更新ldap笔记

Author: pptfz

…ux/Linux服务/ldap/Self Service Password.md …ervice Password/Self Service Password.mddocs/Linux/Linux服务/ldap/Self Service Password.md renamed to docs/Linux/Linux服务/ldap/Self Service Password/Self Service Password.md docs/Linux/Linux服务/ldap/Self Service Password.md renamed to docs/Linux/Linux服务/ldap/Self Service Password/Self Service Password.md

@@ -0,0 +1,82 @@
+# Self Service Password修改密码报错
+
+## 报错信息
+
+用户修改密码，页面报错 `密码被 LDAP 目录服务拒绝` ，日志报错如下
+
+```php
+[Mon Sep 08 06:07:25.578613 2025] [php:notice] [pid 19:tid 19] [client 12.12.13.19:21786] LDAP - Modify password error 50 (Insufficient access), referer: https://ssp.xxx.com/index.php
+```
+
+![iShot_2025-09-05_15.04.06](https://raw.githubusercontent.com/pptfz/picgo-images/master/img/iShot_2025-09-05_15.04.06.png)
+
+
+
+
+
+## 解决方法
+
+### 查看acl
+
+:::tip 说明
+
+```shell
+$ ldapsearch -H ldapi:/// -Y EXTERNAL -b "olcDatabase={2}mdb,cn=config" olcAccess
+
+SASL/EXTERNAL authentication started
+SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
+SASL SSF: 0
+# extended LDIF
+#
+# LDAPv3
+# base <olcDatabase={2}mdb,cn=config> with scope subtree
+# filter: (objectclass=*)
+# requesting: olcAccess 
+#
+
+# {2}mdb, config
+dn: olcDatabase={2}mdb,cn=config
+
+# search result
+search: 2
+result: 0 Success
+
+# numResponses: 2
+# numEntries: 1
+```
+
+
+
+
+
+编辑文件
+
+```
+cat > add-acl.ldif << EOF
+dn: olcDatabase={2}mdb,cn=config
+changetype: modify
+add: olcAccess
+olcAccess: to attrs=userPassword
+  by self write
+  by anonymous auth
+  by * none
+EOF
+```
+
+
+
+执行
+
+```shell
+ldapmodify -H ldapi:/// -Y EXTERNAL -f add-acl.ldif
+```
+
+输出
+
+```shell
+SASL/EXTERNAL authentication started
+SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
+SASL SSF: 0
+modifying entry "olcDatabase={2}mdb,cn=config"
+```
+

docs/Linux/Linux服务/ldap/Self Service Password/Self Service Password修改密码报错.md

@@ -0,0 +1,88 @@
+# ldap批量创建用户
+
+
+
+编辑用户文件
+
+```
+cat > users.txt << EOF
+zhuzhisheng
+libin
+lichao
+lianglikai
+songtingsen
+wangjun
+wanglin
+wangpengfei
+yanxin
+zhangjintao
+zhangxing
+zhangzhenbiao
+zhaoxiaofei
+zhaoyulong
+EOF
+```
+
+
+
+批量增加用户
+
+```shell
+cat > add-users.sh << 'AAA'
+#!/bin/bash
+
+BASE_DN="cn=后端组,ou=kingclub,dc=zmexing,dc=com"
+GROUP_GID=1000
+PASSWORD="{SSHA}G7h4TMhnEuc1iR5pR/E7E9WPQ7rW23UJ"
+DOMAIN="zmexing.com"
+
+UID_START=1001
+
+while read -r USERNAME
+do
+  EMAIL="${USERNAME}@${DOMAIN}"
+  UID=$UID_START
+
+cat <<EOF | ldapadd -x -H ldap://localhost:1389 -D "cn=admin,dc=zmexing,dc=com" -w 'NgIZnm#b%6PI'
+dn: uid=${USERNAME},${BASE_DN}
+objectClass: inetOrgPerson
+objectClass: posixAccount
+objectClass: top
+cn: ${USERNAME}
+sn: ${USERNAME}
+uid: ${USERNAME}
+uidNumber: ${UID}
+gidNumber: ${GROUP_GID}
+homeDirectory: /home/${USERNAME}
+loginShell: /bin/bash
+mail: ${EMAIL}
+userPassword: ${PASSWORD}
+EOF
+
+  UID_START=$((UID_START+1))
+
+done < users.txt
+AAA
+```
+
+
+
+批量删除用户
+
+```shell
+cat > del-users.sh << 'EOF'
+#!/bin/bash
+
+BASE_DN="cn=后端组,ou=kingclub,dc=zmexing,dc=com"
+
+while read -r USERNAME
+do
+  DN="uid=${USERNAME},${BASE_DN}"
+
+  echo "Deleting ${DN} ..."
+  ldapdelete -x -H ldap://localhost:1389 -D "cn=admin,dc=zmexing,dc=com" -w 'NgIZnm#b%6PI' "${DN}"
+
+done < users.txt
+EOF
+```
+

…/Linux/Linux服务/ldap/centos7安装openldap.md …nux服务/ldap/openldap/centos7安装openldap.mddocs/Linux/Linux服务/ldap/centos7安装openldap.md renamed to docs/Linux/Linux服务/ldap/openldap/centos7安装openldap.md docs/Linux/Linux服务/ldap/centos7安装openldap.md renamed to docs/Linux/Linux服务/ldap/openldap/centos7安装openldap.md

@@ -0,0 +1,16 @@
+# yearning对接ldap
+
+
+
+`LDAP_Search filter` 要写成如下
+
+```shell
+(&(objectClass=organizationalPerson)(uid=%s))
+```
+
+
+
+![iShot_2025-09-08_16.19.51](https://raw.githubusercontent.com/pptfz/picgo-images/master/img/iShot_2025-09-08_16.19.51.png)
+
+
+