Gerrit和OpenLDAP服务器集成-白红宇

Gerrit和OpenLDAP服务器集成

阅读量：6530 次

发布时间：2019-06-24

本文共 9495 字，大约阅读时间需要 31 分钟。

　　　　　　　　　　Gerrit和OpenLDAP服务器集成

　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　作者：尹正杰

一.安装LDAP服务器

　　详情请参考：https://www.cnblogs.com/yinzhengjie/p/11020700.html

二.安装Gerrit基于LDAP验证（我们之前演示基于""认证的方式）

[gerrit@node201.yinzhengjie.org.cn ~/soft]$  java -jar gerrit-2.15.14.war initUsing secure store: com.google.gerrit.server.securestore.DefaultSecureStore*** Gerrit Code Review 2.15.14*** *** Git Repositories*** Location of Git repositories   [git]: *** SQL Database*** Database server type           [mysql]: Server hostname                [node201.yinzhengjie.org.cn]: Server port                    [3306]: Database name                  [gerrit]: Database username              [gerrit]: Change gerrit's password       [y/N]? n*** Index*** Type                           [lucene/?]: The index must be rebuilt before starting Gerrit:  java -jar gerrit.war reindex -d site_path*** User Authentication*** Authentication method          [development_become_any_account/?]: ?       Supported options are:         openid         openid_sso         http         http_ldap         client_ssl_cert_ldap         ldap         ldap_bind         custom_extension         development_become_any_account         oauthAuthentication method          [development_become_any_account/?]: ldapGit/HTTP authentication        [http/?]: LDAP server                    [ldap://localhost]: ldap://node202.yinzhengjie.org.cn:389　　　　　　　　　　　　　　#指定LDAP的服务器地址LDAP username                  : cn=Manager,dc=yinzhengjie,dc=org,dc=cn　　　　　　　　　　　　　　　　　　　　　　　　#指定LDAP的用户名cn=Manager,dc=yinzhengjie,dc=org,dc=cn's password : 　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　　#输入登陆LDAP的密码              confirm password : Account BaseDN                 [DC=yinzhengjie,DC=org,DC=cn:389]: ou=People,dc=yinzhengjie,dc=org,dc=cn　　　　  #指定我们认证用户对应的LDAP路径Group BaseDN                   [ou=People,dc=yinzhengjie,dc=org,dc=cn]: ou=Group,dc=yinzhengjie,dc=org,dc=cn　　 #指定我们认证的用户组对应的LDAP路径Enable signed push support     [y/N]? n*** Email Delivery*** SMTP server hostname           [smtp.qq.com]: SMTP server port               [465]: SMTP encryption                [ssl/?]: SMTP username                  [y1053419035@qq.com]: Change y1053419035@qq.com's password [y/N]? n*** Container Process*** Run as                         [gerrit]: Java runtime                   [/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre]: Upgrade ./bin/gerrit.war       [Y/n]? n*** SSH Daemon*** Listen on address              [node201.yinzhengjie.org.cn]: Listen on port                 [29418]: *** HTTP Daemon*** Behind reverse proxy           [y/N]? nUse SSL (https://)             [y/N]? nListen on address              [node201.yinzhengjie.org.cn]: Listen on port                 [8080]: Canonical URL                  [http://172.30.1.201:8080]: *** Cache*** Delete cache file /yinzhengjie/softwares/gerrit/soft/cache/diff_summary.lock.db [y/N]? y　　　　　　　　#删除掉之前的缓存文件Delete cache file /yinzhengjie/softwares/gerrit/soft/cache/diff_summary.h2.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/change_kind.lock.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/change_kind.h2.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/mergeability.lock.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/mergeability.h2.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/conflicts.lock.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/conflicts.h2.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/diff_intraline.lock.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/diff_intraline.h2.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/diff.lock.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/diff.h2.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/oauth_tokens.lock.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/oauth_tokens.h2.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/git_tags.lock.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/git_tags.h2.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/web_sessions.lock.db [y/N]? yDelete cache file /yinzhengjie/softwares/gerrit/soft/cache/web_sessions.h2.db [y/N]? y*** Plugins*** Installing plugins.Install plugin commit-message-length-validator version v2.15.14 [Y/n]? y　　　　　　　　　　#安装对应的插件但不覆盖commit-message-length-validator v2.15.14 is already installed, overwrite it [Y/n]? nInstall plugin download-commands version v2.15.14 [Y/n]? ydownload-commands v2.15.14 is already installed, overwrite it [Y/n]? nInstall plugin hooks version v2.15.14 [Y/n]? yhooks v2.15.14 is already installed, overwrite it [Y/n]? nInstall plugin replication version v2.15.14 [Y/n]? yreplication v2.15.14 is already installed, overwrite it [Y/n]? nInstall plugin reviewnotes version v2.15.14 [Y/n]? yreviewnotes v2.15.14 is already installed, overwrite it [Y/n]? nInstall plugin singleusergroup version v2.15.14 [Y/n]? ysingleusergroup v2.15.14 is already installed, overwrite it [Y/n]? nInitializing plugins.*** Experimental features*** Enable any experimental features [y/N]? yDefault to PolyGerrit UI       [Y/n]? yEnable GWT UI                  [Y/n]? yTue Jun 18 04:57:05 EDT 2019 WARN: Establishing SSL connection without server's identity verification is not recommended. According to MySQL 5.5.45+, 5.6.26+ and 5.7.6+ requirements SSL connection must be established by default if explicit option isn't set. For compliance with existing applications not using SSL the verifyServerCertificate property is set to 'false'. You need either to explicitly disable SSL by setting useSSL=false, or set useSSL=true and provide truststore for server certificate verification.Tue Jun 18 04:57:06 EDT 2019 WARN: Establishing SSL connection without server's identity verification is not recommended. According to MySQL 5.5.45+, 5.6.26+ and 5.7.6+ requirements SSL connection must be established by default if explicit option isn't set. For compliance with existing applications not using SSL the verifyServerCertificate property is set to 'false'. You need either to explicitly disable SSL by setting useSSL=false, or set useSSL=true and provide truststore for server certificate verification.Initialized /yinzhengjie/softwares/gerrit/soft[gerrit@node201.yinzhengjie.org.cn ~/soft]$ [gerrit@node201.yinzhengjie.org.cn ~/soft]$

三.启动Gerrit服务

1>.启动Gerrit服务（MySQL数据库别忘记启动了哈）

[gerrit@node201.yinzhengjie.org.cn ~/soft]$ ./bin/gerrit.sh startStarting Gerrit Code Review: WARNING: Could not adjust Gerrit's process for the kernel's out-of-memory killer.         This may be caused by ./bin/gerrit.sh not being run as root.         Consider changing the OOM score adjustment manually for Gerrit's PID=21559 with e.g.:         echo '-1000' | sudo tee /proc/21559/oom_score_adjOK[gerrit@node201.yinzhengjie.org.cn ~/soft]$

2>.检查启动的端口

[gerrit@node201.yinzhengjie.org.cn ~/soft]$ ss -ntlState       Recv-Q Send-Q                                                    Local Address:Port                                                                   Peer Address:Port              LISTEN      0      50                                                         172.30.1.201:29418                                                                             *:*                  LISTEN      0      50                                                         172.30.1.201:8080                                                                              *:*                  LISTEN      0      128                                                                   *:22                                                                                *:*                  LISTEN      0      100                                                           127.0.0.1:25                                                                                *:*                  LISTEN      0      80                                                                   :::3306                                                                             :::*                  LISTEN      0      128                                                                  :::22                                                                               :::*                  [gerrit@node201.yinzhengjie.org.cn ~/soft]$

3>.访问Gerrit对应的WebUI（）

4>.输入在LDAP中创建的用户名和密码（如果你输入的用户和密码不存在，则登陆失败，服务器也会产生错误日志，根据日志的报错信息来解决问题即可）

[gerrit@node201.yinzhengjie.org.cn ~/soft/logs]$ tail -100f error_log 　　　　　　#登陆成功后，我们会在对应的如下日志信息......[2019-06-18 05:15:28,761] [HTTP-67] INFO  com.googlesource.gerrit.plugins.hooks.HookFactory : hooks.path: /yinzhengjie/softwares/gerrit/soft/hooks[2019-06-18 05:15:28,762] [HTTP-67] INFO  com.googlesource.gerrit.plugins.hooks.HookFactory : hooks.refUpdatedHook resolved to /yinzhengjie/softwares/gerrit/soft/hooks/ref-updated[2019-06-18 05:15:28,962] [HTTP-67] INFO  com.google.gerrit.server.account.ChangeUserName : Created the new external Id with key: username:jason