OpenLDAP 2.4 管理员入门指南

需积分: 15 191 浏览量更新于2024-07-25 收藏 1.45MB PDF 举报

"OpenLDAP Software 2.4 管理员指南提供了关于如何管理和配置 OpenLDAP 软件的详细信息，适用于那些希望在他们的系统中实施 LDAP 目录服务的专业人员。" OpenLDAP Software 2.4 是一个开源的 LDAP (Lightweight Directory Access Protocol) 实现，用于构建目录服务，这种服务可以存储和管理大量的结构化信息，如用户账号、组织结构等。本指南主要针对管理员，旨在帮助他们理解 LDAP 的工作原理以及如何有效地部署和维护 OpenLDAP 实例。文档的前言部分介绍了版权信息，并概述了文档的范围，包括对贡献者的感谢以及可能的修订信息。文档的核心是介绍 LDAP 和 OpenLDAP 相关概念，以便管理员能够判断何时应该使用 LDAP 以及它与其它数据库系统的区别。 1.1 节定义了目录服务，解释了其作为信息存储和查找的中央仓库的角色。1.2 节则深入到 LDAP 本身，解释了 LDAP 是一种轻量级的协议，用于访问和操作目录信息。1.3 和 1.4 节分别讨论了适合使用 LDAP 的场景和不适合的场景，帮助读者做出决策。1.5 节描述了 LDAP 的运作机制，1.6 节提及了 X.500 标准及其与 LDAP 的关系，1.7 节对比了 LDAPv2 和 LDAPv3 的差异，而 1.8 节探讨了 LDAP 与 RDBMS（关系型数据库管理系统）的区别，强调了各自的优势。 1.9 节介绍了 slapd，它是 OpenLDAP 的核心守护进程，负责处理 LDAP 请求和目录数据的管理。这部分内容解释了 slapd 的功能和用途。接下来的章节提供了一个快速入门指南，让管理员能够快速搭建 OpenLDAP 环境。第 3 章则讨论了不同的配置选择，如本地目录服务、带有引用的本地服务、复制的目录服务和分布式本地目录服务，这为管理员提供了根据需求定制解决方案的指导。第 4 章详细阐述了 OpenLDAP 软件的构建和安装过程，包括获取软件、提取文件、所需的前置软件（如 TLS、SASL、Kerberos、数据库软件、线程库和 TCP Wrappers）以及运行配置脚本的步骤。这部分内容对于初次接触 OpenLDAP 的管理员来说尤其重要，因为他们需要确保所有依赖项都已正确安装和配置。 OpenLDAP Software 2.4 Administrator's Guide 是一个全面的资源，涵盖了从基础概念到实际部署的各个方面，为管理员提供了构建和管理高效、可靠的 LDAP 目录服务的工具和知识。

The OpenLDAP Project would also like to thank the University of Michigan LDAP Team for building the

foundation of LDAP software and information to which OpenLDAP Software is built upon. This document is

based upon University of Michigan document: The SLAPD and SLURPD Administrators Guide.

Amendments

Suggested enhancements and corrections to this document should be submitted using the OpenLDAP Issue

Tracking System (http://www.openldap.org/its/).

About this document

This document was produced using the Simple Document Format (SDF) documentation system

(http://search.cpan.org/src/IANC/sdf-2.001/doc/catalog.html) developed by Ian Clatworthy. Tools for SDF are

available from CPAN (http://search.cpan.org/search?query=SDF&mode=dist).

OpenLDAP Software 2.4 Administrator's Guide

1. Introduction to OpenLDAP Directory Services

This document describes how to build, configure, and operate OpenLDAP Software to provide directory

services. This includes details on how to configure and run the Standalone LDAP Daemon, slapd(8). It is

intended for new and experienced administrators alike. This section provides a basic introduction to directory

services and, in particular, the directory services provided by slapd(8). This introduction is only intended to

provide enough information so one might get started learning about LDAP, X.500, and directory services.

1.1. What is a directory service?

A directory is a specialized database specifically designed for searching and browsing, in additional to

supporting basic lookup and update functions.

Note: A directory is defined by some as merely a database optimized for read access. This definition, at best,

is overly simplistic.

Directories tend to contain descriptive, attribute-based information and support sophisticated filtering

capabilities. Directories generally do not support complicated transaction or roll-back schemes found in

database management systems designed for handling high-volume complex updates. Directory updates are

typically simple all-or-nothing changes, if they are allowed at all. Directories are generally tuned to give quick

response to high-volume lookup or search operations. They may have the ability to replicate information

widely in order to increase availability and reliability, while reducing response time. When directory

information is replicated, temporary inconsistencies between the replicas may be okay, as long as

inconsistencies are resolved in a timely manner.

There are many different ways to provide a directory service. Different methods allow different kinds of

information to be stored in the directory, place different requirements on how that information can be

referenced, queried and updated, how it is protected from unauthorized access, etc. Some directory services

are local, providing service to a restricted context (e.g., the finger service on a single machine). Other services

are global, providing service to a much broader context (e.g., the entire Internet). Global services are usually

distributed, meaning that the data they contain is spread across many machines, all of which cooperate to

provide the directory service. Typically a global service defines a uniform namespace which gives the same

view of the data no matter where you are in relation to the data itself.

A web directory, such as provided by the Open Directory Project <http://dmoz.org>, is a good example of a

directory service. These services catalog web pages and are specifically designed to support browsing and

searching.

While some consider the Internet Domain Name System (DNS) is an example of a globally distributed

directory service, DNS is not browseable nor searchable. It is more properly described as a globally

distributed lookup service.

1.2. What is LDAP?

LDAP stands for Lightweight Directory Access Protocol. As the name suggests, it is a lightweight protocol

for accessing directory services, specifically X.500-based directory services. LDAP runs over TCP/IP or other

connection oriented transfer services. LDAP is an IETF Standard Track protocol and is specified in

"Lightweight Directory Access Protocol (LDAP) Technical Specification Road Map" RFC4510.

Figure 1.2: LDAP directory tree (Internet naming)

In addition, LDAP allows you to control which attributes are required and allowed in an entry through the use

of a special attribute called objectClass. The values of the objectClass attribute determine the

schema rules the entry must obey.

How is the information referenced? An entry is referenced by its distinguished name, which is constructed by

taking the name of the entry itself (called the Relative Distinguished Name or RDN) and concatenating the

names of its ancestor entries. For example, the entry for Barbara Jensen in the Internet naming example above

has an RDN of uid=babs and a DN of uid=babs,ou=People,dc=example,dc=com. The full DN

format is described in RFC4514, "LDAP: String Representation of Distinguished Names."

How is the information accessed? LDAP defines operations for interrogating and updating the directory.

Operations are provided for adding and deleting an entry from the directory, changing an existing entry, and

changing the name of an entry. Most of the time, though, LDAP is used to search for information in the

directory. The LDAP search operation allows some portion of the directory to be searched for entries that

match some criteria specified by a search filter. Information can be requested from each entry that matches the

criteria.

For example, you might want to search the entire directory subtree at and below dc=example,dc=com for

people with the name Barbara Jensen, retrieving the email address of each entry found. LDAP lets you

do this easily. Or you might want to search the entries directly below the st=California,c=US entry for

organizations with the string Acme in their name, and that have a fax number. LDAP lets you do this too. The

next section describes in more detail what you can do with LDAP and how it might be useful to you.

How is the information protected from unauthorized access? Some directory services provide no protection,

allowing anyone to see the information. LDAP provides a mechanism for a client to authenticate, or prove its

identity to a directory server, paving the way for rich access control to protect the information the server

contains. LDAP also supports data security (integrity and confidentiality) services.

OpenLDAP Software 2.4 Administrator's Guide

剩余263页未读，继续阅读

公子乾

粉丝: 0
资源: 6

OpenLDAP 2.4 管理员入门指南

openldap-2.4新主从配置详细介绍（1）

openldap 2.4

OpenLDAP2.4安装与配置

源码编译安装openldap

ubuntu22.04安装svn对接openldap

windows 安装openldap

centos下安装openldap

centos中安装openldap

openldap windows高可用

openldap 集成windows AD认证

最新资源