搭建ldap自助修改密码系统--Self Service Password

被刻印的时光 ゝ 提交于 2020-08-14 03:45:12

搭建ldap自助修改密码系统--Self Service Password
choulanlan
关注
0人评论
2382人阅读
2019-08-15 20:52:31




服务安装:

安装依赖:yum install php70-ldap.x86_64 -y (版本尽量大于5.3,否则会提示更新php程序)
yum install httpd -y
安装Self Service Password:yum install https://ltb-project.org/rpm/6Server/noarch/self-service-password-1.1-1.el6.noarch.rpm

    配置apache: /etc/httpd/conf.d/self-service-password.conf

        NameVirtualHost *:80

<VirtualHost *:80>
ServerName ssp.xinniu.com

    DocumentRoot /usr/share/self-service-password
    DirectoryIndex index.php

    AddDefaultCharset UTF-8

<Directory "/usr/share/self-service-password">
AllowOverride None
Allow from all
</Directory>
LogLevel warn
ErrorLog /var/log/httpd/ssp_error_log
CustomLog /var/log/httpd/ssp_access_log combined
</VirtualHost>






配置Self Service Password,支持密码修改和邮件重置: vim /usr/share/self-service-password/conf/config.inc.php

这个文件配置项太多了,只写一下改动的

$ldap_url = "ldap://172.xx.xx.xx:389";
$ldap_starttls = false;
$ldap_binddn = "cn=admin,dc=xxxx,dc=com";
$ldap_bindpw = "****";
$ldap_base = "dc=xxxx,dc=com";
$ldap_login_attribute = "uid";
$ldap_fullname_attribute = "cn";
$ldap_filter = "(&(objectClass=person)($ldap_login_attribute={login}))";
$mail_from = "msg_data@xxxx.com";
$mail_from_name = "Self Service Password";
$mail_signature = "";









$notify_on_change = true;
https://github.com/PHPMailer/PHPMailer)
$mail_sendmailpath = '/usr/sbin/sendmail';
$mail_protocol = 'smtp';
$mail_smtp_debug = 0;
$mail_debug_format = 'html';
$mail_smtp_host = 'localhost';
$mail_smtp_auth = true;
$mail_smtp_user = 'msg_data@xxxxx.com';
$mail_smtp_pass = 'xxxxx;
$mail_smtp_port = 25;









keyphrase = "secret";

配完后
systemctl restart httpd

完成之后,测试系统是否可以使用
打开页面
搭建ldap自助修改密码系统--Self Service Password
d搭建ldap自助修改密码系统--Self Service Password
修改密码时不用输入整个dn,直接输入前缀就可以了



测试修改密码时,报错,ldap服务器拒绝我们修改的密码,经过查看日志加上自己手动验证,发现普通用户没有修改密码的权限。
然后查看ldap官方的手册:http://www.openldap.org/doc/admin24/access-control.html

研究后发现需要修改ldap的条目
文件添加ACL 信息,问题解决,添加命令如下:

ldapmodify -Y EXTERNAL -H ldapi:/// -f updatepass.ldif

updatepass.ldif 文件内容如下:

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: to attrs=userPassword
by self =xw
by anonymous auth
by * none





olcAccess: to
by self write
by users read
by


none

然后试下真的可以修改密码了

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!