User Tools
авторизация_с_использованием_ldap_сервера
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
авторизация_с_использованием_ldap_сервера [2021/03/11 10:21] val [Microsoft Active Directory] |
авторизация_с_использованием_ldap_сервера [2025/10/08 09:12] (current) val |
||
|---|---|---|---|
| Line 3: | Line 3: | ||
| ===== Установка LDAP клиента ===== | ===== Установка LDAP клиента ===== | ||
| - | !!! Не требуется для nss_ldap, удобен для отладки | + | * !!! Не требуется для nss_ldap, удобен для отладки |
| ==== Debian/Ubuntu ==== | ==== Debian/Ubuntu ==== | ||
| Line 21: | Line 21: | ||
| <code> | <code> | ||
| gate# ldapsearch -x -b"dc=corpX,dc=un" -H ldap://server "uid=user1" | gate# ldapsearch -x -b"dc=corpX,dc=un" -H ldap://server "uid=user1" | ||
| + | </code> | ||
| + | ==== FreeIPA ==== | ||
| + | <code> | ||
| + | gate# ldapsearch -x -b"dc=corpX,dc=un" -H ldap://server "uid=user1" | ||
| + | |||
| + | gate# ldapsearch -x -D "uid=admin,cn=users,cn=accounts,dc=corp13,dc=un" -W -H ldap://server -b "dc=corp13,dc=un" "uid=user1" | ||
| + | ... | ||
| + | mail: user1@corp13.un | ||
| + | ... | ||
| </code> | </code> | ||
| Line 26: | Line 35: | ||
| * Права на чтение атрибутов LDAP ([[http://support.microsoft.com/kb/976063]]) | * Права на чтение атрибутов LDAP ([[http://support.microsoft.com/kb/976063]]) | ||
| + | * [[https://ldap.com/dns-srv-records-for-ldap/|DNS SRV Records for LDAP]] | ||
| <code> | <code> | ||
| - | gate# ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -h server -b "dc=corpX,dc=un" "sAMAccountName=user1" | + | gate# ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -H ldap://server -b "dc=corpX,dc=un" "sAMAccountName=user1" |
| или через ldaps: | или через ldaps: | ||
| Line 36: | Line 46: | ||
| или с Kerberos GSSAPI аутентификацией | или с Kerberos GSSAPI аутентификацией | ||
| - | # apt install libsasl2-modules-gssapi-mit | + | gate# apt install libsasl2-modules-gssapi-mit |
| - | + | gate# kinit Administrator | |
| - | # kinit Administrator | + | gate# ldapsearch -h server -b "dc=corpX,dc=un" "sAMAccountName=user1" |
| - | + | ||
| - | # ldapsearch -h server -b "dc=corpX,dc=un" "sAMAccountName=user1" | + | |
| </code><code> | </code><code> | ||
| ... | ... | ||
| Line 50: | Line 58: | ||
| ... | ... | ||
| </code><code> | </code><code> | ||
| - | # ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -h server -b "dc=corpX,dc=un" "sAMAccountName=guser1" | + | # ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -H ldap://server -b "dc=corpX,dc=un" "sAMAccountName=guser1" |
| </code><code> | </code><code> | ||
| ... | ... | ||
| Line 61: | Line 69: | ||
| ==== Debian/Ubuntu ==== | ==== Debian/Ubuntu ==== | ||
| <code> | <code> | ||
| - | root@gate:~# apt install libnss-ldap | + | root@gate:~# DEBIAN_FRONTEND=noninteractive apt install libnss-ldap |
| </code><code> | </code><code> | ||
| ... | ... | ||
| Line 163: | Line 171: | ||
| debian# service nscd restart && service nscd reload | debian# service nscd restart && service nscd reload | ||
| - | # getent passwd | + | # getent passwd user1 |
| # id user1 | # id user1 | ||
| Line 170: | Line 178: | ||
| ===== Установка сертификатов ===== | ===== Установка сертификатов ===== | ||
| - | ==== FreeBSD ==== | + | * [[Пакет OpenSSL#Импорт сертификата центра сертификации]] |
| <code> | <code> | ||
| - | # setenv LDAPTLS_REQCERT never | + | # export LDAPTLS_REQCERT=never |
| - | или | + | |
| - | # pkg install ca_root_nss | + | |
| - | # setenv LDAPTLS_CACERT /usr/local/etc/ssl/cert.pem | + | |
| </code> | </code> | ||
| - | ==== Linux ==== | + | |
| + | ===== Дополнительные материалы ===== | ||
| + | |||
| + | ==== Изменения в Debian 12 ==== | ||
| <code> | <code> | ||
| - | # export LDAPTLS_REQCERT=never | + | debian12# apt install libnss-ldapd |
| + | |||
| + | debian12# grep "^[^#]" /etc/nslcd.conf | ||
| + | uid nslcd | ||
| + | gid nslcd | ||
| + | uri ldap://server/ | ||
| + | base dc=corp20,dc=un | ||
| + | tls_cacertfile /etc/ssl/certs/ca-certificates.crt | ||
| + | |||
| + | service nslcd restart | ||
| + | |||
| + | gate# chown -R user1:user1 /home/user1 | ||
| + | gate# chown -R user2:user2 /home/user2 | ||
| </code> | </code> | ||
авторизация_с_использованием_ldap_сервера.1615447261.txt.gz · Last modified: 2021/03/11 10:21 by val
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
