Jenkins接入LDAP用户管理

一、准备

1.1部署jenkins：https://www.cnblogs.com/wangyuanguang/p/18025410

1.2LDAP部署：https://www.cnblogs.com/wangyuanguang/p/18189832

二、LDAP配置组织和uid用户

2.1配置组织

编辑ou=jenkins的配置文件 ou-jk.ldif

dn: ou=jenkins,dc=wyg,dc=com
objectClass: organizationalUnit
objectClass: top
ou: jenkins

创建jenkins组织

]# ldapadd -x -D 'cn=admin,dc=wyg,dc=com' -f ou-jk.ldif  -H ldap://192.168.100.102:389 -w 123456
adding new entry "ou=jenkins,dc=wyg,dc=com"

2.2创建uid的用户

配置user-jk.ldif，配置user1和user2用户

dn: uid=user1,ou=jenkins,dc=wyg,dc=com
ou: jenkins
uid: user1
sn: user1
cn: suer1
givenName: user1
displayName: user1
mail: readafa@esgyn.local
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
userpassword: 123456

dn: uid=user2,ou=jenkins,dc=wyg,dc=com
ou: jenkins
uid: user2
sn: user2
cn: user2
givenName: user2
displayName: user2
mail: readafa@esgyn.local
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
userpassword: 123456

创建用户

]# ldapadd -x -D 'cn=admin,dc=wyg,dc=com' -f user-jk.ldif  -H ldap://192.168.100.102:389 -w 123456
adding new entry "uid=user1,ou=jenkins,dc=wyg,dc=com"
adding new entry "uid=user2,ou=jenkins,dc=wyg,dc=com"

查看

[root@node1 ldif]# ldapsearch -x -D "uid=user1,ou=jenkins,dc=wyg,dc=com" -w 123456 -b 'ou=jenkins,dc=wyg,dc=com' 'uid=user1'
# extended LDIF
#
# LDAPv3
# base <ou=jenkins,dc=wyg,dc=com> with scope subtree
# filter: uid=user1
# requesting: ALL
#

# user1, jenkins, wyg.com
dn: uid=user1,ou=jenkins,dc=wyg,dc=com
ou: jenkins
uid: user1
sn: user1
cn: suer1
givenName: user1
displayName: user1
mail: readafa@esgyn.local
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
userPassword:: MTIzNDU2

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
[root@node1 ldif]# ldapsearch -x -D "uid=user2,ou=jenkins,dc=wyg,dc=com" -w 123456 -b 'ou=jenkins,dc=wyg,dc=com' 'uid=user2'
# extended LDIF
#
# LDAPv3
# base <ou=jenkins,dc=wyg,dc=com> with scope subtree
# filter: uid=user2
# requesting: ALL
#

# user2, jenkins, wyg.com
dn: uid=user2,ou=jenkins,dc=wyg,dc=com
ou: jenkins
uid: user2
sn: user2
cn: user2
givenName: user2
displayName: user2
mail: readafa@esgyn.local
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
userPassword:: MTIzNDU2

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

三、jenkins配置

3.1备份配置文件

LDAP配置一旦保存，config.xml配置就会修改，原来的用户就无法登陆，所以需要备份防止配置有问题后可以还原

]# cp -a /var/lib/jenkins/config.xml /var/lib/jenkins/config.xml.bak

3.2下载插件

需要下载LDAP的插件，下载好后重启可生效，不做演示

3.3配置LDAP

设置管理--->全局安全配置--->

配置，根据自己的实际填写

- Server：ldap://192.168.100.102:389
    # ldap地址
- User search base：ou=jenkins,dc=wyg,dc=com
    # 用户基于jenkins组进行获取，想要获取所有用户就填：dc=wyg,dc=com
- User search filter：uid={0}
    # 使用ldap中User Name值进行登录，（cn={0}表示用cn值登录）
- Group search base：ou=jenkins,dc=wyg,dc=com
    # 用户基于jenkins组进行获取，想要获取所有用户就填：dc=wyg,dc=com
- Manager DN：cn=admin,dc=wyg,dc=com
    # 选用的DN
- Manager password：123456
    # DN的密码
- Display Name LDAP attribute：displayName
    # 登录之后显示的名称为displayName的值，可以选择其他属性值，如sn、givenName