LDAP&it's usage

本文介绍了LDAP(轻量目录访问协议)的基本概念、特点及其在实际场景中的应用。LDAP是一种用于查询、浏览和搜索目录信息的标准协议,适用于需要跨平台访问且更新频率较低的数据存储场景。

LDAP:

的英文全称是Lightweight Directory Access Protocol,简称为LDAP。LDAP是轻量目录访问协议[1],它是基于X.500标准的,但是简单多了并且可以根据需要定制。LDAP目录中可以存储各种类型的数据:电子邮件地址、邮件路由信息、人力资源数据、公用密匙、联系人列表,等等.

简单的说来,LDAP是一个得到关于人或者资源的集中、静态数据的快速方式,用来发布目录信息到许多不同资源的协议。通常它都作为一个集中的地址本使用,类似于我们所使用诸如NIS(Network Information Service)、DNS (Domain Name Service)等网络目录,也类似于你在花园中所看到的树木。

LDAP和关系数据库是两种不同层次的概念,后者是存贮方式(同一层次如网格数据库,对象数据库),前者是存贮模式和访问协议。LDAP是一个比关系数据库抽象层次更高的存贮概念,与关系数据库的查询语言SQL属同一级别。LDAP最基本的形式是一个连接数据库的标准方式。该数据库为读查询作了优化。因此它可以很快地得到查询结果,不过在其它方面,例如更新,就慢得多。从另一个意义上 LDAP是实现了指定的数据结构的存贮,它是一种特殊的数据库。但是LDAP和一般的数据库不同,明确这一点是很重要的。 LDAP对查询进行了优化,与写性能相比LDAP的读性能要优秀很多。

服务器

LDAP服务器可以用“推”或“拉”的方法复制部分或全部数据,例如:可以把数据“推”到远程的办公室,以增加数据的安全性。复制技术是内置在LDAP服务器中的而且很容易配置。如果要在DBMS中使用相同的复制功能,数据库厂商就会要你支付额外的费用,而且也很难管理。

什么时候该用LDAP存储数据?

如果下面每一个问题的答案都是"是",那么把数据存在LDAP中就是一个好主意。

l 需要在任何平台上都能读取数据吗?

l 每一个单独的记录项是不是每一天都只有很少的改变?

信息模型:描述LDAP的信息表示方式

在LDAP中信息以树状方式组织,在树状信息中的基本数据单元是条目,而每个条目由属性构成,属性中存储有属性值;LDAP中的信息模式,类似于面向对象的概念,在LDAP中每个条目必须属于某个或多个对象类(Object Class),每个Object Class由多个属性类型组成,每个属性类型有所对应的语法和匹配规则;对象类和属性类型的定义均可以使用继承的概念。每个条目创建时,必须定义所属的对象类,必须提供对象类中的必选属性类型的属性值,在LDAP中一个属性类型可以对应多个值。

在LDAP中把对象类、属性类型、语法和匹配规则统称为Schema,在LDAP中有许多系统对象类、属性类型、语法和匹配规则,这些系统Schema在LDAP标准中进行了规定,同时不同的应用领域也定义了自己的Schema,同时用户在应用时,也可以根据需要自定义Schema。

LDAP中为了加快查询的速度,针对不同的数据类型,可以提供不同的匹配方法,如针对字符串类型的相等、模糊、大于小于均提供自己的匹配规则。

过滤器和语法

LDAP是一个查询为主的记录结构,无论是何种查询方式,最终都由过滤器缺点查询的条件。过滤器相当于SQL中的WHERE子句。任何LDAP的类过滤和字符串都必须放在括号内,如(objectclass=*),指列出所有类型的记录(不过分类)。

可以使用=,>=,<=,~=(约等于)进行比较,如(number<=100)。合并条件是最怪的,必须把操作符放在两个操作对象的前面而不是中间,单一操作对象用括号括起来。如

l A与B,不是A&B,而是(&(A)(B))。

l 或使用"|"表示;

l 非使用"!"表示。

l 对于"与",或"或"在操作符后可以跟多个条件表达式,但非后则只参是单个表达式。

目录优势:

 

1.LDAP目录服务可以有效地解决众多网络服务的用户账户问题。

 

2.LDAP目录服务规定了统一的身份信息数据库、身份认证机制和接口,实现了资源和信息的统一管理,保证了数据的一致性和完整性。

 

3.LDAP目录服务是以树状的层次结构来描述数据信息的,此种模型适应了众多行业应用的业务组织结构。[3]

LDAP 使用说明

  • LDAP 支持 使用 LADP 与 Windows AD 的用户作为 jumpserver 登录用户
  • 已经存在的用户不能与要登录的 LDAP 用户有用户名和邮箱同名, 具有唯一性
  1. LDAP 设置说明
LDAP地址  ldap://serverurl:389  或者  ldaps://serverurl:636(需要勾选ssl)
# 此处是设置LDAP的服务器,推荐使用IP, 防止解析问题

绑定DN  cn=administrator,cn=Users,dc=jumpserver,dc=org
# 这里是设置认证用户的信息, jumpserver会使用这个用户去校验ldap的信息是否正确

密码   # 上面认证用户的密码

用户OU  ou=jumpserver,dc=jumpserver,dc=org
# 这里是设置用来登录jumpserver的组织单元, 比如我要用某个ou的用户来登录jumpserver
# 多OU用法  ou=jumpserver,dc=jumpserver,dc=org | ou=user,dc=jumpserver,dc=org | ou=xxx,dc=jumpserver,dc=org

用户过滤器  (cn=%(user)s)
# 这里是设置筛选ldap用户的哪些属性, 不能有多余的空格

LADP属性映射  {"username": "cn", "name": "sn", "email": "mail"}
username name email 是jumpserver的用户属性(不可更改)
cn       sn   mail  是ldap的用户属性(可自定义)
# 这里的意思是, 把ldap用户的属性映射到jumpserver上

使用SSL
# 勾选后 LDAP地址 需要设置成 ldaps://serverurl:636

启动LDAP认证
# 如果需要使用 LDAP或域用户 登录 jumpserver,则必选
  1. 补充
  2. DN 一定要是完整的DN, 不能跳过OU, 可以使用其他工具查询
    如:cn=admin,ou=aaa,dc=jumpserver,dc=org,必须要写成cn=admin,ou=aaa,dc=jumpserver,dc=org 不能缩写成cn=admin,dc=jumpserver,dc=org
    
    用户OU 用户OU可以只写顶层OU, 不写子OU
    如:ou=aaa,ou=bbb,ou=ccc,dc=jumpserver,dc=org,可以只写ou=ccc,dc=jumpserver,dc=org,根据需求自行修改
    
    用户过滤器  筛选用户的规则, 点击测试连接就是根据这个规则到用户OU里面去检索用户, 可以自定义规则
    如:(uid=%(user)s) 或 (sAMAccountName=%(user)s)  等, 这里的属性需要与下面的属性映射设置一致
    
    LADP属性映射  username name email 这三项不可修改删除, 属性映射的字段必须存在, 且登录用户名和邮件不可以重复
    如:{"username": "uid", "name": "sn", "email": "mail"} 或 {"username": "sAMAccountName", "name": "cn", "email": "mail"}
    "username": "uid" 这里的 uid 必须和上面的 (uid=%(user)s) 这里的 uid 一致
    如果上面是(sAMAccountName=%(user)s) 那么下面也应该修改为{"username": "sAMAccountName",
    username 是 jumpserver 的用户用户名, name 是 jumpserver 的用户名称, mail 是 jumpserver 用户的邮箱
    属性映射的意思是把ldap的什么属性来作为jumpserver的用户用户名, 把ldap的什么属性作为jumpserver的用户名称, 把ldap的什么属性作为jumpserver的用户邮箱

     

转载于:https://www.cnblogs.com/sensenma533/p/10655079.html

#!/bin/sh # Copyright Abandoned 1996 TCX DataKonsult AB & Monty Program KB & Detron HB # This file is public domain and comes with NO WARRANTY of any kind # MySQL daemon start/stop script. # Usually this is put in /etc/init.d (at least on machines SYSV R4 based # systems) and linked to /etc/rc3.d/S99mysql and /etc/rc0.d/K01mysql. # When this is done the mysql server will be started when the machine is # started and shut down when the systems goes down. # Comments to support chkconfig on RedHat Linux # chkconfig: 2345 64 36 # description: A very fast and reliable SQL database engine. # Comments to support LSB init script conventions ### BEGIN INIT INFO # Provides: mysql # Required-Start: $local_fs $network $remote_fs # Should-Start: ypbind nscd ldap ntpd xntpd # Required-Stop: $local_fs $network $remote_fs # Default-Start: 2 3 4 5 # Default-Stop: 0 1 6 # Short-Description: start and stop MySQL # Description: MySQL is a very fast and reliable SQL database engine. ### END INIT INFO # If you install MySQL on some other places than /usr/local/mysql, then you # have to do one of the following things for this script to work: # # - Run this script from within the MySQL installation directory # - Create a /etc/my.cnf file with the following information: # [mysqld] # basedir=<path-to-mysql-installation-directory> # - Add the above to any other configuration file (for example ~/.my.ini) # and copy my_print_defaults to /usr/bin # - Add the path to the mysql-installation-directory to the basedir variable # below. # # If you want to affect other MySQL variables, you should make your changes # in the /etc/my.cnf, ~/.my.cnf or other MySQL configuration files. # If you change base dir, you must also change datadir. These may get # overwritten by settings in the MySQL configuration files. basedir= datadir= # Default value, in seconds, afterwhich the script should timeout waiting # for server start. # Value here is overriden by value in my.cnf. # 0 means don't wait at all # Negative numbers mean to wait indefinitely service_startup_timeout=900 # Lock directory for RedHat / SuSE. lockdir='/var/lock/subsys' lock_file_path="$lockdir/mysql" # The following variables are only set for letting mysql.server find things. # Set some defaults mysqld_pid_file_path= if test -z "$basedir" then basedir=/usr/local/mysql bindir=/usr/local/mysql/bin if test -z "$datadir" then datadir=/usr/local/mysql/data fi sbindir=/usr/local/mysql/bin libexecdir=/usr/local/mysql/bin else bindir="$basedir/bin" if test -z "$datadir" then datadir="$basedir/data" fi sbindir="$basedir/sbin" libexecdir="$basedir/libexec" fi # datadir_set is used to determine if datadir was set (and so should be # *not* set inside of the --basedir= handler.) datadir_set= # # Use LSB init script functions for printing messages, if possible # lsb_functions="/lib/lsb/init-functions" if test -f $lsb_functions ; then . $lsb_functions else log_success_msg() { echo " SUCCESS! $@" } log_failure_msg() { echo " ERROR! $@" } fi PATH="/sbin:/usr/sbin:/bin:/usr/bin:$basedir/bin" export PATH mode=$1 # start or stop [ $# -ge 1 ] && shift other_args="$*" # uncommon, but needed when called from an RPM upgrade action # Expected: "--skip-networking --skip-grant-tables" # They are not checked here, intentionally, as it is the resposibility # of the "spec" file author to give correct arguments only. case `echo "testing\c"`,`echo -n testing` in *c*,-n*) echo_n= echo_c= ;; *c*,*) echo_n=-n echo_c= ;; *) echo_n= echo_c='\c' ;; esac parse_server_arguments() { for arg do case "$arg" in --basedir=*) basedir=`echo "$arg" | sed -e 's/^[^=]*=//'` bindir="$basedir/bin" if test -z "$datadir_set"; then datadir="$basedir/data" fi sbindir="$basedir/sbin" libexecdir="$basedir/libexec" ;; --datadir=*) datadir=`echo "$arg" | sed -e 's/^[^=]*=//'` datadir_set=1 ;; --pid-file=*) mysqld_pid_file_path=`echo "$arg" | sed -e 's/^[^=]*=//'` ;; --service-startup-timeout=*) service_startup_timeout=`echo "$arg" | sed -e 's/^[^=]*=//'` ;; esac done } wait_for_pid () { verb="$1" # created | removed pid="$2" # process ID of the program operating on the pid-file pid_file_path="$3" # path to the PID file. i=0 avoid_race_condition="by checking again" while test $i -ne $service_startup_timeout ; do case "$verb" in 'created') # wait for a PID-file to pop into existence. test -s "$pid_file_path" && i='' && break ;; 'removed') # wait for this PID-file to disappear test ! -s "$pid_file_path" && i='' && break ;; *) echo "wait_for_pid () usage: wait_for_pid created|removed pid pid_file_path" exit 1 ;; esac # if server isn't running, then pid-file will never be updated if test -n "$pid"; then if kill -0 "$pid" 2>/dev/null; then : # the server still runs else # The server may have exited between the last pid-file check and now. if test -n "$avoid_race_condition"; then avoid_race_condition="" continue # Check again. fi # there's nothing that will affect the file. log_failure_msg "The server quit without updating PID file ($pid_file_path)." return 1 # not waiting any more. fi fi echo $echo_n ".$echo_c" i=`expr $i + 1` sleep 1 done if test -z "$i" ; then log_success_msg return 0 else log_failure_msg return 1 fi } # Get arguments from the my.cnf file, # the only group, which is read from now on is [mysqld] if test -x "$bindir/my_print_defaults"; then print_defaults="$bindir/my_print_defaults" else # Try to find basedir in /etc/my.cnf conf=/etc/my.cnf print_defaults= if test -r $conf then subpat='^[^=]*basedir[^=]*=\(.*\)$' dirs=`sed -e "/$subpat/!d" -e 's//\1/' $conf` for d in $dirs do d=`echo $d | sed -e 's/[ ]//g'` if test -x "$d/bin/my_print_defaults" then print_defaults="$d/bin/my_print_defaults" break fi done fi # Hope it's in the PATH ... but I doubt it test -z "$print_defaults" && print_defaults="my_print_defaults" fi # # Read defaults file from 'basedir'. If there is no defaults file there # check if it's in the old (depricated) place (datadir) and read it from there # extra_args="" if test -r "$basedir/my.cnf" then extra_args="-e $basedir/my.cnf" fi parse_server_arguments `$print_defaults $extra_args mysqld server mysql_server mysql.server` # # Set pid file if not given # if test -z "$mysqld_pid_file_path" then mysqld_pid_file_path=$datadir/`hostname`.pid else case "$mysqld_pid_file_path" in /* ) ;; * ) mysqld_pid_file_path="$datadir/$mysqld_pid_file_path" ;; esac fi case "$mode" in 'start') # Start daemon # Safeguard (relative paths, core dumps..) cd $basedir echo $echo_n "Starting MySQL" if test -x $bindir/mysqld_safe then # Give extra arguments to mysqld with the my.cnf file. This script # may be overwritten at next upgrade. $bindir/mysqld_safe --datadir="$datadir" --pid-file="$mysqld_pid_file_path" $other_args >/dev/null & wait_for_pid created "$!" "$mysqld_pid_file_path"; return_value=$? # Make lock for RedHat / SuSE if test -w "$lockdir" then touch "$lock_file_path" fi exit $return_value else log_failure_msg "Couldn't find MySQL server ($bindir/mysqld_safe)" fi ;; 'stop') # Stop daemon. We use a signal here to avoid having to know the # root password. if test -s "$mysqld_pid_file_path" then # signal mysqld_safe that it needs to stop touch "$mysqld_pid_file_path.shutdown" mysqld_pid=`cat "$mysqld_pid_file_path"` if (kill -0 $mysqld_pid 2>/dev/null) then echo $echo_n "Shutting down MySQL" kill $mysqld_pid # mysqld should remove the pid file when it exits, so wait for it. wait_for_pid removed "$mysqld_pid" "$mysqld_pid_file_path"; return_value=$? else log_failure_msg "MySQL server process #$mysqld_pid is not running!" rm "$mysqld_pid_file_path" fi # Delete lock for RedHat / SuSE if test -f "$lock_file_path" then rm -f "$lock_file_path" fi exit $return_value else log_failure_msg "MySQL server PID file could not be found!" fi ;; 'restart') # Stop the service and regardless of whether it was # running or not, start it again. if $0 stop $other_args; then $0 start $other_args else log_failure_msg "Failed to stop running server, so refusing to try to start." exit 1 fi ;; 'reload'|'force-reload') if test -s "$mysqld_pid_file_path" ; then read mysqld_pid < "$mysqld_pid_file_path" kill -HUP $mysqld_pid && log_success_msg "Reloading service MySQL" touch "$mysqld_pid_file_path" else log_failure_msg "MySQL PID file could not be found!" exit 1 fi ;; 'status') # First, check to see if pid file exists if test -s "$mysqld_pid_file_path" ; then read mysqld_pid < "$mysqld_pid_file_path" if kill -0 $mysqld_pid 2>/dev/null ; then log_success_msg "MySQL running ($mysqld_pid)" exit 0 else log_failure_msg "MySQL is not running, but PID file exists" exit 1 fi else # Try to find appropriate mysqld process mysqld_pid=`pidof $libexecdir/mysqld` # test if multiple pids exist pid_count=`echo $mysqld_pid | wc -w` if test $pid_count -gt 1 ; then log_failure_msg "Multiple MySQL running but PID file could not be found ($mysqld_pid)" exit 5 elif test -z $mysqld_pid ; then if test -f "$lock_file_path" ; then log_failure_msg "MySQL is not running, but lock file ($lock_file_path) exists" exit 2 fi log_failure_msg "MySQL is not running" exit 3 else log_failure_msg "MySQL is running but PID file could not be found" exit 4 fi fi ;; *) # usage basename=`basename "$0"` echo "Usage: $basename {start|stop|restart|reload|force-reload|status} [ MySQL server options ]" exit 1 ;; esac exit 0 帮忙分析下脚本
最新发布
09-06
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值