openldap 使用mysql作为后端数据库
关于搭建openldap+mysql数据作为后端的实例参看http://www.wingfoss.com/content/how-to-install-openldap-with-mysql-on-debian6
一步一步做100%可以成功
这里重点说明一下mysql作为后段数据库中各个表的关系
文章内容参考了http://www.flatmtn.com/article/setting-ldap-back-sql#LdapBacksql-5文档
其中主要表格的字段说明：
2) Understanding the ldap_* Tables
This is the best I can describe it...
The ldap_oc_mappings table is where you put your object classes. Columns:
ldap_oc_mappings 表是用于放置你的objectclass类型信息
id = a unique id that you will refer to in other ldap_* tables
id = 一个唯一标示服用于在其他表中引用
name = The value for objectClass
name = objectclass名称
keytbl = the table where entities for the objectClass are held. Ex: inetOrgPerson is for identifying people, so it uses the persons table in the test data.
keytbl = objectclass在数据库中对应映射的表名（每条objectclass在数据库对应一个实体表用于储存相关objectclass的记录）
keycol = the table's primary key column name
keycol = objectclass表中的主键
create_proc = the SQL code when an LDAP create is called
create_proc = 创建objectclass时使用的sql
delete_proc = the SQL code when an LDAP delete is called
delete_proc = 删除时使用的sql
expect_return = what to expect when the query is successful (ie not an error)
expect_return = 请求成功时返回
The ldap_attr_mappings table is where you put your field definitions (table colum = ldap type). Columns:
ldap_attr_mappings表用于储存关于ldap字段的描述
id = a unique id that you will refer to in other ldap_* tables
id = 一个唯一标示符用于在其他表中引用
oc_map_id = refers back to the id of the relevant objectClass in the ldap_oc_mappings table
oc_map_id = 使用这个字段的相关objectclass的id，这个id对应ldap_oc_mappings的id
name = the ldap attribute name
name = 这个字段的名称
sel_expr = the SELECT
xxxx part of the SQL statement
sel_expr = 如何从该objectclass实体表中查出对应的字段数据的sql
from_tbls = the FROM
xxxx part of the SQL statement
from_tbls = 查询的objectclass实体表名
join_where = the WHERE ...
xx.xx=yy.yy ... part of the SQL statement if applicable. A null is allowed if you are not doing a join.
join_tbls = 如果查询数据时候需要join操作，在此列填写
add_proc = the SQL code when an LDAP create is called
add_proc = 添加字段时使用的sql
delete_proc = the SQL code when an LDAP delete is called
delete_proc = 删除字段时使用的sql
param_order = (I have no idea, but 3 seems to be the default in the test data.)
expect_return = what to expect when the query is successful (ie not an error)
expect_return = 请求成功时返回
The ldap_entries table is where you define the mappings between the DN entries in the LDAP tree. Columns:
ldap_entries表主要用来记录你定义的DN实体在ldap树中的位置
id = a unique id
id = 唯一标示符
dn = the dn for an entry
dn = 实体的dn
oc_map_id = refers back to the id of the relevant objectClass in the ldap_oc_mappings table
oc_map_id = 该实体所属的objectclass在ldap_oc_mappings中的id
parent = what level in the LDAP tree this is located at, starting with 0 (zero)
parent = 该实体的父节点id
keyval = refers back to the id of the relevant row of the table the data is contained in. These rows are identified by a number that is a primary key.
keyval = 这是这个实体在相应的objectclass的表中的记录的id
Note: If you database server supports VIEW, see the concepts in (
openldap-*)/servers/slapd/back-sql/docs.
The ldap_entry_objectclass... something to do with multiclassing?
The ldap_referrals... something to do with referrals?
我的英语水平不好这也是我根据自己的理解加以翻译。
关于如何在ldap中插入或者删除记录
由于使用了sql作为后段，传统的ldap命令都不能使用了，只能使用手动了插入数据库的方式，如果想要使用自己定义的objectclass也必须在数据库中给出起查询的sql实现，所有操作都必须自己完成，有些繁琐。官网也给出使用sql数据库作为后端为实验性能容，建议如果不是必须还是使用伯克利数据库作为后端最佳。当然使用mysql结合视图可以完成很多ldap不能完成的复杂查询。
关于删除数据，我发现一个问题，在数据库删除了的数据在ldap终不能立刻生效，只有重启后才能生效，但是插入的数据可以立即生效，可能是我是用的openldap版本的一个bug
https://bugzilla.redhat.com/show_bug.cgi?id=1114980 这里可以看到这个bug应该已经修复了