nginx反向代理registry，用ldap做验证

Posted 2020-06-14

1.安装nginx

（1安装pcre:
    tar zxvf  pcre-8.37.tar
    cd pcre-8.37
    ./configure
    make && make install
（2安装openssl
    tar zxvf  openssl-1.0.1g.tar.gz
    cd openssl-1.0.1g
    ./config
    make %% make install 
  如果openssl还是报错就:yum -y install  openssl openldap-devel
  (3安装nginx
  cd /usr/src
  tar zxvf nginx-1.6.2.tar.gz 
  cd nginx-1.6.2
  ./configure   --prefix=/usr/local/nginx  
  make && make install

2.nginx安装ldap模块

cd /usr/src/
git clone https://github.com/kvspb/nginx-auth-ldap.git   
cd /usr/src/nginx-1.6.2
./configure --add-module=/usr/src/nginx-auth-ldap/
make install

3.搭建registry（省略）

4.修改nginx配置文件

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}
#ldap认证 
http {




    log_format  main  ‘$remote_addr - $remote_user [$time_local] "$request" ‘
                      ‘$status $body_bytes_sent "$http_referer" ‘
                      ‘"$http_user_agent" "$http_x_forwarded_for"‘;
    access_log  /var/log/nginx/access.log  main;
    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
    include /etc/nginx/conf.d/*.conf;
    #反向代理配置

    ldap_server test1 {
        url ldap://10.10.212.71/ou=People,dc=wepaas,dc=com?uid?sub?(objectClass=*);
        #binddn "uid=wepaas,ou=People,dc=wepaas,dc=com";  
        #binddn_passwd "wepaas2016#";
        group_attribute uniquemember;
        group_attribute_is_dn on;
        require valid_user;
     }
    upstream webserver {
       server 127.0.0.1:5000;

      }
    server {
       listen       9000 default_server;
       server_name  registry.eitcloud.cn;
       location / {
            proxy_pass http://webserver;
            auth_ldap_servers   test1;
            auth_ldap "Forbidden";
            root  html;
            index index.html  index.htm;

        }
        }

}

参考文档:

https://github.com/kvspb/nginx-auth-ldap

http://www.365dw.cn/575.html

本文出自 “翟军铭的linux博客” 博客，请务必保留此出处http://zhaijunming5.blog.51cto.com/10668883/1743907