GitLab 通过ldap完成帐号认证

https://www.58jb.com/html/120.html

https://blog.csdn.net/reblue520/article/details/80553528

1.环境搭建
操作系统：centos6.5 x86_64
关闭防火墙、selinux
开启时间同步
# crontab -e
加入
# time sync
*/5 * * * * /usr/sbin/ntpdate 192.168.8.102 >/dev/null 2>&1
# crontab -l
*/5 * * * * /usr/sbin/ntpdate -u 192.168.8.102 >/dev/null 2>&1

配置域名解析：
# echo "192.168.8.43 chinasoft.com" >> /etc/hosts

解决依赖关系
# yum grouplist

   Base
   Debugging Tools
   Performance Tools
   Compatibility libraries
   Development tools
   Dial-up Networking Support
   Hardware monitoring utilities
如果缺少组包，需要安装
yum groupinstall -y "Compatibility libraries"

2.安装openldap master
# yum install -y openldap openldap-*
# yum install -y nscd nss-pam-ldapd nss-* pcre pcre*

# rpm -qa | grep openldap*
compat-openldap-2.3.43-2.el6.x86_64
openldap-2.4.40-12.el6.x86_64
openldap-clients-2.4.40-12.el6.x86_64
openldap-servers-sql-2.4.40-12.el6.x86_64
openldap-servers-2.4.40-12.el6.x86_64
openldap-devel-2.4.40-12.el6.x86_64

3.配置slapd.conf文件
# cd /etc/openldap/
[root@node5 openldap]# cp /usr/share/openldap-servers/slapd.conf.obsolete slapd.conf

[root@node5 openldap]# cp slapd.conf slapd.conf.bak
[root@node5 openldap]# slappasswd -s chinasoft|sed -e "s#{SSHA}#rootpw\t{SSHA}#g"
rootpw {SSHA}D9+lqUJZVPobp0sZfXl37jE1aVvR2P9K
[root@node5 openldap]# slappasswd -s chinasoft|sed -e "s#{SSHA}#rootpw\t{SSHA}#g">>/etc/openldap/slapd.conf
[root@node5 openldap]# tail -1 slapd.conf
rootpw {SSHA}FvBRnIPqtIi0/u11O2gOfOCrRJr+xMAr

# vim slapd.conf
注释掉一下四行
# database        dbb
#suffix         "dc=my-domain,dc=com"
#checkpoint     1024 15
#rootdn         "cn=Manager,dc=my-domain,dc=com"

添加如下内容
# add start by jack 2016/07/01
database        bdb
suffix          "dc=chinasoft,dc=com"
rootdn          "cn=admin,dc=chinasoft,dc=com"

对比修改是否成功：
# diff slapd.conf.bak slapd.conf
114,117c114,122
< database bdb
< suffix "dc=my-domain,dc=com"
< checkpoint 1024 15
< rootdn "cn=Manager,dc=my-domain,dc=com"
---
> #database bdb
> #suffix "dc=my-domain,dc=com"
> #checkpoint 1024 15
> #rootdn "cn=Manager,dc=my-domain,dc=com"
> # add start by jack 2016/07/01
> database dbd
> suffix "dc=chinasoft,dc=com"
> rootdn "cn=admin,dc=chinasoft,dc=com"
> 
140a146
> rootpw {SSHA}FvBRnIPqtIi0/u11O2gOfOCrRJr+xMAr

添加如下内容
cat >> /etc/openldap/slapd.conf<<EOF
# add start by jack 2016/07/01
loglevel 296
cachesize 1000
checkpoint 2018 10
EOF

参数说明：

# add start by jack 2016/07/01
loglevel 296  # 日志级别，记录日志信息方便调试，296级别是由256(日志连接/操作/结果)、32（搜索过滤器处理）、8（连接管理）累加的结果
cachesize 1000 # 设置ldap可以换成的记录数
checkpoint 2018 10 # 可以设置把内存中的数据协会数据文件的操作上，上面设置表示每达到2048KB或者10分钟执行一次，checkpoint即写入数据文件的操作

4.ldap授权及安全参数配置
# vim /etc/openldap/slapd.conf
删除如下内容：
database config
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
        by * none

# enable server status monitoring (cn=monitor)
databas