搭建ldap自助修改密碼系統--Self Service Password

服務安裝：

安裝依賴：yum install php70-ldap.x86_64 -y (版本儘可能大於5.3，不然會提示更新php程序) 
                 yum install httpd -y 
  安裝Self Service Password：yum install https://ltb-project.org/rpm/6Server/noarch/self-service-password-1.1-1.el6.noarch.rpm

        配置apache: /etc/httpd/conf.d/self-service-password.conf

NameVirtualHost *:80
<VirtualHost *:80>
        ServerName ssp.xinniu.com

        DocumentRoot /usr/share/self-service-password
        DirectoryIndex index.php

        AddDefaultCharset UTF-8
   <Directory "/usr/share/self-service-password">
            AllowOverride None
            Allow from all
 </Directory>
        LogLevel warn
        ErrorLog /var/log/httpd/ssp_error_log
        CustomLog /var/log/httpd/ssp_access_log combined
</VirtualHost>

配置Self Service Password,支持密碼修改和郵件重置： vim /usr/share/self-service-password/conf/config.inc.php

這個文件配置項太多了，只寫一下改動的

$ldap_url = "ldap://172.xx.xx.xx:389";
$ldap_starttls = false;
$ldap_binddn = "cn=admin,dc=xxxx,dc=com";
$ldap_bindpw = "****";
$ldap_base = "dc=xxxx,dc=com";
$ldap_login_attribute = "uid";
$ldap_fullname_attribute = "cn";
$ldap_filter = "(&(objectClass=person)($ldap_login_attribute={login}))";
$mail_from = "msg_data@xxxx.com";
$mail_from_name = "Self Service Password";
$mail_signature = "";

$notify_on_change = true;
 https://github.com/PHPMailer/PHPMailer)
$mail_sendmailpath = '/usr/sbin/sendmail';
$mail_protocol = 'smtp';
$mail_smtp_debug = 0;
$mail_debug_format = 'html';
$mail_smtp_host = 'localhost';
$mail_smtp_auth = true;
$mail_smtp_user = 'msg_data@xxxxx.com';
$mail_smtp_pass = 'xxxxx;
$mail_smtp_port = 25;

keyphrase = "secret";

配完後
systemctl restart httpd

完成以後，測試系統是否能夠使用
打開頁面

d
修改密碼時不用輸入整個dn，直接輸入前綴就能夠了

測試修改密碼時，報錯，ldap服務器拒絕咱們修改的密碼，通過查看日誌加上本身手動驗證，發現普通用戶沒有修改密碼的權限。
而後查看ldap官方的手冊：http://www.openldap.org/doc/admin24/access-control.html

研究後發現須要修改ldap的條目
文件添加ACL 信息，問題解決，添加命令以下：

ldapmodify -Y EXTERNAL -H ldapi:/// -f updatepass.ldif

updatepass.ldif 文件內容以下：

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: to attrs=userPassword
        by self =xw
        by anonymous auth
        by * none

olcAccess: to *
        by self write
        by users read
        by * none

而後試下真的能夠修改密碼了