Rancher访问LDAP的默认规则
用户
搜索起点: ou=Users,dc=thecover,dc=cn
对象分类: inetOrgPerson
登录字段: uid
名称字段: cn
搜索字段: uid|sn|givenName
启用字段:
禁用位掩码: 0
用户组
搜索起点: ou=Groups,dc=thecover,dc=cn
对象分类: groupOfNames
名称字段: cn
搜索字段: cn
创建只读用户
- 创建用户（可以用管理工具创建同objectClass的用户）
#密码
LDAP_READONLY_USER_PW='密码'
#Base DN
LDAP_BASE_DN='dc=thecover,dc=cn'
cat <<EOF > ./readOnly.ldif
dn: cn=readonly,${LDAP_BASE_DN}
cn: readonly
objectClass: simpleSecurityObject
objectClass: organizationalRole
description: LDAP read only user
userPassword: ${LDAP_READONLY_USER_PW}
EOF
命令行增加用户
ldapadd -x -D cn=Manager,dc=okcoin,dc=com -w '密码' -f ./readOnly.ldif
- 配置权限
LDAP_BASE_DN='dc=thecover,dc=cn'
cat <<EOF > readonly-user-acl.ldif
dn: olcDatabase={1}hdb,cn=config
changetype: modify
delete: olcAccess
-
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange
by dn="cn=admin,dc=thecover,dc=cn" write
by anonymous auth
by self write
by dn="cn=readonly,dc=thecover,dc=cn" read
by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=thecover,dc=cn" write by * read
EOF
ldapmodify -Y EXTERNAL -H ldapi:/// -f readonly-user-acl.ldif
- 备注
配置权限时需要使用
slapcat -b cn=config
定位olcDatabase config的位置
Ldap增加memberOf属性
https://www.linuxprobe.com/enable-memberof-openldap.html
https://kifarunix.com/how-to-create-openldap-member-groups/
配置缓存
查询缓存配置
ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config 'olcDatabase={0}mdb' olcDbindex
删除旧配置
cat >> del-1mdb-index.ldif << EOF
dn: olcDatabase={1}mdb, cn=config
changetype:modify
delete: olcDbIndex
olcDbIndex: uid eq
EOF
ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f del-1mdb-index.ldif
新增配置
cat >> mdb-index.ldif << EOF
dn: olcDatabase={1}mdb, cn=config
changetype:modify
add:olcDbIndex
olcDbIndex: uid pres,eq,sub
EOF
ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f mdb-index.ldif