搭建OPENLDAP代理服务无缝访问AD服务器

1、安装Berkeley DB

#下载、安装软件包

wget http://download.oracle.com/berkeley-db/db-4.6.21.tar.gz

tar -xvzf db-4.6.21.tar.gz
cd db-4.6.21
cd build_unix
../dist/configure --prefix=/usr/local/berkeleydb
make
make install

2、安装openldap

下载openldap安装包：此处我用的版本号为2.4.43，下面配置也仅依据该版本 ，其他版本未做研究，而且差别很大。

安装包：openldap-2.4.43.tgz

第一步，解开安装包

第二步，设置编译环境变量

CPPFLAGS="-I/usr/local/berkeleydb/include"
export CPPFLAGS
LDFLAGS="-L/usr/local/lib -L/usr/local/berkeleydb/lib"
export LDFLAGS
LD_LIBRARY_PATH="/usr/local/berkeleydb/lib"
export LD_LIBRARY_PATH

第三步，配置openldap：

cd openldap-2.4.43
./configure --prefix=/usr/local/ldapproxy --enable-bdb=mod --enable-ldap=mod --enable-meta=mod --enable-rewrite=yes --with-proxycache=yes  --enable-rwm=yes

没有报错即可下一步。若有报错优先解决满足配置要求。

如下警告：configure: WARNING: unrecognized options: –with-proxycache

可以不理会，继续

make depend

第四步，编译安装：

make
make install

第五步，配置openldap：

vi /usr/local/ldapproxy/etc/openldap/slapd.conf

1、包入所有的schema

include     /usr/local/ldapproxy/etc/openldap/schema/core.schema
include     /usr/local/ldapproxy/etc/openldap/schema/ppolicy.schema
include     /usr/local/ldapproxy/etc/openldap/schema/misc.schema
include     /usr/local/ldapproxy/etc/openldap/schema/corba.schema
include     /usr/local/ldapproxy/etc/openldap/schema/collective.schema
include     /usr/local/ldapproxy/etc/openldap/schema/cosine.schema
include     /usr/local/ldapproxy/etc/openldap/schema/dyngroup.schema
include     /usr/local/ldapproxy/etc/openldap/schema/nis.schema

2、load模块：

moduleload  meta
overlay     rwm
rewriteEngine   on

3、增加ldap代理配置：

database    ldap
suffix      "dc=server,dc=org"
rebind-as-user  yes
uri "ldap://server.org"
chase-referrals yes

4、增加本地服务器的配置:

lastmod     off
database    bdb
suffix  "dc=testadvdbg,dc=org"
rootdn  "cn=user,dc=testserver,dc=org"
rootpw  user

5、公共配置：

directory   /usr/local/ldapproxy/var/openldap-data
index   objectClass eq,pres
index   ou,cn,mail,surname,givenname    eq,pres,sub
index   uid eq,pres,sub

配置完成，slapd.conf配置文件中内容均以tab键分割，否则报错。

第六步，测试openldap配置

[root@mailmeta1 libexec]# /usr/local/ldapproxy/libexec/slapd -T test -u
config file testing succeeded

说明测试通过

第七步，启动openldap代理服务

[root@mailmeta1 libexec]# /usr/local/ldapproxy/libexec/slapd -d 256&
[1] 20493
[root@mailmeta1 libexec]# 568c8098 @(#) $OpenLDAP: slapd 2.4.43 (Jan  6 2016 10:31:01) $
root@mailmeta1.synihefei.com:/home/ldap/openldap-2.4.43/servers/slapd
568c8098 bdb_db_open: warning - no DB_CONFIG file found in directory /usr/local/ldapproxy/var/openldap-data: (2).
Expect poor performance for suffix "dc=testadvdbg,dc=org".
568c8098 bdb_monitor_db_open: monitoring disabled; configure monitor database to enable
568c8098 slapd starting

没有报错说明启动成功。

第八步，配置域名解析

vi /etc/hosts
192.168.28.183   server.org

第八步，测试代理是否可用

1、登录本地openldap服务器是否成功

/usr/local/ldapproxy/bin/ldapsearch -H "ldap://127.0.0.1:389" -D "cn=user,dc=testserver,dc=org" -w '111111' -b "ou=People,DC=testserver,DC=org"

2、通过代理登录AD查询是否成功

/usr/local/ldapproxy/bin/ldapsearch -H "ldap://127.0.0.1:389" -D "cn=Administrator,cn=users,dc=server,dc=org" -w '111111' -b "cn=users,DC=server,DC=org" -x

提示如下表示成功查询：

# search result

search: 2

result: 0 Success

# numResponses: 42

# numEntries: 41