13.一键添加OpenLDAP用户及Kerberos账号

[root@cdh01 openldap-shell]# vim config-env.sh
#!/bin/bash

mkdir -p ldif
mkdir -p keytab
#OpenLDAP信息
ldap_url="ldap://cdh01.fayson.com"
user_base="ou=People,dc=fayson,dc=com"
group_base="ou=Group,dc=fayson,dc=com"
super_admin="cn=Manager,dc=fayson,dc=com"
super_password="123456"

#kerberos信息
domain="FAYSON.COM"

#输出异常日志方法
function show_errmsg() {
  echo -e "\033[40;31m[ERROR] $1 \033[0m"
}

#输出高亮日志方法
function show_highlight() {
  echo -e "\033[40;34m $1 \033[0m"
  exit
}

#查找OpenLDAP用户是否已存在
exists_user(){
  result=`ldapsearch -H $ldap_url -b "uid=${1},${user_base}" -D "$super_admin" -w $super_password | grep result: |awk -F " " '{print $2}'`
  return $result
}

[root@cdh01 openldap-shell]# vim addopenldap.sh 
#!/bin/bash
#使用脚本添加OpenLDAP用户
source ./config-env.sh

while : ; do
   echo -n "Enter your OpenLDAP name: "
   read name
   if [ "$name" = "" ]; then
      show_errmsg "Please enter your name"
   else
      exists_user $name
      if [ $? -ne 0 ];then
         break
      else
        show_errmsg "User $name already exists"
      fi
   fi
done

while : ;do 
   echo -n "Enter the uid for user: "
   read uid
   expr $uid + 10 1>/dev/null 2>&1
   if [ $? -ne 0 ];then
     show_errmsg "uid must be number, $uid"
   else
     break 
   fi
done

echo -n "Enter the password for user $name: "
while : ;do
  char=`
   stty cbreak -echo
   dd if=/dev/tty bs=1 count=1 2>/dev/null
   stty -cbreak echo
   `
   if [ "$char" = "" ];then
     echo #这里的echo只是为换行
     break
   fi
     password="$password$char"
     echo -n "*"
done

echo -n "Enter the password of user $name again:"
while : ;do
  char=`
   stty cbreak -echo
   dd if=/dev/tty bs=1 count=1 2>/dev/null
   stty -cbreak echo
   `
   if [ "$char" = "" ];then
     echo #这里的echo只是为换行
     break
   fi
     repassword="$repassword$char"
     echo -n "*"
done

if [ "$password" != "$repassword" ];then
  show_errmsg "Sorry, passwords do not match." 
  exit
fi

echo "username:$name"
echo "userid:$uid"
echo "password:$password"

#生成ldif文件，包含用户和用户组
# Create User Ldif File
echo "dn: uid=$name,$user_base
uid: $name
cn: $name
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: $password
loginShell: /bin/bash
uidNumber: $uid
gidNumber: $uid
homeDirectory: /home/$name

dn: cn=$name,$group_base
objectClass: posixGroup
objectClass: top
cn: $name
userPassword: $password
gidNumber: $uid" > ldif/${name}.ldif

#添加用户和用户组到OpenLDAP中
ldapadd -x -D "$super_admin" -w $super_password -f ldif/${name}.ldif

if [ $? -ne 0 ];then
  show_errmsg "Add openldap user failed..."
else
  #是否为用户生成Kerberos账号
  echo -n "Are you sure if you are generating kerberos?(Y/N): "
  read iskerberos

  if [ "$iskerberos" = "Y" ];then
    #添加kerberos账号
    kadmin.local -q "addprinc -pw $password ${name}@${domain}"
    if [ $? -ne 0 ];then
      show_errmsg "Sorry,Failed to generate kerberos account."
    fi
    #是否为用户生成keytab文件
    echo -n "Are you sure if you are generating keytab for ${name}@${domain} ?(Y/N): "
    read iskeytab
    if [ "$iskeytab" = "Y" ];then
      kadmin.local -q "xst -norandkey -k ./keytab/${name}.keytab ${name}@${domain}"
      if [ $? -ne 0 ];then
        show_errmsg "Sorry,Failed to generate keytab."
      fi
    fi
  fi
fi

[root@cdh01 openldap-shell]# vim start_ldap.sh
#!/bin/bash
#########################################################
#  author: Fayson                                       #
#  version: V1.0                                        #
#  createTime: 2018-09-02                               #
#  OpenLDAP 简单操作:                                   #
#  1.新增OpenLDAP用户并创建Kerberos账号及生成keytab文件 #
#  2.删除OpenLDAP用户                                   #
#  3.删除OpenLDAP用户组                                 #
#  4.修改用户密码                                       #
#########################################################
source ./config-env.sh

useage(){
  echo "Command action
   1   delete a openldap user
   2   delete a openldap group
   3   modify the openldap user password
   4   add a openldap user
   q   quit"
}

echo_help(){
  echo -n "Enter your OpenLDAP $1: "
  read content
}

delete_user(){
   echo "---------Delete [`show_highlight ${content}`] user"
   ldapdelete -x -D "$super_admin" -w $super_password "uid=${content},${user_base}"
   if [ $? -eq 0 ];then
     echo "---------Successfully deleted the [`show_highlight ${content}`] user"
   fi
}

delete_group(){
   echo "---------delete [`show_highlight ${content}`] group"
   ldapdelete -x -D "$super_admin" -w $super_password "cn=${content},${group_base}"
   if [ $? -eq 0 ];then
     echo "---------Successfully deleted the [`show_highlight ${content}`] group"
   fi
}

modify_user(){
   echo "---------Modify the peach [`show_highlight ${content}`] password"
   ldappasswd -x -D "$super_admin" -w $super_password "uid=${content},${user_base}" -S
   if [ $? -eq 0 ];then
     echo "---------Successfully modified the [`show_highlight ${content}`] user password"
   fi
}

add_user(){
  source ./addopenldap.sh
}


while true
do
  echo -n "Command (m for help): "
  read operator
  case $operator in
    m)
      useage
      ;;
    1)
      echo_help "UserName"
      delete_user
      ;;
    2)
      echo_help "GroupName"
      delete_group
      ;;
    3)
      echo_help "UserName"
      modify_user
      ;;
    4)
      add_user
      ;;
    q)
      exit
      ;;
    *)
      echo ""
  esac
done

[root@cdh01 openldap-shell]# sh start_ldap.sh

[root@cdh01 openldap-shell]# id faysontest
[root@cdh01 openldap-shell]# kinit -kt keytab/faysontest.keytab faysontest
[root@cdh01 openldap-shell]# klist