openldap的memberof属性，有很多应用在接入用户组的时候，会判断memberof这个属性，属于哪个组，例如apache kylin，grafana等，配置了ldap用户组的角色以后，只需要把用户添加到相应的组即可，用户就有应用的权限了
1.配置ldap
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
| [dev] [root@dev-bigdata-haproxy memof]# cat memof.ldif
dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
olcModuleLoad: memberof.la
olcModulePath: /usr/lib64/openldap
dn: olcOverlay={0}memberof,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: memberof
olcMemberOfDangling: ignore
olcMemberOfRefInt: TRUE
olcMemberOfGroupOC: groupOfNames
olcMemberOfMemberAD: member
olcMemberOfMemberOfAD: memberOf
[dev] [root@dev-bigdata-haproxy memof]# cat refint1.ldif
dn: cn=module{0},cn=config
add: olcmoduleload
olcmoduleload: refint
[dev] [root@dev-bigdata-haproxy memof]# cat refint2.ldif
dn: olcOverlay={1}refint,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
objectClass: top
olcOverlay: {1}refint
olcRefintAttribute: memberof member manager owner
|
2.执行：
1
2
3
4
5
6
7
8
9
10
| [dev] [root@dev-bigdata-haproxy-2 myconf]# ldapadd -Q -Y EXTERNAL -H ldapi:/// -f memof.ldif
adding new entry "cn=module,cn=config"
adding new entry "olcOverlay={0}memberof,olcDatabase={2}hdb,cn=config"
[dev] [root@dev-bigdata-haproxy-2 myconf]# ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f refint1.ldif
modifying entry "cn=module{0},cn=config"
[dev] [root@dev-bigdata-haproxy-2 myconf]# ldapadd -Q -Y EXTERNAL -H ldapi:/// -f refint2.ldif
adding new entry "olcOverlay={1}refint,olcDatabase={2}hdb,cn=config"
|
3.验证结果
1
2
3
4
5
6
7
8
9
| [dev] [root@dev-bigdata-haproxy memof]# ldapsearch -LL -Y EXTERNAL -H ldapi:/// "(uid=xiaomao)" -b dc=oneops,dc=com memberOf
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
version: 1
dn: uid=xiaomao,ou=People,dc=oneops,dc=com
memberOf: cn=Kylin_Admin_Group,ou=Group,dc=oneops,dc=com
memberOf: cn=Admin,ou=Group,dc=oneops,dc=com
|
通过上面命令查到memberOf有显示说明配置成功。
需要注意的是：只有新建的用户组才能生效，对于之前的用户组，需要重新添加才行。
