Differences

This shows you the differences between two versions of the page.

--- авторизация_с_использованием_ldap_сервера [2019/01/23 10:18]
val [Настройка библиотеки nsswitch]
+++ авторизация_с_использованием_ldap_сервера [2024/01/23 11:25]
val [Microsoft Active Directory]
@@ Line 3: / Line 3: @@
 ===== Установка LDAP клиента =====
-==== FreeBSD ====
+  * !!! Не требуется для nss_ldap, удобен для отладки
-<code>
-[gate:~] # pkg install openldap-client
-</code>
 ==== Debian/Ubuntu ====
 <code>
 root@gate:~# apt install ldap-utils
+</code>
+==== FreeBSD ====
+<code>
+[gate:~] # pkg install openldap-client
 </code>
@@ Line 17: / Line 20: @@
 ==== OpenLDAP ====
 <code>
-gate# ldapsearch -x -b"dc=corpX,dc=un" -h server "uid=user1"
+gate# ldapsearch -x -b"dc=corpX,dc=un" -H ldap://server "uid=user1"
 </code>
@@ Line 23: / Line 26: @@
   * Права на чтение атрибутов LDAP ([[http://support.microsoft.com/kb/976063]])
+  * [[https://ldap.com/dns-srv-records-for-ldap/|DNS SRV Records for LDAP]]
 <code>
-gate# ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -h server -b "dc=corpX,dc=un" "sAMAccountName=user1"
+gate# ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -H ldap://server -b "dc=corpX,dc=un" "sAMAccountName=user1"
 или через ldaps:
-gate# LDAPTLS_REQCERT=never ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -H ldaps://server -b "dc=corpX,dc=un" "sAMAccountName=user1"
+gate# LDAPTLS_REQCERT=never ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -w 'Pa$$w0rd' -H ldaps://server.corpX.un -b "dc=corpX,dc=un" "sAMAccountName=user1"
-</code>
-===== Установка библиотеки nss ldap =====
-==== FreeBSD ====
+или с Kerberos GSSAPI аутентификацией
-<code>
-[gate:~] # pkg install nss_ldap
-[gate:~] # cat /usr/local/etc/nss_ldap.conf
+gate# apt install libsasl2-modules-gssapi-mit
+gate# kinit Administrator
+gate# ldapsearch -h server -b "dc=corpX,dc=un" "sAMAccountName=user1"
+</code><code>
+...
+msSFU30NisDomain: corpX
+uidNumber: 10001
+gidNumber: 10001
+unixHomeDirectory: /home/user1
+loginShell: /bin/sh
+...
+</code><code>
+# ldapsearch -x -D "cn=Administrator,cn=Users,dc=corpX,dc=un" -W -H ldap://server -b "dc=corpX,dc=un" "sAMAccountName=guser1"
+</code><code>
+...
+msSFU30NisDomain: corpX
+gidNumber: 10001
+...
 </code>
+===== Установка библиотеки nss ldap =====
 ==== Debian/Ubuntu ====
 <code>
-root@gate:~# apt install libnss-ldap
+root@gate:~# DEBIAN_FRONTEND=noninteractive apt install libnss-ldap
 </code><code>
 ...
@@ Line 51: / Line 69: @@
 debian# cat /etc/libnss-ldap.conf
+</code>
+==== FreeBSD ====
+<code>
+[gate:~] # pkg install nss_ldap
+[gate:~] # cat /usr/local/etc/nss_ldap.conf
 </code>
@@ Line 57: / Line 82: @@
 ==== OpenLDAP ====
 <code>
-host server
+uri ldap://server
 base dc=corpX,dc=un
-nss_base_passwd               ou=users,dc=corpX,dc=un?one
+nss_base_passwd ou=People,
-nss_base_group                ou=groups,dc=corpX,dc=un?one
+nss_base_group ou=Group,
 </code>
@@ Line 87: / Line 112: @@
 </code>
-=== 2008/Samba4 ===
+=== 2008 ===
 <code>
 host server
-# uri ldaps://server/
-# tls_checkpeer no
 base dc=corpX,dc=un
@@ Line 107: / Line 129: @@
 nss_map_attribute homeDirectory unixHomeDirectory
 </code>
+=== 2016/Samba4 ===
+<code>
+host server
+# uri ldaps://server.corpX.un/
+# tls_checkpeer no
+base dc=corpX,dc=un
+binddn cn=Administrator,cn=Users,dc=corpX,dc=un
+bindpw Pa$$w0rd
+scope sub
+nss_base_passwd         cn=Users,dc=corpX,dc=un?one
+nss_base_group          cn=Users,dc=corpX,dc=un?one
+nss_map_objectClass posixAccount User
+nss_map_objectClass posixGroup Group
+nss_map_attribute uid SamAccountName
+nss_map_attribute homeDirectory unixHomeDirectory
+</code>
 ===== Настройка библиотеки nsswitch =====
@@ Line 113: / Line 155: @@
 </code><code>
 ...
-passwd:         files ldap
+passwd:         files systemd ldap
-group:          files ldap
+group:          files systemd ldap
-#shadow:         files ldap # for linux
+shadow:         files ldap
-#gshadow:        files ldap # for linux, may be no need?
 ...
 </code><code>
-debian# service nscd restart
+debian# service nscd restart && service nscd reload
-debian# service nscd reload
+# getent passwd user1
-# getent passwd
 # id user1
@@ Line 130: / Line 169: @@
 ===== Установка сертификатов =====
-==== FreeBSD ====
+  * [[Пакет OpenSSL#Импорт сертификата центра сертификации]]
-<code>
-# setenv LDAPTLS_REQCERT never
-  или
-# pkg install ca_root_nss
-# setenv LDAPTLS_CACERT /usr/local/etc/ssl/cert.pem
-</code>
-==== Linux ====
 <code>
 # export LDAPTLS_REQCERT=never
 </code>

Методические материалы Лохтурова Вячеслава

User Tools

Site Tools

Differences

Page Tools