随着各种研发工具使用越来越多，单独为每个工具维护一个账号系统的开销越来越大，而且作为用户多个账号密码使用也越来越不方便。所以需要做一个统一账号登陆。
查询了多个方法，又因为之前用过LDAP，所以选择了OpenLDAP来尝试实现。
OpenLDAP安装系统信息：
Ubuntu 14.04.1 LTS/CentOS release 6.5
openldap-2.4.39
关于如何安装请参考其他资料，这里仅记录一些尝试成功的配置。
ldapadd -x -D "cn=Manager,dc=example,dc=com" -w secret -f initial.ldif
ldapdelete -x -D "cn=Manager,dc=example,dc=com" -w secret "uid=liangji.chen,ou=People,dc=example,dc=com"
AuthType Basic
AuthLDAPBindPassword secret
AuthLDAPURL "ldap://10.0.3.140:389/ou=People,dc=example,dc=com?uid"
#!/bin/sh
#首先创建一个linux帐户
if [ -z $1 ]; then echo "Please specify username ..."; exit; fi
useradd $1
passwd $1
export PERL5LIB=./migration/
#转gid到ldap帐户
cat /etc/group | grep $1 >/tmp/group.in
migration/migrate_group.pl /tmp/group.in > /tmp/group.ldif
ldapadd -x -D "cn=root,dc=melot,dc=cn" -w secret -f /tmp/group.ldif
#转uid到ldap帐户
cat /etc/passwd | grep $1 > /tmp/passwd.in
migration/migrate_passwd.pl /tmp/passwd.in > /tmp/passwd.ldif
ldapadd -x -D "cn=root,dc=melot,dc=cn" -w secret -f /tmp/passwd.ldif
#删掉创建的linux帐户, 使帐户成为纯粹的ldap帐户，而不是local帐户
userdel $1
#rm -rf /home/$1
#rm /tmp/group.ldif
#rm /tmp/passwd.ldif
ldapsearch -x "uid=$1" #可用于显示刚刚添加到ldap数据库中的用户信息
if [ -z $1 ]; then echo "Please specify username ..."; exit; fi
ldappasswd -x -S -D "cn=root,dc=melot,dc=cn" -w secret "uid=$1,ou=People,dc=melot,dc=cn"
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title> Reset LDAP Password</title>
<style type="text/css">
dt{
font-weight: bold;
}
</style>
</head>
<body>
<?php
$u = !empty($_REQUEST['u']) ? $_REQUEST['u'] : '';
$op = !empty($_REQUEST['op']) ? $_REQUEST['op'] : '';
$np1 = !empty($_REQUEST['np1']) ? $_REQUEST['np1'] : '';
$np2 = !empty($_REQUEST['np2']) ? $_REQUEST['np2'] : '';
$an = !empty($_REQUEST['an']) ? $_REQUEST['an'] : '';
if(!empty($an)){
if( empty($u) or empty($op) or empty($np1) or empty($np2) ){
$msg = "Some filed was empty!";
}else{
if( $np1 != $np2 ){
$msg = "confirm password error!";
}else{
if($op == $np1){
$msg = "new password can not be same as old password!";
}else{
$ldap_host = "ldap://10.0.3.140";
$ldap_port = 389;
$base_dn = "dc=example,dc=com";
$connect = @ldap_connect($ldap_host, $ldap_port);
if(!$connect){
$msg = "Could not connect to LDAP server";
}else{
ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
$user_dn = sprintf("uid=%s,ou=People,dc=example,dc=com",$u);
$user_pass = $op;
$bind = @ldap_bind($connect, $user_dn, $user_pass);
if(!$bind){
$msg = sprintf("account %s old password error!",$u);
}else{
$root_dn = "cn=Manager,dc=example,dc=com";
$root_pass = 'secret';
$bind = @ldap_bind($connect, $root_dn, $root_pass);
if(!$bind){
$msg = "Programe can not bind to LDAP server!";
}else{
$values["userPassword"][0] = "{md5}".base64_encode(pack("H*",md5($np1)));
$rs = @ldap_mod_replace($connect,$user_dn,$values);
if($rs){
$msg = "password modifed success!";
}else{
$msg = "password modifed failed!";
}
}
}
}
@ldap_close($connect);
}
}
}
}
if(!empty($msg)){
print("<h1>$msg</h1>");
}
?>
<form method="post" action="">
<dl>
<dt>添加用户,重置密码等请联系管理员,谢谢！(/root/openldap目录下有脚本)</dt>
<dt>以下是自助修改密码:</dt>
<dt>User Id</dt>
<dd>uid=<input type="text" name="u" size="16" />,ou=People,dc=example,dc=com</dd>
<dt>Old Password</dt>
<dd><input type="text" name="op" /></dd>
<dt>New Password</dt>
<dd><input type="text" name="np1" /></dd>
<dt>Confirm Password</dt>
<dd><input type="text" name="np2" /></dd>
<dd><input type="submit" value="Submit" /></dd>
</dl>
<input type="hidden" name="an" value="submit" />
</form>
</body>
</html>
设置密码后不生效的情况，可以参考这里解决：http://www.linuxfly.org/post/671/
报错是：ldap_bind: Invalid credentials (49)