Что такое LDAP и как настроить каталог?

1# Установка OpenLDAP сервера
2sudo apt update
3sudo apt install slapd ldap-utils
4
5# Настройка базовой конфигурации
6sudo dpkg-reconfigure slapd

 1# Запуск OpenLDAP в Docker
 2docker run -d \
 3  --name openldap \
 4  -p 389:1389 \
 5  -p 636:1636 \
 6  -e LDAP_ORGANISATION="My Company" \
 7  -e LDAP_DOMAIN="company.com" \
 8  -e LDAP_ADMIN_PASSWORD="admin" \
 9  -e LDAP_CONFIG_PASSWORD="config" \
10  -e LDAP_TLS_VERIFY_CLIENT="never" \
11  osixia/openldap:latest

 1version: '3.8'
 2services:
 3  openldap:
 4    image: osixia/openldap:latest
 5    container_name: openldap
 6    environment:
 7      LDAP_ORGANISATION: "My Company"
 8      LDAP_DOMAIN: "company.com"
 9      LDAP_ADMIN_PASSWORD: "admin"
10      LDAP_CONFIG_PASSWORD: "config"
11      LDAP_BASE_DN: "dc=company,dc=com"
12      LDAP_TLS_VERIFY_CLIENT: "never"
13    ports:
14      - "389:389"
15      - "636:636"
16    volumes:
17      - ldap_data:/var/lib/ldap
18      - ldap_config:/etc/ldap/slapd.d
19    restart: unless-stopped
20
21  phpldapadmin:
22    image: osixia/phpldapadmin:latest
23    container_name: phpldapadmin
24    environment:
25      PHPLDAPADMIN_LDAP_HOSTS: openldap
26      PHPLDAPADMIN_HTTPS: "false"
27    ports:
28      - "8080:80"
29    depends_on:
30      - openldap
31    restart: unless-stopped
32
33volumes:
34  ldap_data:
35  ldap_config:

 1# base.ldif
 2dn: ou=users,dc=company,dc=com
 3objectClass: organizationalUnit
 4ou: users
 5
 6dn: ou=groups,dc=company,dc=com
 7objectClass: organizationalUnit
 8ou: groups
 9
10dn: cn=developers,ou=groups,dc=company,dc=com
11objectClass: groupOfNames
12cn: developers
13member: cn=john.doe,ou=users,dc=company,dc=com
14
15dn: cn=john.doe,ou=users,dc=company,dc=com
16objectClass: inetOrgPerson
17cn: john.doe
18sn: Doe
19givenName: John
20mail: john.doe@company.com
21uid: john.doe
22userPassword: {SSHA}hashed-password

1# Добавление структуры
2ldapadd -x -D "cn=admin,dc=company,dc=com" -W -f base.ldif

 1# Поиск всех пользователей
 2ldapsearch -x -H ldap://localhost:389 \
 3  -D "cn=admin,dc=company,dc=com" -W \
 4  -b "ou=users,dc=company,dc=com" \
 5  "(objectClass=inetOrgPerson)"
 6
 7# Поиск конкретного пользователя
 8ldapsearch -x -H ldap://localhost:389 \
 9  -D "cn=admin,dc=company,dc=com" -W \
10  -b "dc=company,dc=com" \
11  "(uid=john.doe)"
12
13# Изменение пароля пользователя
14ldappasswd -x -H ldap://localhost:389 \
15  -D "cn=admin,dc=company,dc=com" -W \
16  "cn=john.doe,ou=users,dc=company,dc=com" -S
17
18# Удаление записи
19ldapdelete -x -H ldap://localhost:389 \
20  -D "cn=admin,dc=company,dc=com" -W \
21  "cn=john.doe,ou=users,dc=company,dc=com"

1pip install python-ldap3
2poetry add python-ldap3

 1from ldap3 import Server, Connection, ALL, SUBTREE
 2
 3# Подключение к LDAP серверу
 4server = Server('localhost', port=389, get_info=ALL)
 5conn = Connection(
 6    server,
 7    user='cn=admin,dc=company,dc=com',
 8    password='admin',
 9    auto_bind=True
10)
11
12# Поиск пользователей
13conn.search(
14    search_base='ou=users,dc=company,dc=com',
15    search_filter='(objectClass=inetOrgPerson)',
16    search_scope=SUBTREE,
17    attributes=['cn', 'mail', 'uid']
18)
19
20for entry in conn.entries:
21    print(f"User: {entry.cn}, Email: {entry.mail}")
22
23# Аутентификация пользователя
24def authenticate_user(username, password):
25    user_dn = f"cn={username},ou=users,dc=company,dc=com"
26    try:
27        user_conn = Connection(server, user=user_dn, password=password)
28        return user_conn.bind()
29    except:
30        return False
31
32# Добавление нового пользователя
33user_dn = 'cn=jane.smith,ou=users,dc=company,dc=com'
34user_attrs = {
35    'objectClass': ['inetOrgPerson'],
36    'cn': 'jane.smith',
37    'sn': 'Smith',
38    'givenName': 'Jane',
39    'mail': 'jane.smith@company.com',
40    'uid': 'jane.smith',
41    'userPassword': 'password123'
42}
43
44conn.add(user_dn, attributes=user_attrs)
45
46conn.unbind()

1pip install django-auth-ldap
2poetry add django-auth-ldap

 1# settings.py
 2import ldap
 3from django_auth_ldap.config import LDAPSearch, GroupOfNamesType
 4
 5AUTHENTICATION_BACKENDS = [
 6    'django_auth_ldap.backend.LDAPBackend',
 7    'django.contrib.auth.backends.ModelBackend',
 8]
 9
10AUTH_LDAP_SERVER_URI = "ldap://localhost:389"
11AUTH_LDAP_BIND_DN = "cn=admin,dc=company,dc=com"
12AUTH_LDAP_BIND_PASSWORD = "admin"
13
14AUTH_LDAP_USER_SEARCH = LDAPSearch(
15    "ou=users,dc=company,dc=com",
16    ldap.SCOPE_SUBTREE,
17    "(uid=%(user)s)"
18)
19
20AUTH_LDAP_USER_ATTR_MAP = {
21    "first_name": "givenName",
22    "last_name": "sn",
23    "email": "mail"
24}
25
26AUTH_LDAP_GROUP_SEARCH = LDAPSearch(
27    "ou=groups,dc=company,dc=com",
28    ldap.SCOPE_SUBTREE,
29    "(objectClass=groupOfNames)"
30)
31
32AUTH_LDAP_GROUP_TYPE = GroupOfNamesType()
33AUTH_LDAP_REQUIRE_GROUP = None
34AUTH_LDAP_DENY_GROUP = None
35
36AUTH_LDAP_USER_FLAGS_BY_GROUP = {
37    "is_active": "cn=active,ou=groups,dc=company,dc=com",
38    "is_staff": "cn=staff,ou=groups,dc=company,dc=com",
39    "is_superuser": "cn=superuser,ou=groups,dc=company,dc=com"
40}

 1# syncprov.ldif для master сервера
 2dn: cn=module,cn=config
 3objectClass: olcModuleList
 4cn: module
 5olcModulePath: /usr/lib/ldap
 6olcModuleLoad: syncprov.la
 7
 8dn: olcOverlay=syncprov,olcDatabase={1}mdb,cn=config
 9objectClass: olcOverlayConfig
10objectClass: olcSyncProvConfig
11olcOverlay: syncprov

 1# Проверка статуса сервера
 2ldapsearch -x -H ldap://localhost:389 -s base -b "" \
 3  "(objectclass=*)" namingContexts
 4
 5# Мониторинг производительности
 6ldapsearch -x -H ldap://localhost:389 \
 7  -D "cn=admin,dc=company,dc=com" -W \
 8  -b "cn=monitor" \
 9  "(objectclass=*)"
10
11# Проверка подключений
12netstat -an | grep :389

1# Генерация сертификата
2openssl req -new -x509 -nodes -out ldap-cert.pem \
3  -keyout ldap-key.pem -days 365
4
5# Настройка TLS в slapd.conf
6TLSCertificateFile /etc/ssl/certs/ldap-cert.pem
7TLSCertificateKeyFile /etc/ssl/private/ldap-key.pem
8TLSCACertificateFile /etc/ssl/certs/ca-cert.pem