ubuntu22.04服务器docker-compose方式部署ldap服务_业界新闻

发布时间:2024-07-13 15:37

阅读量:1

一：系统版本
二：部署环境
节点名称
IP
部署组件及版本
配置文件路径
机器CPU
机器内存
机器存储
Ldap
10.10.10.111
self-service-password:latest
phpldapadmin:latest
openldap:latest
openldap:/data/openldap/config
phpldapadmin（只是web管理界面，数据依托openldap）
self-service-password:/data/self-service-password/data
2*16cores
64g
50g 系统
800g 数据盘
三：部署流程
（1）安装docker和docker-compose
apt-get install -y docker  wget https://github.com/docker/compose/releases/download/1.29.2/docker-compose-Linux-x86_64  mv docker-compose-Linux-x86_64 /usr/bin/docker-compose
（2）提前拉取需要用到的镜像
docker pull osixia/openldap:latest  docker pull osixia/phpldapadmin:latest  docker pull tiredofit/self-service-password:latest
（3）准备应用要挂载的配置文件目录
mkdir -p /data/openldap/data  mkdir -p /data/openldap/config  mkdir -p /data/self-service-password/data  mkdir -p /data/self-service-password/logs  备注：如遇到读取文件权限问题请使用 chmod 755 -R /data/self-service-password/data
（4）所有组件的部署方式全部为docker-compose形式编排部署，docker-compose.yml文件所在路径/app/ldap_docker_compose/，编排内容：
~]# mkdir -p /app/ldap_docker_compose/ ~]# cat /app/ldap_docker_compose/docker-compose.yml  version: '3' services:   ## 安装openldap   openldap:     container_name: openldap     image: osixia/openldap:latest     restart: always     environment:       TZ: Asia/Shanghai       LDAP_ORGANISATION: "Manager"       LDAP_DOMAIN: "westhab.com"       LDAP_ADMIN_PASSWORD: "admin123456"       LDAP_CONFIG_PASSWORD: "admin123456"     volumes:       - /data/openldap/data:/var/lib/ldap       - /data/openldap/config:/etc/ldap/slapd.d     ports:       - '389:389'   ## 安装phpldapadmin   phpldapadmin:     container_name: phpldapadmin     image: osixia/phpldapadmin:latest     environment:       PHPLDAPADMIN_LDAP_HOSTS: openldap       PHPLDAPADMIN_HTTPS: "false"     ports:       - "30004:80"     depends_on:       - openldap   ## 安装自助修改密码插件self-service-password   change-ldap-password:     container_name: self-service-password     image: tiredofit/self-service-password:latest     restart: always     ports:       - "8080:80"     environment:       - LDAP_SERVER=ldap://10.10.10.111:389       - LDAP_STARTTLS=false       - LDAP_BINDDN=cn=admin,dc=westhab,dc=com       - LDAP_BINDPASS=admin123456       - LDAP_BASE_SEARCH=dc=westhab,dc=com       - LDAP_LOGIN_ATTRIBUTE=uid       - LDAP_FULLNAME_ATTRIBUTE=cn       # 邮箱配置模块       - MAIL_FROM=emis@skycloudsys.com       - MAIL_FROM_NAME=账号自助服务平台       - SMTP_DEBUG=0       - SMTP_HOST=smtp.qiye.aliyun.com       - SMTP_USER=emis@skycloudsys.com       - SMTP_PASS=QUN3ZSQmNzQ1QkJjaQ==       - SMTP_SECURE_TYPE=tls       - SMTP_AUTOTLS=false       - SMTP_AUTH_ON=true       - NOTIFY_ON_CHANGE=true     volumes:       - /etc/localtime:/etc/localtime       - /data/self-service-password/data:/www/ssp       - /data/self-service-password/logs:/www/logs
（5）启动服务
#开始部署 ~]# docker-compose up -d #停止运行的容器实例 ~]# docker-compose stop #单独启动容器 ~]# docker-compose up -d phpldapadmin #重启所有容器 ~]# docker-compose restart #查看服务状态 ~]# docker-compose ps
(6）查看服务状态
(7) 功能测试
1、ldapadmin服务访问测试：（正常）
2、ldapadmin增删改查功能测试：（正常）
3、selfpasswd（自助密码修改服务）访问测试：（正常）
4、selfpasswd功能测试（原密码修改密码，忘记密码邮箱重置密码）：（正常）
（8）部署过程遇到的问题总结：
问题1：由于使用的阿里云smtp服务密码"ACwe$&745BBci"存在连续特殊字符"$&"，而docker-compose的yaml文件无法对连续的特殊字符做转义，尝试使用把密码以挂载env_file形式去传递到docker内部，但是测试此种方案发现没有生效。
解决办法：尝试对原密码进行base64位加密，然后去修改docker volume的服务器上的本地配置文件做base64的解码，以这种方式去规避连续特殊字符。（修改完之后需要重启docker服务生效 docker-compose restart）
在index.php中的email password 修改原配置为base64_decode($mail_smtp_pass);
在/data/self-service-password/data/conf/config.inc.php中的email password 修改原配置为 $mail_smtp_pass = base64_decode($mail_smtp_pass)；
问题2：发现邮件重置密码时，重置链接不完整，缺少实际的ip或域名信息。
解决办法：在修改docker volume的服务器上的本地配置/data/self-service-password/data/conf/config.inc.php文件补全重置邮件链接的前缀换成域名信息。（修改完之后需要重启docker服务生效 docker-compose restart）
三：服务接入
关于要用到的ldap目录树的解释：
1. 基础 DN（Base DN）：作用：基础 DN 是 LDAP 搜索操作的起始点，指定了搜索的根节点。用途：当执行 LDAP 搜索操作时，基础 DN 指定了搜索的起始位置，搜索将从该位置开始递归地向下搜索整个 LDAP 目录树。示例：基础 DN 可以是整个 LDAP 目录树的根节点，如 dc=example,dc=com，或者是特定组织单位（OU）的 DN。
2. 搜索 DN（Search DN）：作用：搜索 DN 是用于执行 LDAP 搜索操作时的身份验证信息，用于访问 LDAP 目录中的数据。用途：在执行 LDAP 搜索操作时，需要提供搜索 DN 和相应的密码以进行身份验证，以便访问 LDAP 数据。示例：搜索 DN 可以是具有适当权限的用户或服务账户的 DN，用于执行 LDAP 搜索操作。
（1）grafana对接ldap
1.在grafana.ini中启用ldap服务开关
enabled = true config_file = /etc/grafana/ldap.toml allow_sign_up = true # prevent synchronizing ldap users organization roles skip_org_role_sync = true
2.ldap.toml配置
# To troubleshoot and get more log info enable ldap debug logging in grafana.ini # [log] # filters = ldap:debug  [[servers]] # Ldap server host (specify multiple hosts space separated) host = "10.10.100.111" # Default port is 389 or 636 if use_ssl = true port = 389 # Set to true if LDAP server should use an encrypted TLS connection (either with STARTTLS or LDAPS) use_ssl = false # If set to true, use LDAP with STARTTLS instead of LDAPS start_tls = false # The value of an accepted TLS cipher. By default, this value is empty. Example value: ["TLS_AES_256_GCM_SHA384"]) # For a complete list of supported ciphers and TLS versions, refer to: https://go.dev/src/crypto/tls/cipher_suites.go tls_ciphers = [] # This is the minimum TLS version allowed. By default, this value is empty. Accepted values are: TLS1.1, TLS1.2, TLS1.3. min_tls_version = "" # set to true if you want to skip ssl cert validation ssl_skip_verify = false # set to the path to your root CA certificate or leave unset to use system defaults # root_ca_cert = "/path/to/certificate.crt" # Authentication against LDAP servers requiring client certificates # client_cert = "/path/to/client.crt" # client_key = "/path/to/client.key"  # Search user bind dn bind_dn = "cn=admin,dc=westhpc,dc=com" # Search user bind password # If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" bind_password = 'admin123456' # We recommend using variable expansion for the bind_password, for more info https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/#variable-expansion # bind_password = '$__env{LDAP_BIND_PASSWORD}'  # Timeout in seconds (applies to each host specified in the 'host' entry (space separated)) timeout = 10  # User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)" search_filter = "(uid=%s)"  # An array of base dns to search through search_base_dns = ["dc=westhap,dc=com"]  ## For Posix or LDAP setups that does not support member_of attribute you can define the below settings ## Please check grafana LDAP docs for examples group_search_filter = "(&(objectClass=posixGroup)(memberUid=%s))" group_search_base_dns = ["dc=westhab,dc=com"] # group_search_filter_user_attribute = "uid"  # Specify names of the ldap attributes your ldap uses [servers.attributes] name = "givenName" surname = "sn" username = "uid" member_of = "cn" email =  "email"  # Map ldap groups to grafana org roles [[servers.group_mappings]] group_dn = "cn=admins,ou=groups,dc=grafana,dc=org" org_role = "Admin" # To make user an instance admin  (Grafana Admin) uncomment line below # grafana_admin = true # The Grafana organization database id, optional, if left out the default org (id 1) will be used # org_id = 1  [[servers.group_mappings]] group_dn = "cn=editors,ou=groups,dc=grafana,dc=org" org_role = "Editor"  [[servers.group_mappings]] # If you want to match all (or no ldap groups) then you can use wildcard group_dn = "*" org_role = "Viewer"