ivaneeo's blog

location / {     proxy_pass http://127.0.0.1:9999;     proxy_connect_timeout 60;     proxy_set_header Host $host;     proxy_set_header X-Real-IP $remote_addr;     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;     proxy_set_header X-NginX-Proxy true;      # 下面是關鍵     proxy_http_version 1.1;     proxy_set_header Upgrade $http_upgrade;     proxy_set_header Connection "upgrade";     # 這是配置webpysessoin丟失的問題     fastcgi_param  SCRIPT_NAME        ""; }

http://nginx.org/en/docs/http/websocket.html

------------------------------------lic-------------------------------------

*u3-7QAAAAIAAAABAAAAAgAKcHVibGljY2VydAAAAUjuvYiDAAVYLjUwOQAAAzQwggMwMIIC7qAD

AgECAgQnLAd6MAsGByqGSM44BAMFADBqMQswCQYDVQQGEwJDTjEQMA4GA1UECBMHYmVpamluZzEQ

MA4GA1UEBxMHYmVpamluZzERMA8GA1UEChMIcHJveHpvbmUxETAPBgNVBAsTCHByb3h6b25lMREw

DwYDVQQDEwhwcm94em9uZTAeFw0xNDEwMDgwNzUxMTFaFw0yNDEwMDUwNzUxMTFaMGoxCzAJBgNV

BAYTAkNOMRAwDgYDVQQIEwdiZWlqaW5nMRAwDgYDVQQHEwdiZWlqaW5nMREwDwYDVQQKEwhwcm94

em9uZTERMA8GA1UECxMIcHJveHpvbmUxETAPBgNVBAMTCHByb3h6b25lMIIBtzCCASwGByqGSM44

BAEwggEfAoGBAP1*U4EddRIpUt9KnC7s5Of2EbdSPO9EAMMeP4C2USZpRV1AIlH7WT2NWPq*xfW6

MPbLm1Vs14E7gB00b*JmYLdrmVClpJ-f6AR7ECLCT7up1*63xhv4O1fnxqimFQ8E-4P208UewwI1

VBNaFpEy9nXzrith1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC*BYHPUCgYEA9-Gghdab

Pd7LvKtcNrhXuXmUr7v6OuqC-VdMCz0HgmdRWVeOutRZT-ZxBxCBgLRJFnEj6EwoFhO3zwkyjMim

4TwWeotUfI0o4KOuHiuzpnWRbqN*C*ohNWLx-2J6ASQ7zKTxvqhRkImog9*hWuWfBpKLZl6Ae1Ul

ZAFMO*7PSSoDgYQAAoGAR-WVUpxcibqSXpi4VHPXIEoiBCu9Ik8AHItVuevHmPqsOLB5ZXbC2qbN

oIVaJyhLntmeCS6M3ZOPWzHdNqcYdA1Rt9nNYQNpHgaMdHJo-w-ueUCDoo7-L2ho6c59P604f7IA

qmjfSnSWdB5OZlQebi23d96awCLTS0bQkN1k0w2jITAfMB0GA1UdDgQWBBS4wsh7wxLuDzvl1gxL

2oA9AevomTALBgcqhkjOOAQDBQADLwAwLAIUSGuB1IXVBwg0VcHn2iBzAjdMUxQCFCUNoYiFqGE7

Qbx9r-jA9BpDOyuDq5iw6uBl83BChP5kQrBpVLJxZbs=

----------------------------------------------------------------------------

GgYqeio1TiUuLqb1kOvqbpAyOV-CXGt7KCibUH*icgfcehQjhsIHNgisDDDt7AZAeZptrTYf56ky

xrzMEkPdoMMoFQGV*9kEXoab6awrAXP-GDcUAwOK7KS*q8-3O-UY7yjOaSMjR2QHszAgkLrFUuxt

onkCQa6EAriSiWdYu*7FGbTlQNAmiUTXilsnnWSCXyw7Hl6xP08kNbovUY4e31D-boaCdW-hQPQw

0XbDZJdT5ndCo4Mh-R4vu6gSmt*t3QJhp7pyeQeOR6VxpIJRFMUCwz2Ddrn0D160nQJ2fx2vchE-

Cz*vDkgQbCkFb7m9aBxKWztEZnATDwyYjyQmOXlcwO1ef4rdpxrBqpib9H5K1ddcQy6xkQdQXdvP

b-Jvq1Dmh*IKrayoqWQY09fdgEKAjmadF7xYKnEVL5nDwI9ZhtIlOrYktQ6q8NqCLd4wKolMTx8q

uOGWe-259-SGrSUNOp*-kgJXkWnqnRVs3do02XSWAsysixFJVSHNItePltdmBGimexVa1G8rV2dz

rSmPyCDlzF12SZKKYePDQOmaYM4EYiUL9Et271D9tv5SsvEzMZhwFiolb33peKztzz2tZ4lOZbXf

c-9sEPqhiOLYkDGqzxfnNyTjtTI4vz9WYqNjOe4SwOxsnHPkltb2evP4hyXru1CZNsm3w9dt1cHu

i6QMYgYz1ivHKoyZ0iAh8N*NtN7o0OAxptyaDv9v-SsqXljN4af0BdJOzwMzSS65B8f47poUH3X-

sKJIp797A5PTviXrCIwP126YWqPgUUHQ5LrsrsxKoQf6nTn7d*QAEQY5FIEoBtbmpq90KBVFVuZg

OKSawSAuJh7Vv2EK3QWS0lk31eRSXymI85ERboNNGbNmMwek*k02KCtlLP4kO2CNs5WF74Dwo732

wVAcdz3VXKt1bmk-

----------------------------------------------------------------------------

Z29kMzU3MXByb3h6b25lIQ==

首先把我看到的有用的資料留下：

1、官方文檔-基本用戶手冊：http://directory.apache.org/apacheds/basic-user-guide.html 主要介紹了安裝以及基本操作、登錄等。

2、官方文檔-高級用戶手冊：http://directory.apache.org/apacheds/advanced-user-guide.html 介紹了代碼編譯、系統結構、服務配置以及服務權限管理，這里吐槽一下，真的很難懂，并且各種TODO；

3、看起來像官方的文檔：http://joacim.breiler.com/apacheds/book.html 介紹得很詳盡，例子也很豐富。

4、訪問控制實例 FR20_ApacheDS_Access_Control_Administration_The_X.500_Way.pdf  

=============================================================================================================

常用的名詞解析：

DIT  Directory Information Tree
AA administrative areas
AP administrative points

AAA autonomous administrative area 有自治權的管理區域，所有的實體均統一管理
SAA specific administrative area 特定管理區域
IAA  inner administrative area  內部管理區域

SAP specific administrative point
ACI Access Control Information

Usually an entry is selected as the administrative point and marked with an operational attribute. The attributeType of the operational attribute is 'administrativeRole'. 
通過添加一個可選屬性來使一個實體成為管理點

ACSA access control specific area

=================================================================================================================

實戰演練

需求：

1、LDAP超級管理員，管理LDAP上的所有數據；

2、匿名用戶可以查看用戶信息；

3、用戶分為開發、測試和運維三組；

4、通過用戶組授權

操作指南：

1、安裝ApacheDS服務端；

  下載地址：apacheds-2.0.0-M15-64bit.bin 下載到目錄/home/apacheds/

[plain] view plaincopy

1. chmod +x *.bin  

[plain] view plaincopy

1. /etc/init.d/apacheds-2.0.0-M15-default start  

2、安裝Apache Directory Studio

本次使用Eclipse插件，詳見 http://directory.apache.org/studio/installation-in-eclipse.html，也支持Eclipse market安裝。

3、連接與配置

切換到Eclipse的LDAP視圖，新建連接

hostname:199.155.122.90 port：10389 encryption method: nocryption （不同加密算法端口注意）

authentication method: simple user:uid=admin,ou=system passwd:secret （默認的最高權限用戶）

OpenConfiguration啟用Access Control，禁用匿名登錄

重啟apacheds服務生效

4、分區設置

系統默認example分區，我們刪除之，并新建，本次創建dc=xxx.com

5、新建ou=users，新建ou=groups。

[plain] view plaincopy

1. dn: ou=groups,dc=taotaosou.com  
2. objectClass: organizationalUnit  
3. objectClass: top  
4. ou: groups  

[plain] view plaincopy

1. dn: ou=users,dc=taotaosou.com  
2. objectClass: organizationalUnit  
3. objectClass: top  
4. ou: users  

[plain] view plaincopy

1. dn: dc=taotaosou.com  
2. objectclass: domain  
3. objectclass: top  
4. dc: taotaosou.com  
5. administrativeRole: accessControlSpecificArea  

[plain] view plaincopy

1. dn: cn=enableAllUsersRead,dc=taotaosou.com  
2. objectClass: subentry  
3. objectClass: accessControlSubentry  
4. objectClass: top  
5. cn: enableAllUsersRead  
6. prescriptiveACI: { identificationTag "enableAllUsersRead", precedence 0, aut  
7.  henticationLevel none, itemOrUserFirst userFirst: { userClasses { allUsers   
8.  }, userPermissions { { protectedItems { entry, allUserAttributeTypesAndValu  
9.  es }, grantsAndDenials { grantCompare, grantFilterMatch, grantRead, grantRe  
10.  turnDN, grantBrowse } } } } }  
11. subtreeSpecification: { }  

[plain] view plaincopy

1. dn: cn=allowSelfAccessAndModification,dc=taotaosou.com  
2. objectClass: subentry  
3. objectClass: accessControlSubentry  
4. objectClass: top  
5. cn: allowSelfAccessAndModification  
6. prescriptiveACI: { identificationTag "allowSelfAccessAndModification", prece  
7.  dence 10, authenticationLevel simple, itemOrUserFirst userFirst: { userClas  
8.  ses { thisEntry }, userPermissions { { protectedItems { entry, allUserAttri  
9.  buteTypesAndValues }, grantsAndDenials { grantRemove, grantExport, grantCom  
10.  pare, grantImport, grantRead, grantFilterMatch, grantModify, grantInvoke, g  
11.  rantDiscloseOnError, grantRename, grantReturnDN, grantBrowse, grantAdd } }   
12.  } } }  
13. subtreeSpecification: { }  

[plain] view plaincopy

1. dn: cn=enableAdminSuper,dc=taotaosou.com  
2. objectClass: subentry  
3. objectClass: accessControlSubentry  
4. objectClass: top  
5. cn: enableAdminSuper  
6. prescriptiveACI: { identificationTag "enableAdminSuper", precedence 0, authe  
7.  nticationLevel strong, itemOrUserFirst userFirst: { userClasses { userGroup  
8.   { "cn=administrator,ou=gourp,dc=taotaosou.com" } }, userPermissions { { pr  
9.  otectedItems { entry, allUserAttributeTypesAndValues }, grantsAndDenials {   
10.  grantRemove, grantExport, grantCompare, grantImport, grantRead, grantFilter  
11.  Match, grantModify, grantInvoke, grantDiscloseOnError, grantRename, grantRe  
12.  turnDN, grantBrowse, grantAdd } } } } }  
13. subtreeSpecification: { }  
    
    
    
    http://blog.csdn.net/lansine2005/article/details/19978411