如何为CM集成FreeIPA提供的LDAP认证

大数据杂货铺

发布于 2020-06-17 19:14:54

1.6K0

发布于 2020-06-17 19:14:54

文章被收录于专栏：大数据杂货铺

文档编写目的

本篇文章主要介绍如何为Cloudera Manager集成FreeIPA提供的LDAP认证。

内容概述

1) 测试环境描述

2) FreeIPA的LDAP介绍

3) Cloudera Manager集成LDAP

4) Cloudera Manager集成验证

5) 总结

测试环境

1) RedHat7.7

2) CM和Cloudera Runtime版本为7.1.1

3) FreeIPA版本为4.6.6

前置条件

1) FreeIPA已安装且正常使用

2) CDP-DC集群已搭建完毕且正常使用

测试环境描述

FreeIPA集群已安装完毕。

查看配置文件

从IPA 3.0开始，我们已经为/etc/openldap/ldap.conf配置了一些默认值：

[ec2-user@ip-10-0-0-170 ~]$ cat /etc/openldap/ldap.conf
# File modified by ipa-client-install

# We do not want to break your existing configuration, hence:
#   URI, BASE, TLS_CACERT and SASL_MECH
#   have been added if they were not set.
#   In case any of them were set, a comment has been inserted and
#   "# CONF_NAME modified by IPA" added to the line above.
# To use IPA server with openLDAP tools, please comment out your
# existing configuration for these options and uncomment the
# corresponding lines generated by IPA.


#
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

#BASE  dc=example,dc=com
#URI  ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT  12
#TIMELIMIT  15
#DEREF    never

TLS_CACERTDIR  /etc/openldap/certs

# Turning this off breaks GSSAPI used with krb5 when rdns = false
SASL_NOCANON  on
URI ldaps://ip-10-0-0-170.ap-southeast-1.compute.internal
BASE dc=ap-southeast-1,dc=compute,dc=internal
TLS_CACERT /etc/ipa/ca.crt
SASL_MECH GSSAPI
[ec2-user@ip-10-0-0-170 ~]$

设置这些默认值意味着您无需将太多选项传递给ldapsearch之类的工具。搜索更加容易：

$ ldapsearch -x uid=admin

而不是：

$ ldapsearch -x -h ipa.example.com  -b dc=example,dc=com uid=admin

[ec2-user@ip-10-0-0-170 ~]$ ldapsearch -x uid=admin
# extended LDIF
#
# LDAPv3
# base <dc=ap-southeast-1,dc=compute,dc=internal> (default) with scope subtree
# filter: uid=admin
# requesting: ALL
#

# admin, users, compat, ap-southeast-1.compute.internal
dn: uid=admin,cn=users,cn=compat,dc=ap-southeast-1,dc=compute,dc=internal
objectClass: posixAccount
objectClass: ipaOverrideTarget
objectClass: top
gecos: Administrator
cn: Administrator
uidNumber: 1376400000
gidNumber: 1376400000
loginShell: /bin/bash
homeDirectory: /home/admin
ipaAnchorUUID:: OklQQTphcC1zb3V0aGVhc3QtMS5jb21wdXRlLmludGVybmFsOmJmYTI4NGI4LW
 E5MzktMTFlYS1iZmEzLTA2YTdiNzk2MzQwYQ==
uid: admin

# admin, users, accounts, ap-southeast-1.compute.internal
dn: uid=admin,cn=users,cn=accounts,dc=ap-southeast-1,dc=compute,dc=internal
objectClass: top
objectClass: person
objectClass: posixaccount
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: inetuser
objectClass: ipaobject
objectClass: ipasshuser
objectClass: ipaSshGroupOfPubKeys
uid: admin
cn: Administrator
sn: Administrator
uidNumber: 1376400000
gidNumber: 1376400000
homeDirectory: /home/admin
loginShell: /bin/bash
gecos: Administrator

# search result
search: 2
result: 0 Success

# numResponses: 3
# numEntries: 2
[ec2-user@ip-10-0-0-170 ~]$

CM与FreeIPA的LDAP集成

1.使用管理员用户登录Cloudera Manager，进入“管理”->“设置”界面

2.通过左侧的筛选器过滤“外部身份验证”

3.配置外部身份验证，具体配置参数如下：

参数名	值	描述
身份验证后端顺序	先外部，后数据库	第一次配置时不能只用外部，预防配置失败无法进入CM
Authorization Backend Order	Database and External	第一次配置时不能只用外部，预防配置失败无法进入CM
外部身份验证类型	LDAP
LDAP URL	ldaps://ip-10-0-0-170.ap-southeast-1.compute.internal:636	配置OpenLDAP URL
LDAP 绑定用户可分辨名称	uid=admin,cn=users,cn=accounts,dc=ap-southeast-1,dc=compute,dc=internal	配置用于搜索OpenLDAP的管理员账号
LDAP 绑定密码	cloudera	管理员账号的密码
LDAP 用户搜索库	cn=users,cn=accounts,dc=ap-southeast-1,dc=compute,dc=internal	搜索LDAP用户的基础域
LDAP 用户搜索筛选器	uid={0}
LDAP 组搜索库	cn= groups,cn=accounts,dc=ap-southeast-1,dc=compute,dc=internal	搜索LDAP组的基础域
LDAP 组搜索筛选器	member={0}	过滤搜索的LDAP组条件，使用或者的关系过滤组中cn，针对用户名和组一致的情况
LDAP 可分辨名称模式	uid={0},cn=users,cn=accounts,dc=ap-southeast-1,dc=compute,dc=internal	LDAP专有名称模式进行配置。