# global configuration settings
dn: cn=config
objectClass: olcGlobal
cn: config
<global config settings>

# schema definitions
dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema
<system schema>

dn: cn=config
objectClass: olcGlobal
cn: config
olcIdleTimeout: 30
olcLogLevel: Stats
olcReferral: ldap://root.openldap.org

dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModuleLoad: /usr/local/lib/smbk5pwd.la

dn: cn=module{1},cn=config
objectClass: olcModuleList
cn: module{1}
olcModulePath: /usr/local/lib:/usr/local/lib/slapd
olcModuleLoad: accesslog.la
olcModuleLoad: pcache.la

# The name that we can dlopen(3).
dlname='back_mdb-2.4.so.2'

# Names of this library.
library_names='back_mdb-2.4.so.2.11.5 back_mdb-2.4.so.2 back_mdb.so'

# The name of the static archive.
old_library=''

# Linker flags that cannot go in dependency_libs.
inherited_linker_flags=' -pthread'

# Libraries that this one depends upon.
dependency_libs=''

# Names of additional weak libraries provided by this library
weak_library_names=''

# Version information for back_mdb.
current=13
age=11
revision=5

# Is this an already installed library?
installed=yes

# Should we warn about portability when linking against -modules?
shouldnotlink=yes

# Files to dlopen/dlpreopen
dlopen=''
dlpreopen=''

# Directory that this library needs to be installed in:
libdir='/usr/lib/ldap'

dn: cn=schema,cn=config
objectClass: olcSchemaConfig
cn: schema

dn: cn=test,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: test
olcAttributeTypes: ( 1.1.1
  NAME 'testAttr'
  EQUALITY integerMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
olcAttributeTypes: ( 1.1.2 NAME 'testTwo' EQUALITY caseIgnoreMatch
  SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.44 )
olcObjectClasses: ( 1.1.3 NAME 'testObject'
  MAY ( testAttr $ testTwo ) AUXILIARY )

# comment
dn: <distinguished name>
<attrdesc>: <attrvalue>
<attrdesc>: <attrvalue>

dn: cn=Barbara J Jensen,dc=example,dc=
 com
cn: Barbara J
 Jensen
 
以上写法等同于
dn: cn=Barbara J Jensen,dc=example,dc=com
cn: Barbara J Jensen

AttributeTypeDescription = "(" whsp
    numericoid whsp              ; AttributeType identifier
  \[ "NAME" qdescrs \]             ; name used in AttributeType
  \[ "DESC" qdstring \]            ; description
  \[ "OBSOLETE" whsp \]
  \[ "SUP" woid \]                 ; derived from this other
                                 ; AttributeType
  \[ "EQUALITY" woid              ; Matching Rule name
  \[ "ORDERING" woid              ; Matching Rule name
  \[ "SUBSTR" woid \]              ; Matching Rule name
  \[ "SYNTAX" whsp noidlen whsp \] ; Syntax OID
  \[ "SINGLE-VALUE" whsp \]        ; default multi-valued
  \[ "COLLECTIVE" whsp \]          ; default not collective
  \[ "NO-USER-MODIFICATION" whsp \]; default user modifiable
  \[ "USAGE" whsp AttributeUsage \]; default userApplications
  whsp ")"

AttributeUsage =
  "userApplications"     /
  "directoryOperation"   /
  "distributedOperation" / ; DSA-shared
  "dSAOperation"          ; DSA-specific, value depends on server

attributetype ( 2.16.840.1.113730.3.1.241
	NAME 'displayName'
	DESC 'RFC2798: preferred name to be used when displaying entries'
	EQUALITY caseIgnoreMatch
	SUBSTR caseIgnoreSubstringsMatch
	SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
	SINGLE-VALUE )

attributeType ( 2.5.4.3 NAME ( 'cn' 'commonName' )
        DESC 'common name(s) associated with the object'
        SUP name )

ObjectClassDescription = "(" whsp
        numericoid whsp      ; ObjectClass identifier
        \[ "NAME" qdescrs \]
        \[ "DESC" qdstring \]
        \[ "OBSOLETE" whsp \]
        \[ "SUP" oids \]       ; Superior ObjectClasses
        \[ ( "ABSTRACT" / "STRUCTURAL" / "AUXILIARY" ) whsp \]
                ; default structural
        \[ "MUST" oids \]      ; AttributeTypes
        \[ "MAY" oids \]       ; AttributeTypes
        whsp ")"

objectclass	( 2.16.840.1.113730.3.2.2
    NAME 'inetOrgPerson'
	DESC 'RFC2798: Internet Organizational Person'
    SUP organizationalPerson
    STRUCTURAL
	MAY (
		audio $ businessCategory $ carLicense $ departmentNumber $
		displayName $ employeeNumber $ employeeType $ givenName $
		homePhone $ homePostalAddress $ initials $ jpegPhoto $
		labeledURI $ mail $ manager $ mobile $ o $ pager $
		photo $ roomNumber $ secretary $ uid $ userCertificate $
		x500uniqueIdentifier $ preferredLanguage $
		userSMIMECertificate $ userPKCS12 )
	)

objectclass ( 1.3.6.1.1.1.2.0 NAME 'posixAccount'
	DESC 'Abstraction of an account with POSIX attributes'
	SUP top AUXILIARY
	MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory )
	MAY ( userPassword $ loginShell $ gecos $ description ) )

dn: cn=zhangsan,ou=people,dc=example,dc=com
cn: zhangsan
gidNumber: 500
givenName: san
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
......

objectclass	( 2.16.840.1.113730.3.2.2
    NAME 'inetOrgPerson'
	DESC 'RFC2798: Internet Organizational Person'
    SUP organizationalPerson
    STRUCTURAL
	MAY (
		audio $ businessCategory $ carLicense $ departmentNumber $
		displayName $ employeeNumber $ employeeType $ givenName $
		homePhone $ homePostalAddress $ initials $ jpegPhoto $
		labeledURI $ mail $ manager $ mobile $ o $ pager $
		photo $ roomNumber $ secretary $ uid $ userCertificate $
		x500uniqueIdentifier $ preferredLanguage $
		userSMIMECertificate $ userPKCS12 )
	)

objectIdentifier myOID  1.1
objectIdentifier mySNMP myOID:1
objectIdentifier myLDAP myOID:2
objectIdentifier myAttributeType        myLDAP:1
objectIdentifier myObjectClass  myLDAP:2
attributetype ( myAttributeType:3 NAME 'x-my-PhotoURI'
        DESC 'URI and optional label referring to a photo'
        SUP labeledURI )
objectclass ( myObjectClass:1 NAME 'x-my-PhotoObject'
        DESC 'mixin x-my-Photo'
        AUXILIARY
        MAY x-my-Photo )

overlay dds
dds-max-ttl     1d
dds-min-ttl     10s
dds-default-ttl 1h
dds-interval    120s
dds-tolerance   5s

dn: cn=OpenLDAP Documentation Meeting,ou=Meetings,dc=example,dc=com
cn: OpenLDAP Documentation Meeting
objectClass: groupOfNames
objectClass: dynamicObject
member: uid=ghenry,ou=People,dc=example,dc=com
member: uid=hyc,ou=People,dc=example,dc=com

# ldapsearch --hostname xxxx --port 389 --baseDN "dc=example,dc=com" "(objectClass=groupOfURLs)"
dn: cn=sn-gu,ou=group,dc=example,dc=com
cn: sn-gu
memberURL: ldap:///ou=people,dc=example,dc=com??sub?(sn=gu)
objectClass: groupOfURLs
objectClass: top

# ldapsearch --hostname xxxx --port 389 --baseDN "dc=example,dc=com" "(isMemberOf=cn=sn-gu,ou=group,dc=example,dc=com)"
dn: cn=aaaagu,ou=people,dc=example,dc=com
cn: aaaagu
givenName: aaaa
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: gu
uid: aaaagu

dn: cn=ssssgu,ou=people,dc=example,dc=com
cn: ssssgu
givenName: ssss
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: gu
uid: ssssgu

-D  {bindDN}   用于绑定到服务器的 DN

-h  {host}     目录服务器主机名或 IP 地址   Default value: localhost
-H  {uri}      目录服务器的ldap格式地址。如果用了-h 就不用 -H了
-p  {port}     目录服务器端口号  Default value: 389

-w  {bindPassword} 用于绑定到服务器的密码
-W  提示输入密码

-a  添加条目

编写ldif文件，将新增用户的ldif信息写入
dn: cn=zhangsan,ou=people,dc=ebay,dc=com
changetype: add
cn: zhangsan
gidnumber: 500
givenname: san
homedirectory: /home/users/zhangsan
objectclass: inetOrgPerson
objectclass: posixAccount
objectclass: top
sn: zhang
uid: zhangsan
uidnumber: 1002
userpassword: {MD5}lueSGJZetyySpUndWjMBEg==

ldapmodify: modify operation type is missing at line 2, entry "cn=zhangsan,ou=people,dc=ebay,dc=com"

adding new entry "cn=zhangsan,ou=people,dc=ebay,dc=com"

dn: cn=zhangsan,ou=people,dc=ebay,dc=com
changetype: modify
replace: homeDirectory
homeDirectory: /home/users/zhangsan1111111

dn: cn=zhangsan,ou=people,dc=ebay,dc=com
changetype: modify
add: mobile
mobile: 222222222

dn: cn=zhangsan,ou=people,dc=ebay,dc=com
changetype: modify
delete: mobile

Usage:  ldapsearch  {options} filter [attributes ...]
Command options:

-A, --typesOnly
    仅检索属性名称，而不检索属性值
-b, --baseDN {baseDN}
    搜索基 DN
-c, --continueOnError
    即使出现错误也继续进行处理
--countEntries
    计算服务器返回的条目数

-n, --dry-run
    显示将要执行的操作，但不执行任何操作

-S, --sortOrder {sortOrder}
    使用提供的排序顺序对结果进行排序
--simplePageSize {numEntries}
    将简单分页结果控制用于给定页面大小
    Default value: 1000

ldapsearch -D "cn=admin,dc=example,dc=com" -w xxxxx -H ldap://localhost -b "ou=people,dc=example,dc=com"

# people, example.com
dn: ou=people,dc=example,dc=com
ou: people
objectClass: organizationalUnit
objectClass: top

......
# search result
search: 2
result: 0 Success

ldapsearch -D "cn=admin,dc=example,dc=com" -w xxxxx -H ldap://localhost  -b 'dc=example,dc=com' "(cn=zhangsan)" homeDirectory

dn: cn=zhangsan,ou=people,dc=example,dc=com
homeDirectory: /home/users/zhangsan

docker run -d --name ldap-service \
              --hostname ldap-service \
              -p 389:389 -p 636:636 \
              -v /data/openldap/database:/var/lib/ldap \
              -v /data/openldap/config:/etc/ldap/slapd.d \
              --env LDAP_ORGANISATION="公司名" \
              --env LDAP_DOMAIN="公司域名" \
              --env LDAP_ADMIN_PASSWORD="admin账号的密码" \
              --env LDAP_TLS=false \
              --detach osixia/openldap:stable

docker run --name phpldapadmin-service \
            -p 6443:443 -p 6680:80 \
            --hostname phpldapadmin-service \
            --link ldap-service \
            --env PHPLDAPADMIN_LDAP_HOSTS=ldap-service \
            --env PHPLDAPADMIN_HTTPS=false \
            --detach osixia/phpldapadmin:stable

ou=group
|- ou=某某大部门
    |- ou=某某子部门
ou=people
|- cn=用户

docker run -p 6681:80 \
            -v /data/self-service-password/config.inc.local.php:/var/www/conf/config.inc.local.php \
            -itd ltbproject/self-service-password:latest

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ldap
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ldap
  template:
    metadata:
      labels:
        app: ldap
    spec:
      containers:
        - name: ldap
          image: osixia/openldap:stable
          args: ["--copy-service"]
          volumeMounts:
            - name: container-run
              mountPath: /container/run
          env:
          - name: LDAP_ORGANISATION
            value: XXX
          - name: LDAP_DOMAIN
            value: XXX.XXX
          - name: LDAP_ADMIN_PASSWORD
            value: XXXXX
          ports:
            - containerPort: 389
              name: openldap
            - name: ssl-ldap-port
              containerPort: 636
          livenessProbe:
            tcpSocket:
              port: openldap
            initialDelaySeconds: 20
            periodSeconds: 10
            failureThreshold: 10
          readinessProbe:
            tcpSocket:
              port: openldap
            initialDelaySeconds: 20
            periodSeconds: 10
            failureThreshold: 10
      volumes:
        - name: container-run
          emptyDir: {}

gitlab_rails['ldap_enabled'] = true
gitlab_rails['prevent_ldap_sign_in'] = false

###! **remember to close this block with 'EOS' below**
gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
  main: # 'main' is the GitLab 'provider ID' of this LDAP server
    label: 'LDAP'
    host: '填写LDAP服务器IP'
    port: 389
    uid: 'uid'
    bind_dn: 'cn=admin,dc=xxx,dc=xxx'
    password: '填写admin密码'
    encryption: 'plain' # "start_tls" or "simple_tls" or "plain"
    verify_certificates: true
#     smartcard_auth: false
    active_directory: false
    allow_username_or_email_login: false
#     lowercase_usernames: false
#     block_auto_created_users: false
    base: 'dc=xxx,dc=xxx'
    attributes:
      username: ['uid', 'mail']
      email:    ['mail']
EOS