1
2
3
4

dn: <识别名>
<属性 1>: <值 1>
<属性 2>: <值 2>
...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89

version: '2'
services:
  openldap:
    image: osixia/openldap:1.5.0  ### 如果有私有仓库可以从自己的私有仓库拉取镜像
    container_name: openldap
    restart: always
    environment:
      LDAP_LOG_LEVEL: "256"
      LDAP_ORGANISATION: "ndzzmc"   ### 您的组织名称
      LDAP_DOMAIN: "gsymgsym.com"    ### 公司域名
      LDAP_BASE_DN: "dc=gsymgsym,dc=com"   ### 根据域名组成
      LDAP_ADMIN_PASSWORD: "Aa123+Bb"   ### 密码自己来设置
      LDAP_CONFIG_PASSWORD: "Aa123+BbCc"
      LDAP_READONLY_USER: "false"
      #LDAP_READONLY_USER_USERNAME: "readonly"
      #LDAP_READONLY_USER_PASSWORD: "readonly"
      LDAP_RFC2307BIS_SCHEMA: "false"
      LDAP_BACKEND: "mdb"
      #LDAP_TLS: "true"
      #LDAP_TLS_CRT_FILENAME: "zaq.test.pem"
      #LDAP_TLS_KEY_FILENAME: "zaq.test.key"
      #LDAP_TLS_DH_PARAM_FILENAME: "dhparam.pem"
      #LDAP_TLS_CA_CRT_FILENAME: "ca.crt"
      #LDAP_TLS_ENFORCE: "false"
      #LDAP_TLS_CIPHER_SUITE: "SECURE256:-VERS-SSL3.0"
      # LDAP_TLS_VERIFY_CLIENT: "demand"
      LDAP_REPLICATION: "false"
      #LDAP_REPLICATION_CONFIG_SYNCPROV: 'binddn="cn=admin,cn=config" bindmethod=simple credentials="$$LDAP_CONFIG_PASSWORD" searchbase="cn=config" type=refreshAndPersist retry="60 +" timeout=1 starttls=critical'
      #LDAP_REPLICATION_DB_SYNCPROV: 'binddn="cn=admin,$$LDAP_BASE_DN" bindmethod=simple credentials="$$LDAP_ADMIN_PASSWORD" searchbase="$$LDAP_BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="60 +" timeout=1 starttls=critical'
      #LDAP_REPLICATION_HOSTS: "#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']"
      KEEP_EXISTING_CONFIG: "false"
      LDAP_REMOVE_CONFIG_AFTER_SETUP: "true"
      #LDAP_SSL_HELPER_PREFIX: "ldap"
    tty: true
    stdin_open: true
    volumes:
      - /opt/openldap/ldap:/var/lib/ldap
      - /opt/openldap/slapd.d:/etc/ldap/slapd.d
      - /opt/openldap/certs:/container/service/lapd/assets/certs
    ports:
      - "389:389"
      - "636:636"
    # For replication to work correctly, domainname and hostname must be
    # set correctly so that "hostname"."domainname" equates to the
    # fully-qualified domain name for the host.
    domainname: "gsymgsym.com"
    hostname: "ldap-server"
  phpldapadmin:
    image: osixia/phpldapadmin:latest
    container_name: phpldapadmin
    restart: always
    environment:
      PHPLDAPADMIN_LDAP_HOSTS: "openldap"   ### 如果部署后登录不进去有可能是这里出了问题，直接换为部署openldap服务的可达IP试试
      PHPLDAPADMIN_HTTPS: "false"
    ports:
      - "50081:80"
    depends_on:
      - openldap
  self-service-password:
    container_name: self-service-password
    image: tiredofit/self-service-password:latest
    restart: always
    ports:
      - "50080:80"
    environment:
      - LDAP_SERVER=ldap://openldap:389
      - LDAP_BINDDN=cn=admin,dc=gsymgsym,dc=com
      - LDAP_BINDPASS=XXXX
      - LDAP_BASE_SEARCH=dc=gsymgsym,dc=com
      - MAIL_FROM=it@open.com
      - MAIL_FROM_NAME=账号自助服务平台
      - SMTP_DEBUG=0
      - SMTP_HOST=smtp.qiye.aliyun.com
      - SMTP_USER=it@open.com
      - SMTP_PASS=jYda52VZ8Ftw1111
      - SMTP_PORT=465
      - SMTP_SECURE_TYPE=ssl
      - SMTP_AUTH_ON=true
      - NOTIFY_ON_CHANGE=true
    volumes:
      - /etc/localtime:/etc/localtime
      - /opt/openldap/self-service-password/htdocs:/www/ssp
      - /opt/openldap/self-service-password/logs:/www/logs
    deploy:
      resources:
        limits:
           memory: 2G
        reservations:
           memory: 512M

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

##By default the auth mode is db_auth, i.e. the credentials are stored in a local database.
#Set it to ldap_auth if you want to verify a user's credentials against an LDAP server.
auth_mode = ldap_auth
 
#The url for an ldap endpoint.
ldap_url = xx.xx.xx.xx
 
#A user's DN who has the permission to search the LDAP/AD server.
#If your LDAP/AD server does not support anonymous search, you should configure this DN and ldap_search_pwd.
ldap_searchdn = cn=admin,dc=zaq,dc=test
 
#the password of the ldap_searchdn
ldap_search_pwd = xxx
 
#The base DN from which to look up a user in LDAP/AD
ldap_basedn = dc=zaq,dc=com
 
#Search filter for LDAP/AD, make sure the syntax of the filter is correct.
#ldap_filter = (objectClass=person)
 
# The attribute used in a search to match a user, it could be uid, cn, email, sAMAccountName or other attributes depending on your LDAP/AD
ldap_uid = uid
 
#the scope to search for users, 0-LDAP_SCOPE_BASE, 1-LDAP_SCOPE_ONELEVEL, 2-LDAP_SCOPE_SUBTREE
ldap_scope = 2
 
#Timeout (in seconds)  when connecting to an LDAP Server. The default value (and most reasonable) is 5 seconds.
ldap_timeout = 5
 
#Verify certificate from LDAP server
ldap_verify_cert = true
 
#The base dn from which to lookup a group in LDAP/AD
ldap_group_basedn = ou=IT,dc=shileizcc,dc=com
 
#filter to search LDAP/AD group
ldap_group_filter = objectclass=group
 
#The attribute used to name a LDAP/AD group, it could be cn, name
ldap_group_gid = cn
 
#The scope to search for ldap groups. 0-LDAP_SCOPE_BASE, 1-LDAP_SCOPE_ONELEVEL, 2-LDAP_SCOPE_SUBTREE
ldap_group_scope = 2

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

package com.study.ldapp;

public class LdapUser {

    public String cn;
    public String sn;
    public String uid;
    public String userPassword;
    public String displayName;
    public String mail;
    public String description;
    public String uidNumber;
    public String gidNumber;
    /**忽略get\set方法**/
}

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296

package com.study.ldapp;
import java.util.ArrayList;
import java.util.Hashtable;
import java.util.List;

import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.BasicAttribute;
import javax.naming.directory.BasicAttributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.ModificationItem;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.Control;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;

public class LdapStore {
    public static void main(String[] args) throws NamingException {
        String url = "ldap://localhost:389/";
        String basedn = "dc=gsymgsym,dc=com";  // basedn
        String root = "cn=admin,dc=gsymgsym,dc=com";  // 用户
        String pwd ="Aa123+Bb";  // pwd

        LdapContext ctx=ldapConnect(url,root,pwd);//集团 ldap认证
        List<LdapUser> jtlm=readLdap(ctx,basedn);//获取集团ldap中用户信息

        url = "ldap://localhost:389/";
        basedn = "dc=gsymgsym,dc=com";  // basedn
        root = "cn=admin,dc=gsymgsym,dc=com";  // 用户
        pwd ="Aa123+Bb";  // pwd
        ctx=ldapConnect(url,root,pwd);//cdh ldap认证
        List<LdapUser> cdhlm=readLdap(ctx,basedn);//获取cdh ldap中用户信息
        //通过时间戳初始化一个uid
        long init_uid= getNowTimeStamp();
        //循环集团ldap用户
        for(int i=0;i<jtlm.size();i++){
            LdapUser jtu=jtlm.get(i);
            init_uid=init_uid+i;//生成一个唯一的ID
            jtu.setGidNumber(init_uid+"");//设置gid
            jtu.setUidNumber(init_uid+"");//设置uid
            // if(!"testwx".equals(jtu.getUid()))
            //	 continue;
            boolean not_exist =true;
            //循环匹配cdh ldap用户
            for(int j=0;j<cdhlm.size();j++){
                LdapUser cdhu=cdhlm.get(j);
                //双方用户存在并且密码相同
                if( jtu.getUid().equals(cdhu.getUid()) && jtu.getUserPassword().equals(cdhu.getUserPassword()) ){
                    not_exist=false;
                    break;
                }else if(jtu.getUid().equals(cdhu.getUid()) && !jtu.getUserPassword().equals(cdhu.getUserPassword())){//双方用户存在,但是密码不同
                    modifyInformation(jtu,ctx);//修改cdh ldap的密码,改为集团ldap的用户密码
                    not_exist=false;
                    break;
                }
            }
            //cdh ldap中没有此用户就添加
            if(not_exist){
                boolean b = addGoups(jtu,ctx);
                if(b)
                    addUser(jtu,ctx);
            }
        }
        if(ctx!=null)
            ctx.close();
    }
    /**
     * 添加组
     * @param lu
     * @param ctx
     * @return
     */
    public static boolean addGoups(LdapUser lu,LdapContext ctx) {
        BasicAttributes attrsbu = new BasicAttributes();
        BasicAttribute objclassSet = new BasicAttribute("objectClass");
        objclassSet.add("posixGroup");
        objclassSet.add("top");
        attrsbu.put(objclassSet);
        attrsbu.put("cn", lu.getCn());//显示账号
        attrsbu.put("userPassword", "{crypt}x");//显示

        attrsbu.put("gidNumber",lu.getGidNumber());/*显示组id */
        attrsbu.put("memberUid", lu.getCn());//显示账号
        try {
            String cn="cn="+lu.getCn()+",ou=Group,dc=tcjf,dc=com";
            System.out.println(cn);
            ctx.createSubcontext(cn, attrsbu);
            System.out.println("添加用户group成功");
            return true;
        } catch (Exception e) {
            System.out.println("添加用户group失败");
            e.printStackTrace();
            return false;
        }
    }

    /**
     * 添加用户
     * @param lu
     * @param ctx
     * @return
     */
    public static boolean addUser(LdapUser lu,LdapContext ctx) {
        BasicAttributes attrsbu = new BasicAttributes();
        BasicAttribute objclassSet = new BasicAttribute("objectClass");
        // objclassSet.add("account");
        objclassSet.add("posixAccount");
        objclassSet.add("inetOrgPerson");
        objclassSet.add("top");
        objclassSet.add("shadowAccount");
        attrsbu.put(objclassSet);
        attrsbu.put("uid",  lu.getUid());//显示账号
        attrsbu.put("sn", lu.getSn());//显示姓名
        attrsbu.put("cn", lu.getCn());//显示账号
        attrsbu.put("gecos", lu.getCn());//显示账号
        attrsbu.put("userPassword", lu.getUserPassword());//显示密码
        attrsbu.put("displayName", lu.getDisplayName());//显示描述
        attrsbu.put("mail", lu.getMail());//显示邮箱
        attrsbu.put("homeDirectory", "/home/" + lu.getCn());//显示home地址
        attrsbu.put("loginShell", "/bin/bash");//显示shell方式
        attrsbu.put("uidNumber", lu.getUidNumber());/*显示id */
        attrsbu.put("gidNumber", lu.getGidNumber());/*显示组id */

        try {
            String dn="uid="+lu.getCn()+",ou=People,dc=tcjf,dc=com";
            System.out.println(dn);
            ctx.createSubcontext(dn, attrsbu);
            System.out.println("添加用户成功");
            return true;
        } catch (Exception e) {
            System.out.println("添加用户失败");
            e.printStackTrace();
            return false;
        }
    }
    /**
     * 修改属性
     * @param lu
     * @param ctx
     * @return
     */
    public static boolean modifyInformation(LdapUser lu,LdapContext ctx) {
        try {
            ModificationItem[] mods = new ModificationItem[1];
            String dn="uid="+lu.getCn()+",ou=People,dc=tcjf,dc=com";
            /*添加属性*/
            //  Attribute attr0 = new BasicAttribute("description", "测试");
            //  mods[0] = new ModificationItem(DirContext.ADD_ATTRIBUTE,attr0);

            /*修改属性*/
            Attribute attr0 = new BasicAttribute("userPassword", lu.getUserPassword());
            mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, attr0);

            /*删除属性*/
            //  Attribute attr0 = new BasicAttribute("description", "测试");
            //  mods[0] = new ModificationItem(DirContext.REMOVE_ATTRIBUTE, attr0);
            ctx.modifyAttributes(dn, mods);
            System.out.println("修改成功");
            return true;
        } catch (NamingException ne) {
            System.out.println("修改失败");
            ne.printStackTrace();
            return false;
        }

    }

    /**
     * 删除
     * @param dn
     * @param ctx
     * @return
     */
    public  static boolean delete(String dn,LdapContext ctx) {
        try {
            ctx.destroySubcontext(dn);
            return true;
        } catch (Exception e) {
            e.printStackTrace();
            return false;
        }
    }
    /**
     * 获取ldap认证
     * @param url
     * @param root
     * @param pwd
     * @return
     */
    public static LdapContext ldapConnect(String url,String root,String pwd){
        String factory = "com.sun.jndi.ldap.LdapCtxFactory";
        String simple="simple";
        Hashtable<String, String> env = new Hashtable<String, String>();
        env.put(Context.INITIAL_CONTEXT_FACTORY,factory);
        env.put(Context.PROVIDER_URL, url);
        env.put(Context.SECURITY_AUTHENTICATION, simple);
        env.put(Context.SECURITY_PRINCIPAL, root);
        env.put(Context.SECURITY_CREDENTIALS, pwd);
        LdapContext ctx = null;
        Control[] connCtls = null;
        try {
            ctx = new InitialLdapContext(env, connCtls);
            System.out.println( "认证成功:"+url);
        }catch (javax.naming.AuthenticationException e) {
            System.out.println("认证失败：");
            e.printStackTrace();
        } catch (Exception e) {
            System.out.println("认证出错：");
            e.printStackTrace();
        }
        return ctx;
    }

    /**
     * 获取用户信息
     * @param ctx
     * @param basedn
     * @return
     */
    public static List<LdapUser> readLdap(LdapContext ctx,String basedn){

        List<LdapUser> lm=new ArrayList<LdapUser>();
        try {
            if(ctx!=null){
                //过滤条件
                String filter = "(&(objectClass=*)(uid=*))";
                String[] attrPersonArray = { "uid", "userPassword", "displayName", "cn", "sn", "mail", "description" };
                SearchControls searchControls = new SearchControls();//搜索控件
                searchControls.setSearchScope(2);//搜索范围
                searchControls.setReturningAttributes(attrPersonArray);
                //1.要搜索的上下文或对象的名称；2.过滤条件，可为null，默认搜索所有信息；3.搜索控件，可为null，使用默认的搜索控件
                NamingEnumeration<SearchResult> answer = ctx.search(basedn, filter.toString(),searchControls);
                while (answer.hasMore()) {
                    SearchResult result = (SearchResult) answer.next();
                    NamingEnumeration<? extends Attribute> attrs = result.getAttributes().getAll();
                    LdapUser lu=new LdapUser();
                    while (attrs.hasMore()) {
                        Attribute attr = (Attribute) attrs.next();
                        if("userPassword".equals(attr.getID())){
                            Object value = attr.get();
                            lu.setUserPassword(new String((byte [])value));
                        }else if("uid".equals(attr.getID())){
                            lu.setUid(attr.get().toString());
                        }else if("displayName".equals(attr.getID())){
                            lu.setDisplayName(attr.get().toString());
                        }else if("cn".equals(attr.getID())){
                            lu.setCn(attr.get().toString());
                        }else if("sn".equals(attr.getID())){
                            lu.setSn(attr.get().toString());
                        }else if("mail".equals(attr.getID())){
                            lu.setMail(attr.get().toString());
                        }else if("description".equals(attr.getID())){
                            lu.setDescription(attr.get().toString());
                        }
                    }
                    if(lu.getUid()!=null)
                        lm.add(lu);

                }
            }
        }catch (Exception e) {
            System.out.println("获取用户信息异常:");
            e.printStackTrace();
        }

        return lm;
    }

    /**
     * string 转 数值
     * @param m
     * @return
     */
    public static String strToint(String m){
        if(m==null || "".equals(m))
            return "-1";
        char [] a=m.toCharArray();
        StringBuffer sbu = new StringBuffer();
        for(char c:a)
            sbu.append((int)c);
        System.out.println(sbu.toString());
        return sbu.toString();
    }
    /**
     * 获取时间戳
     * @return
     */
    public static long getNowTimeStamp() {
        long time = System.currentTimeMillis();
        time =  time / 1000;
        return time;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

1MOyoQIABAAAAAAAAAAAAAAABAAAAAAAa8RFZ/PgCAA4AAAAOAAAAAIAAABFAAA0TwRAAIAGAAB/
AAABfwAAAQi1AYXkU/U2AAAAAIAC//+TJQAAAgT/1wEDAwgBAQQCa8RFZyfhCAA4AAAAOAAAAAIA
AABFAAA0TwdAAIAGAAB/AAABfwAAAQGFCLUCKHpG5FP1N4AS//8WpgAAAgT/1wEDAwgBAQQCa8RF
Z0fhCAAsAAAALAAAAAIAAABFAAAoTwhAAIAGAAB/AAABfwAAAQi1AYXkU/U3Aih6R1AQJ/kppAAA
a8RFZyvjCABdAAAAXQAAAAIAAABFAABZTwlAAIAGAAB/AAABfwAAAQi1AYXkU/U3Aih6R1AYJ/l9
MgAAMC8CAQFgKgIBAwQbY249YWRtaW4sZGM9Z3N5bWdzeW0sZGM9Y29tgAhBYTEyMytCYmvERWdG
4wgALAAAACwAAAACAAAARQAAKE8KQACABgAAfwAAAX8AAAEBhQi1Aih6R+RT9WhQECf5KXMAAGvE
RWex5wgAOgAAADoAAAACAAAARQAANk8LQACABgAAfwAAAX8AAAEBhQi1Aih6R+RT9WhQGCf55eQA
ADAMAgEBYQcKAQAEAAQAa8RFZ8rnCAAsAAAALAAAAAIAAABFAAAoTwxAAIAGAAB/AAABfwAAAQi1
AYXkU/VoAih6VVAQJ/kpZQAAa8RFZ0PqCADFAAAAxQAAAAIAAABFAADBTw1AAIAGAAB/AAABfwAA
AQi1AYXkU/VoAih6VVAYJ/kf0AAAMIGWAgECY3QEEmRjPWdzeW1nc3ltLGRjPWNvbQoBAgoBAwIB
AAIBAAEBAKAShwtvYmplY3RDbGFzc4cDdWlkMDsEA3VpZAQMdXNlclBhc3N3b3JkBAtkaXNwbGF5
TmFtZQQCY24EAnNuBARtYWlsBAtkZXNjcmlwdGlvbqAbMBkEFzIuMTYuODQwLjEuMTEzNzMwLjMu
NC4ya8RFZ1/qCAAsAAAALAAAAAIAAABFAAAoTw5AAIAGAAB/AAABfwAAAQGFCLUCKHpV5FP2AVAQ
J/gozQAAa8RFZ7ftCAA6AAAAOgAAAAIAAABFAAA2Tw9AAIAGAAB/AAABfwAAAQGFCLUCKHpV5FP2
AVAYJ/jkOgAAMAwCAQJlBwoBAAQABABrxEVn2O0IACwAAAAsAAAAAgAAAEUAAChPEEAAgAYAAH8A
AAF/AAABCLUBheRT9gECKHpjUBAn+Si+AABrxEVny+4IAFAAAABQAAAAAgAAAEUAAExPEUAAgAYA
AH8AAAF/AAABCLUBheRT9gECKHpjUBgn+YcEAAAwIgIBA0IAoBswGQQXMi4xNi44NDAuMS4xMTM3
MzAuMy40LjJrxEVn4e4IACwAAAAsAAAAAgAAAEUAAChPEkAAgAYAAH8AAAF/AAABAYUItQIoemPk
U/YlUBAn+CibAABrxEVnQ+8IACwAAAAsAAAAAgAAAEUAAChPE0AAgAYAAH8AAAF/AAABCLUBheRT
9iUCKHpjUBEn+SiZAABrxEVnU+8IACwAAAAsAAAAAgAAAEUAAChPFEAAgAYAAH8AAAF/AAABAYUI
tQIoemPkU/YmUBAn+CiaAABrxEVndvIIACwAAAAsAAAAAgAAAEUAAChPFUAAgAYAAH8AAAF/AAAB
AYUItQIoemPkU/YmUBEn+CiZAABrxEVnnvIIACwAAAAsAAAAAgAAAEUAAChPFkAAgAYAAH8AAAF/
AAABCLUBheRT9iYCKHpkUBAn+SiYAAA=