正常配置openfire使用ldap认证后,在openfire后台可以看到所有用户和组,但是组里面没有用户。
解决方法:
一、增加member属性到organizationalUnit这个objectclass中
编辑core.schema
这个schema中有member这个attribute,但是organizationalUnit objectclass中没有启用,所以在:
objectclass ( 2.5.6.5 NAME 'organizationalUnit'
DESC 'RFC2256: an organizational unit'
SUP top STRUCTURAL
MUST ou
MAY ( userPassword $ searchGuide $ seeAlso $ businessCategory $
x121Address $ registeredAddress $ destinationIndicator $
preferredDeliveryMethod $ telexNumber $ teletexTerminalIdentifier $
telephoneNumber $ internationaliSDNNumber $
facsimileTelephoneNumber $ street $ postOfficeBox $ postalCode $
postalAddress $ physicalDeliveryOfficeName $ st $ l $ description $ member ) )
中增加$ member,重启ldap即可。
二、修改openfire.script脚本:
编辑/opt/openfire/embedded-db/openfire.script文件,修改如下行为:
INSERT INTO OFPROPERTY VALUES('ldap.groupMemberField','seeAlso')
INSERT INTO OFPROPERTY VALUES('ldap.groupMemberField','member')
三、添加组员到组中。
这样在ldapadmin后台OU里面添加新的attribute的时候就可以看到member这个属性了。member的值如下图所示:
![OU的设置 openfire使用ldap认证,组的过滤设置_openldap openfire](https://s2.51cto.com/attachment/201309/151621267.png?x-oss-process=image/resize,m_fixed,w_1184)
这样,重启openfire和ldap后,登陆spark就可以看到组已经组员了。
备注一下:
属性名 | 属性值 | 编辑 | 删除 |
---|
admin.authorizedJIDs | user@domain.com.cn | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.adminDN | cn=root,dc=domain,dc=com | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.adminPassword | hidden | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.autoFollowAliasReferrals | true | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.autoFollowReferrals | false | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.baseDN | dc=domain,dc=com | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.connectionPoolEnabled | true | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.debugEnabled | false | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.emailField | mail | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.encloseDNs | true | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.groupDescriptionField | description | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.groupMemberField | member | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.groupNameField | ou | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.groupSearchFilter | (&(ou={0})(objectClass=organizationalUnit)) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.host | 10.0.0.12 | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.ldapDebugEnabled | false | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.nameField | description | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.override.avatar | true | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.port | 389 | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.posixMode | false | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.searchFields |
| ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.searchFilter | (&(cn={0})(objectClass=inetOrgPerson)) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.sslEnabled | false | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.usernameField | cn | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
ldap.vcard-mapping | <span title="<![CDATA[<br><vCard xmlns=" vcard-temp"><N> <GIVEN>{description}</GIVEN> </N> <EMAIL> <INTERNET/> <USERID>{mail}</USERID> </EMAIL> <FN>{description}</FN> <NICKNAME>{uid}</NICKNAME> <ADR> <HOME/> </ADR> <ADR> <WORK/> </ADR> </vCard>]]>"><![CDATA[ <vCard xmlns="vcard-temp"> <N> <GIVEN>{description}</GIVEN> </N> <EMAIL> <INTERNET/> <USERID>{mail}</USERID> </EMAIL> <FN>{description}</FN> <NICKNAME>{uid}</NICKNAME> <ADR> <HOME/> </ADR> <ADR> <WORK/> </ADR> </vCard>]]> | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
provider.auth.className | org.jivesoftware.openfire.ldap.LdapAuthProvider | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
provider.group.className | org.jivesoftware.openfire.ldap.LdapGroupProvider | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
provider.user.className | org.jivesoftware.openfire.ldap.LdapUserProvider | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
provider.vcard.className | org.jivesoftware.openfire.ldap.LdapVCardProvider | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
update.lastCheck | 1379953378982 | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
xmpp.auth.anonymous | true | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
xmpp.domain | domain.com.cn | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
xmpp.session.conflict-limit | 0 | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif) |
xmpp.socket.ssl.active | true | ![openfire使用ldap认证,组的过滤设置_openldap openfire_02](http://192.168.8.225:9090/p_w_picpaths/edit-16x16.gif) | ![openfire使用ldap认证,组的过滤设置_openldap openfire_03](http://192.168.8.225:9090/p_w_picpaths/delete-16x16.gif)
|
这是一个介绍关于ldap group的连接:http://www.zytrax.com/books/ldap/ch11/groups.html