Jenkins配置使用LDAP的用户和密码登录

news2024/12/23 23:10:28

# 检查配置文件是否正确
[root@localhost schema]# slaptest -u
62c6aafe ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif"
62c6aafe ldif_read_file: checksum error on "/etc/openldap/slapd.d/cn=config/olcDatabase={2}mdb.ldif"
config file testing succeeded # 成功

# 启动服务
[root@localhost schema]# systemctl enable --now slapd.service 


# 查看服务状态
[root@localhost schema]# systemctl status slapd.service 	~~~

一、搭建openLADP环境

1.下载安装

下载插件地址:

https://pkgs.org/search/?q=ldap

下载以下插件

[root@localhost ~]# ll /var/localrepo/
总用量 4388
-rw-r--r-- 1 root root  359796 11月 10 2021 openldap-2.4.46-18.el8.x86_64.rpm
-rw-r--r-- 1 root root  206276 11月 10 2021 openldap-clients-2.4.46-18.el8.x86_64.rpm
-rw-r--r-- 1 root root  829864 11月 10 2021 openldap-devel-2.4.46-18.el8.x86_64.rpm
-rw-r--r-- 1 root root 2263988 11月 10 2021 openldap-servers-2.4.46-18.el8.x86_64.rpm
-rw-r--r-- 1 root root  822872 5月  14 2023 phpldapadmin-1.2.6.6-1.el8.noarch.rpm

注意openldap几个插件之间的版本要一致

下载安装:

将上述插件都安装: yum -y install xx.rpm

2.配置参数

2-1.生成管理员密码

# 执行如下命令后，生成的是对密码进行加密后的字符串
slappasswd -s 123456

{SSHA}k6jzxUPpA9UN0d2VY5NZhqJPwmrLxfYt

将下述文件中框起来的内容改为自己的命名

2-2.修改monitor.ldif

vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}monitor.ldif
修改后：

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 b3b6f871
dn: olcDatabase={1}monitor
objectClass: olcDatabaseConfig
olcDatabase: {1}monitor
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=extern
 al,cn=auth" read by dn.base="cn=root,dc=xb,dc=hou" read by * none
structuralObjectClass: olcDatabaseConfig
entryUUID: 2011ffa8-fc18-103e-8142-d79dad983498
creatorsName: cn=config
createTimestamp: 20240831190817Z
entryCSN: 20240831190817.852578Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20240831190817Z

将红框中的部分改为你自己的配置

2-3.修改mdb.ldif

vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}mdb.ldif
修改后：

# AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
# CRC32 0663050d
dn: olcDatabase={2}mdb
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {2}mdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=xb,dc=hou
olcRootDN: cn=root,dc=xb,dc=hou
olcDbIndex: objectClass eq,pres
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
structuralObjectClass: olcMdbConfig
entryUUID: 20120b06-fc18-103e-8143-d79dad983498
creatorsName: cn=config
createTimestamp: 20240831190817Z
entryCSN: 20240831190817.852859Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20240831190817Z
olcRootPW: {SSHA}k6jzxUPpA9UN0d2VY5NZhqJPwmrLxfYt

2-4.拷贝db文件并修改所属组权限

[root@localhost /]# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
# 修改文件权限
[root@localhost /]# chown -R ldap:ldap /var/lib/ldap/

2-5配置ldap.conf

vim /etc/openldap/ldap.conf

#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.
BASE dc=xb,dc=hou
URI  ldap://192.168.137.121 ldap://192.168.137.121:666

#BASE   dc=example,dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never

# When no CA certificates are specified the Shared System Certificates
# are in use. In order to have these available along with the ones specified
# by TLS_CACERTDIR one has to include them explicitly:
#TLS_CACERT     /etc/pki/tls/cert.pem

# System-wide Crypto Policies provide up to date cipher suite which should
# be used unless one needs a finer grinded selection of ciphers. Hence, the
# PROFILE=SYSTEM value represents the default behavior which is in place
# when no explicit setting is used. (see openssl-ciphers(1) for more info)
#TLS_CIPHER_SUITE PROFILE=SYSTEM

# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON    on

将BASE, URI改为你的实际配置

2-6.启动服务

# 检查配置文件是否正确
[root@localhost schema]# slaptest -u
...略...
config file testing succeeded # 成功

# 启动服务
[root@localhost schema]# systemctl enable --now slapd.service 


# 查看服务状态
[root@localhost schema]# systemctl status slapd.service

注意:

登录后如果遇到下面的错误：

This base cannot be created with PLA.主要是在base.ldif导入的时候出现问题，最好使用自动生成的base.ldif进行导入，不要手动去创建。

[root@localhost ~]# vim base.ldif
#dn项
dn: dc=xb,dc=hou
#组织名
o: ldap
#对象类别
objectclass: dcObject
##对象类别
objectclass: organization


[root@localhost ~]# ldapadd -f /root/base.ldif -x -D cn=root,dc=xb,dc=hou -W

再重新登录试试

2-7.配置日志

[root@localhost ~]# vim log.ldif
# log.ldif内容:
dn: cn=config
changetype: modify
add: olcLogLevel
olcLogLevel: 32

# 导入文件
[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -f log.ldif
[root@localhost ~]# systemctl restart rsyslog
[root@localhost ~]# systemctl restart slapd
# 依次执行
[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/cosine.ldif
[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/nis.ldif
[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/inetorgperson.ldif
[root@localhost ~]# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/core.ldif


# 注意: 第一次添加ldapadd, 后面修改使用ldapmodify
ldapmodify -Y EXTERNAL -H ldapi:/// -f log.ldif
systemctl restart rsyslog
systemctl restart slapd
# 依次执行
ldapmodify -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/cosine.ldif
ldapmodify -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/nis.ldif
ldapmodify -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/inetorgperson.ldif
ldapmodify -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/core.ldif