LDAP Setup

验证：未记录

适用版本: 未记录
验证范围: 尚未登记验证记录。

本文缩写（英文全称与中文含义）

缩写	英文全称／名称	中文含义
ACL	Access Control List	访问控制列表
AD	Active Directory	微软活动目录
CA	Certificate Authority	证书颁发机构
DNS	Domain Name System	域名系统
DS	Domain Services / Directory Server	AD DS 中指域服务；389 DS 等产品中指目录服务器
HA	High Availability	高可用
HBAC	Host-Based Access Control	基于主机的访问控制
LDAP	Lightweight Directory Access Protocol	轻量级目录访问协议
LDIF	LDAP Data Interchange Format	LDAP 数据交换格式
SSSD	System Security Services Daemon	Linux 系统安全服务守护进程
TLS	Transport Layer Security	传输层安全协议
VM	Virtual Machine	虚拟机

Links#

https://www.openldap.org/doc/admin26/quickstart.html
https://www.openldap.org/doc/admin26/slapdconfig.html
https://www.port389.org/docs/389ds/howto/quickstart.html
https://www.freeipa.org/page/Quick_Start_Guide
https://www.freeipa.org/page/Deployment_Recommendations
https://www.samba.org/samba/docs/current/man-html/samba-tool.8.html

1. Linux VM With systemd#

OpenLDAP#

OpenLDAP 适合轻量、通用、标准 LDAP 目录。生产上要认真设计 schema、ACL、TLS、backup 和 replication。

Ubuntu packages:

sudo apt-get update
sudo apt-get install -y slapd ldap-utils
sudo systemctl enable --now slapd
sudo systemctl status slapd

Configure interactively if needed:

sudo dpkg-reconfigure slapd

Verify RootDSE:

ldapsearch -H ldap://127.0.0.1:389 -x -b "" -s base namingContexts supportedLDAPVersion

Example base LDIF:

dn: ou=people,dc=example,dc=com
objectClass: organizationalUnit
ou: people

dn: ou=groups,dc=example,dc=com
objectClass: organizationalUnit
ou: groups

dn: ou=service-accounts,dc=example,dc=com
objectClass: organizationalUnit
ou: service-accounts

Apply:

ldapadd -H ldapi:/// -Y EXTERNAL -f base.ldif

Useful logs:

journalctl -u slapd -f

389 Directory Server#

389 Directory Server is a mature LDAP server with better admin tooling than raw OpenLDAP for many enterprise teams.

Typical package flow:

sudo dnf install -y 389-ds-base
sudo dscreate interactive
sudo dsctl <instance_name> status

Useful commands:

sudo dsctl <instance_name> status
sudo dsctl <instance_name> restart
sudo dsconf <instance_name> backend suffix list
sudo dsconf <instance_name> monitor server

FreeIPA#

FreeIPA is not just LDAP. It combines LDAP, Kerberos, CA, DNS options, SSSD integration, sudo/HBAC policy, and host/service identity for Linux environments.

Typical package flow:

sudo dnf install -y freeipa-server freeipa-server-dns
sudo ipa-server-install
sudo systemctl status ipa

Client enrollment:

sudo dnf install -y freeipa-client
sudo ipa-client-install --mkhomedir

Use FreeIPA when the goal is Linux identity platform, not only a simple LDAP address book.

2. Docker#

Docker is useful for local tests. Do not treat random LDAP container images as production-grade without checking persistence, TLS, backup, upgrade, and security posture.

Lab-only principles:

use:
    dev schema tests
    app LDAP integration tests
    Keycloak User Federation tests

do not use for production unless:
    image is vetted
    version is pinned
    persistent volume is backed up
    TLS and secrets are managed
    upgrade path is tested

Example test workflow:

1. start LDAP container
2. import test users/groups from LDIF
3. run ldapsearch and ldapwhoami checks
4. connect Keycloak dev realm
5. destroy environment after test

Example LDIF for tests:

dn: uid=alice,ou=people,dc=example,dc=com
objectClass: inetOrgPerson
uid: alice
cn: Alice Chen
sn: Chen
mail: alice@example.com

dn: cn=developers,ou=groups,dc=example,dc=com
objectClass: groupOfNames
cn: developers
member: uid=alice,ou=people,dc=example,dc=com

3. K8S With Helm#

LDAP can run on Kubernetes, but it is often not the best first choice for production identity infrastructure. Directory services are stateful, security-sensitive, and operationally unforgiving.

Kubernetes fit:

good:
    dev/test LDAP
    ephemeral integration tests
    small internal directory with clear ownership

risky:
    enterprise source of truth without experienced operators
    unclear backup/restore
    unclear persistent volume recovery
    unclear replication behavior during node failure

If using Kubernetes:

required:
    StatefulSet
    persistent volume
    PodDisruptionBudget
    anti-affinity
    NetworkPolicy
    TLS Secret
    backup CronJob or external backup
    restore runbook
    liveness/readiness probes based on ldapsearch

Readiness probe idea:

ldapsearch -H ldaps://127.0.0.1:636 -x -b "" -s base namingContexts

Production note:

prefer:
    Microsoft AD DS for Windows enterprise domain
    managed directory service when acceptable
    FreeIPA / 389 DS / OpenLDAP on VMs when the team owns LDAP operations

use Helm only when:
    chart source is trusted
    values are reviewed
    backups and upgrades are tested

4. High Availability#

LDAP HA is product-specific. Do not assume putting one LDAP pod behind a load balancer is HA.

HA design:
    at least two directory servers
    replication configured and monitored
    clients have multiple LDAP URLs or use a load balancer
    write path understood
    conflict handling understood
    backup is separate from replication

Product notes:

Product	HA Pattern	Notes
AD DS	multiple domain controllers	DNS and site design matter
FreeIPA	multiple replicas	CA/DNS/Kerberos roles must be planned
389 DS	multi-supplier replication	monitor replication status
OpenLDAP	replication with syncrepl / delta-syncrepl	operational expertise required

Backup is not HA:

replication:
    handles node loss and read availability

backup:
    handles accidental deletion, corruption, bad schema change, disaster recovery

5. Operations#

common checks#

ldapsearch -H ldaps://ldap.example.com:636 -x -b "" -s base namingContexts supportedLDAPVersion

ldapwhoami -H ldaps://ldap.example.com:636 -x -D "uid=svc-keycloak,ou=service-accounts,dc=example,dc=com" -W

backup checklist#

backup:
    directory database
    schema
    config
    TLS certificates
    service account list
    replication agreement config

restore test:
    restore to isolated network
    verify admin bind
    verify service bind
    verify user search
    verify group membership
    verify Keycloak sync in test realm

change checklist#

before schema/ACL change:
    export config
    test in staging
    notify app owners
    verify rollback path

after change:
    run ldapsearch for sample users
    run group lookup
    run Keycloak sync
    watch bind/search errors

incident commands#

OpenLDAP:

systemctl status slapd
journalctl -u slapd -n 200
ldapsearch -H ldapi:/// -Y EXTERNAL -b cn=config dn

389 Directory Server:

dsctl <instance_name> status
dsconf <instance_name> monitor server
dsconf <instance_name> backend suffix list

FreeIPA:

ipactl status
ipa user-find alice
ipa group-show developers

完整生产实操#

部署、权限、故障与独立恢复提供本模块选定路径的分步实现和验收，补充本页安装参考。