轻松了解LDAP的结构概念

介绍
轻型目录访问协议(LDAP)是目录访问协议的轻型版本,是X.500协议的一部份。它即不是目录也不是数据库,LDAP是一个在目录环境中客户端如何能够访问和更新数据的访问协议。些刻,shark的用户组和认证API接口的LDAP实现支持LDAP结构的两种类型。第一种结构是标记类型0,第二种结构是标记类型1。
LDAP 结构,类型0
这是一个简单LDAP结构。它包含组和用户。LDAP对象类列表描述通过配置参数LDAPGroupObjectClasses定义用户组。如果不定义默认值是:
LDAPGroupObjectClasses=organizationalUnit
LDAP对象类列表描述通过配置参数LDAPUserObjectClasses定义用户。如果不定义默认值是:
LDAPUserObjectClasses=inetOrgPerson
组和用户都没有一个包含表示属于那个组或用户信息的属性。因此,一个用户(或组)只能属于一个组。通过dn(专有名称)定义一个用户(或组)仅仅属于一个组。LDAPGroupUniqueAttributeName参数定义每个LDAP对象类描述用户组

推荐阅读:

RedHat6下构建LDAP服务

Linux 使用pam_LDAP通过ad域认证

Zimbra故障——Unable to determine enabled services from LDAP

LDAPGroupUniqueAttributeName=ou

LDAPUserUniqueAttributeName=userid
例如,下列的数据能够描述结构类型0:
      version: 1
dn: o=SunsetComputers, c=sr
objectClass: top
objectClass: organization
o: SunsetComputers
version: 1
dn: userid=sasaboy, ou=developers, ou=programers, o=SunsetComputers, c=sr
objectClass: top
objectClass: inetOrgPerson
cn: Sasa Smith
givenname: Sale
initials: S.S.
mail: sasasmith@sunsetcomputers.com
mobile: 067/66688844
postaladdress: Tm92aSBTYWQsIFNla3NwaXJvdmEgNS8xMDAJ
postofficebox: 21000
sn: Smith
st: Serbia
street: 6th street 74
title: B.S.C. in E.E.
userid: sasaboy
userpassword:: c2FzYWJveQ==
dn: userid=simbe, ou=designers, ou=programers, o=SunsetComputers, c=sr
objectClass: top
objectClass: inetOrgPerson
cn: Sean Young
givenname: Sean
initials: S.Y.
mail: seanyoung@sunsetcomputers.com
mobile: 067/88833366
postaladdress: Tm92aSBTYWQsIFNla3NwaXJvdmEgNS8xMDAJ
postofficebox: 21000
sn: Young
st: Serbia
street: 4th street 27
title: B.S.C. in E.E.
userid: simbe
userpassword:: c2ltYmU=
dn: ou=programers, o=SunsetComputers, c=sr
objectClass: top
objectClass: organizationalUnit
ou: programers
dn: ou=developers, ou=programers, o=SunsetComputers, c=sr
objectClass: top
objectClass: organizationalUnit
ou: developers
dn: ou=designers, ou=programers, o=SunsetComputers, c=sr
objectClass: top
objectClass: organizationalUnit
ou: designers
在这个例子中,有三个组:
·programes
·developer
·designer
和两个用户:
·sasaboy
·simbe
组developer属于组programers。它被定义通过它的dn:ou=developers,ou=programmers,o=SunsetComputers,c=sr.组designer也属于组programers(它的dn:ou=designers,ou=programmers,o=SunsetComputers,c=sr).
用户sasaboy属于组developers(它的dn:userid=sasaboy,ou=developers,ou=programmers,o=SunsetComputer,c=sr).用户simbe属于组designers(它的dn:userid=simbe,ou=designers,ou=programmers,o=SunsetComputers,c=sr).
LDAP 结构,类型1
这是复合LDAP结构。它也包含组和用户。参数LDAPGroupObjectClasses,LDAPUserObjectClasses, LDAPGroupUniqueAttributeName和LDAPUserUniqueAttributeName被使用与结构类型0相同的方式。在结构类型中用户和组相比,类型1提供定义组与组之间和组与用户之间的关系(“属于”)。LDAP对象类列表描述shark用户与组之间或通过配置参数LDAPRelationObjectClasses定义的shark组之间的关系。如果没有定义默认值是:
LDAPRelationObjectClasses=groupOfNames
对象类有两个重要的属性。LDAPRelationUniqueAttributeName参数定义每个LDAP对象类描述关系的强制属性名。这个属性值为LDAP树每个LDAP条目。如果没有定义默认值是:
LDAPRelationUniqueAttributeName=cn
LDAPRelationMemberAttributeName参数定义描述包含(用户或组)在关系中的成员LDAP对象类的属性名称– 成员也是定义在关系中的属于组的用户或组。默认值是:
LDAPRelationMemberAttributeName=member

例如,下列的数据能够描述结构类型1:
version: 1dn: o=SunsetComputers, c=srobjectClass: topobjectClass: organizationo: SunsetComputersversion: 1dn: ou=Groups, o=SunsetComputers, c=srobjectClass: topobjectClass: organizationalUnitou: Groupsdn: ou=Users, o=SunsetComputers, c=srobjectClass: topobjectClass: organizationalUnitou: Usersdn: ou=GroupRelations, o=SunsetComputers, c=srobjectClass: topobjectClass: organizationalUnitou: GroupRelationsdn: ou=UserRelations, o=SunsetComputers, c=srobjectClass: topobjectClass: organizationalUnitou: UserRelationsdn: ou=programers, ou=Groups, o=SunsetComputers, c=srobjectClass: topobjectClass: organizationalUnitou: programersdn: ou=designers, ou=Groups, o=SunsetComputers, c=srobjectClass: topobjectClass: organizationalUnitou: designersdn: ou=developers, ou=Groups, o=SunsetComputers, c=srobjectClass: topobjectClass: organizationalUnitou: developersdn: ou=testers, ou=Groups, o=SunsetComputers, c=srobjectClass: topobjectClass: organizationalUnitou: codeDesignersdn: userid=sasaboy, ou=Users, o=SunsetComputers, c=srobjectClass: topobjectClass: inetOrgPersoncn: Sasa Smithgivenname: Saleinitials: S.S.mail: sasasmith@sunsetcomputers.commobile: 067/66688844postaladdress: Tm92aSBTYWQsIFNla3NwaXJvdmEgNS8xMDAJpostofficebox: 21000sn: Smithst: Serbiastreet: 6th street 74title: B.S.C. in E.E.userid: sasaboyuserpassword:: c2FzYWJveQ==dn: userid=simbe, ou=Users, o=SunsetComputers, c=srobjectClass: topobjectClass: inetOrgPersoncn: Sean Younggivenname: Seaninitials: S.Y.mail: seanyoung@sunsetcomputers.commobile: 067/88833366postaladdress: Tm92aSBTYWQsIFNla3NwaXJvdmEgNS8xMDAJpostofficebox: 21000sn: Youngst: Serbiastreet: 4th street 27title: B.S.C. in E.E.userid: simbeuserpassword:: c2ltYmU=dn: cn=testers, ou=UserRelations, o=SunsetComputers, c=srobjectClass: topobjectClass: groupOfNamescn: testersmember: userid=sasaboy, ou=Users, o=SunsetComputers, c=srdn: cn=developers, ou=UserRelations, o=SunsetComputers, c=srobjectClass: topobjectClass: groupOfNamescn: developersmember: userid=simbe, ou=Users, o=SunsetComputers, c=srdn: cn=SunsetComputers, ou=GroupRelations, o=SunsetComputers, c=srobjectClass: topobjectClass: groupOfNamescn: SunsetComputersmember: ou=programers, ou=Groups, o=SunsetComputers, c=srdn: cn=programers, ou=GroupRelations, o=SunsetComputers, c=srobjectClass: topobjectClass: groupOfNamescn: programersmember: ou=designers, ou=Groups, o=SunsetComputers, c=srmember: ou=developers, ou=Groups, o=SunsetComputers, c=srdn: cn=designers, ou=GroupRelations, o=SunsetComputers, c=srobjectClass: topobjectClass: groupOfNamescn: designersmember: ou=testers, ou=Groups, o=SunsetComputers, c=srdn: cn=developers, ou=GroupRelations, o=SunsetComputers, c=srobjectClass: topobjectClass: groupOfNamescn: developersmember: ou=testers, ou=Groups, o=SunsetComputers, c=sr在这个结构中,4个假设的组必须创建。第一个用包含所有的组。它的名称被定义通过参数LDAPGroupGroupsName。如果没有定义默认值是:
LDAPGroupGroupsName=Groups
在这个例子中,这个组被定义为:
dn: ou=Groups, o=SunsetComputers, c=srobjectClass: topobjectClass: organizationalUnitou: Groups第二个组包含所有用户。它的名称被定义通过参数LDAPGroupUsersName。如果没有定义默认值是:
LDAPGroupUsersName=Users
在这个例子中,这个组被定义为:
dn: ou=Users, o=SunsetComputers, c=srobjectClass: topobjectClass: organizationalUnitou: Users第三个组包含所有组之间的关系。它的名称被定义通过参数LDAPGroupGroupRelationsName。如果没有定义默认值是:
LDAPGroupGroupRelationsName=GroupRelations
在这个例子中,这个组被定义为:
dn: ou=GroupRelations, o=SunsetComputers, c=srobjectClass: topobjectClass: organizationalUnitou: GroupRelations在这个例子中,四个组被定义(他都属于组Groups – 看他们的dn):
·programers(dn是ou=programmers,ou=groups,o=SunsetComputers,c=sr)
·developers(dn是ou=developers,ou=groups,o=SunsetComputers,c=sr)
·designers(dn是ou=designers,ou=groups,o=SunsetComputers,c=sr)
·testers(dn是ou=testers,ou=groups,o=SunsetComputers,c=sr)
和两个用户(它们属于组User – 看它们的dn):
·sasaboy(dn是userid=sasaboy,ou=groups,o=SunsetComputers,c=sr)
·simbe(dn是userid=simb,ou=groups,o=SunsetComputers,c=sr)
组developer和designers属于组programers。在这个例子中,这是定义为:
dn: cn=programers, ou=GroupRelations, o=SunsetComputers, c=sr
objectClass: top
objectClass: groupOfNames
cn: programers
member: ou=designers, ou=Groups, o=SunsetComputers, c=sr
member: ou=developers, ou=Groups, o=SunsetComputers, c=sr
注意:。这是在结构类型1中使用惯例。
组tester属于组developers和designer。在这个例子中,这是定义为:
dn: cn=designers, ou=GroupRelations, o=SunsetComputers, c=srobjectClass: top
objectClass: groupOfNames
cn: designers
member: ou=testers, ou=Groups, o=SunsetComputers, c=sr

内容版权声明:除非注明,否则皆为本站原创文章。

转载注明出处:http://www.heiqu.com/f243dc6e72edb8cf261d5e121dc404bd.html