参考及依赖

https://github.com/nginxinc/nginx-ldap-authhttp://nginx.org/nginx-1.14.2http_auth_request_modulenginx-ldap-authpython2.7python-ldap

Nginx支持ldap

1. 部署nginx，注意需要http_auth_request_module支持

wget http://nginx.org/download/nginx-1.14.2.tar.gztar zxvf nginx-1.14.2.tar.gzcd nginx-1.14.2./configure --with-http_auth_request_modulemakemake install/usr/local/nginx/sbin/nginx

2. 配置nginx,注意ldap配置
   cat /usr/local/nginx/conf/nginx.conf

user                  nobody nobody;worker_processes auto;#worker_cpu_affinity auto;worker_rlimit_nofile 65535;error_log             logs/error.log;pid                   logs/nginx.pid;events {    use epoll;    #reuse_port on;   #used in tengine and linux kernel >= 3.9    accept_mutex off;  #used in nginx    worker_connections  65535;}http {    include                     mime.types;    default_type                application/octet-stream;    server_tokens               off;    log_format      main        '$remote_addr - $remote_user [$time_local] "$request" '                                '$status $request_time $body_bytes_sent "$http_referer" '                                '"$http_user_agent" "$http_x_forwarded_for"|body: $request_body';    sendfile                    on;    tcp_nopush                  on;    tcp_nodelay                 on;    keepalive_timeout           60;    gzip                        on;    gzip_vary                   on;    gzip_comp_level             5;    gzip_buffers                16 4k;    gzip_min_length             1000;    gzip_proxied                any;    gzip_disable                "msie6";    gzip_types                  text/plain text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript application/json;    open_file_cache max=1000    inactive=20s;    open_file_cache_valid       30s;    open_file_cache_min_uses    2;    open_file_cache_errors      on;    client_max_body_size        50m;    #缓存可以减少ldap验证频率，不然每个页面都需要ldap验证一次    #你不在乎的话，不要缓存也是没有任何问题的     proxy_cache_path cache/ keys_zone=auth_cache:10m;#kibananupstream kibana_server {    server 10.2.8.44:5601;}server {    listen 5601;    server_name localhost;    access_log logs/kibanan_access.log main;    error_log logs/kibanan_error.log debug;    #后端程序，也就是kubernetes-dashboard    location / {        auth_request /auth-proxy;        #nginx接收到nginx-ldap-auth-daemon.py返回的401和403都会重新跳转到登录页面        error_page 401 403 =200 /login;        proxy_pass http://kibana_server;    }    #登录页面，由backend-sample-app.py提供，跑在同一台机器的8082端口(默认不是8082端口)    location /login {        proxy_pass http://127.0.0.1:9000/login;        proxy_set_header X-Target $request_uri;    }    location = /auth-proxy {        internal;        proxy_pass http://127.0.0.1:8888;     #nginx-ldap-auth-daemon.py运行端口        #缓存设置        proxy_cache auth_cache;        proxy_cache_key "$http_authorization$cookie_nginxauth";        proxy_cache_valid 200 403 10m;        proxy_pass_request_body off;        proxy_set_header Content-Length "";        #最最重要的ldap配置，请务必按照贵公司的ldap配置如下四项，我在这一步卡了好久，就是ldap配置不对        #这些配置都会通过http头部传递给nginx-ldap-auth-daemon.py脚本        proxy_set_header X-Ldap-URL      "ldap://10.2.150.11:389";        proxy_set_header X-Ldap-BaseDN   "ou=People,dc=yiche,dc=org";        proxy_set_header X-Ldap-BindDN   "cn=OPITUser,ou=OuterUser,dc=che,dc=org";        proxy_set_header X-Ldap-BindPass "opit@minminmsn";        proxy_set_header X-Ldap-Template "(uid=%(username)s)";        proxy_set_header X-CookieName "nginxauth";        proxy_set_header Cookie nginxauth=$cookie_nginxauth;    }}}

Python Ldap认证

wget https://github.com/nginxinc/nginx-ldap-auth/archive/0.0.4.tar.gztar zxvf 0.0.4.tar.gzpython nginx-ldap-auth-daemon.py &

后端登陆跳转页面

默认页面只能测试，这里需要大概改下才能使用

        
    
        
     
            
      
                
       
  欢迎登陆kibana管理平台
       
  请使用邮箱账户密码登陆
       
                                                                                                                                                      
         
           
用户名:
          
          
@minminmsn.com
          
                             
           
密   码:
          
          
                             
           
          
          
                        
       
                    
                   
      
        
     
    
    

登陆测试