # export LDAPTLS_REQCERT=never | + | debian12# apt install libnss-ldapd |
+ | |||
+ | debian12# grep "^[^#]" /etc/nslcd.conf | ||
+ | uid nslcd | ||
+ | gid nslcd | ||
+ | uri ldap://server/ | ||
+ | base dc=corp20,dc=un | ||
+ | tls_cacertfile /etc/ssl/certs/ca-certificates.crt | ||
+ | |||
+ | service nslcd restart | ||
+ | |||
+ | gate# chown -R user1:user1 /home/user1 | ||
+ | gate# chown -R user2:user2 /home/user2 | ||
</code> | </code> |