{"id":32899,"date":"2023-09-09T05:26:17","date_gmt":"2023-09-01T04:42:52","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/"},"modified":"2024-04-30T22:06:18","modified_gmt":"2024-04-30T14:06:18","slug":"%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/","title":{"rendered":"\u5c1d\u8bd5\u4f7f\u7528Keycloak+OAuth2\u4ee3\u7406+OpenLDAP\u8fdb\u884cLdap\u8ba4\u8bc1"},"content":{"rendered":"

\u8fd9\u6b21\u5b9e\u65bd\u7684\u7ec4\u5408<\/h1>\n
\"\u69cb\u6210\u56f3.jpg\"<\/div>\n

\u73af\u5883<\/h1>\n
    \n
  • \n
      WSL Ubuntu 20.04<\/ul>\n<\/li>\n<\/ul>\n

       <\/p>\n

        Docker version 20.10.14<\/ul>\n

        Keycloak\u662f\u4ec0\u4e48\uff1f<\/h1>\n

        Keycloak\u662f\u4e00\u6b3e\u5f00\u6e90\u8f6f\u4ef6\u3002<\/p>\n

          \n
        • \n
            \u30b7\u30f3\u30b0\u30eb\u30b5\u30a4\u30f3\u30aa\u30f3<\/ul>\n<\/li>\n<\/ul>\n

             <\/p>\n

              \n
            • \n
                \u30a2\u30a4\u30c7\u30f3\u30c6\u30a3\u30c6\u30a3\u7ba1\u7406<\/ul>\n<\/li>\n<\/ul>\n

                 <\/p>\n

                  \u30a2\u30af\u30bb\u30b9\u7ba1\u7406\u306e\u6a5f\u80fd<\/ul>\n

                  \u63d0\u4f9b\u7b49\u7b49\u7684\u670d\u52a1\u3002<\/p>\n

                  OAuth2 Proxy \u662f\u4ec0\u4e48\uff1f<\/h1>\n

                  \u9019\u662f\u4e00\u500b\u7528\u65bc\u5c07\u8a8d\u8b49\u548c\u6388\u6b0a\u59d4\u8a17\u7d66\u5916\u90e8\u8a8d\u8b49\u57fa\u790e\u8a2d\u65bd\u7684\u53cd\u5411\u4ee3\u7406\u4f3a\u670d\u5668\u3002\uff08\u53c3\u8003\uff1aOAuth2 Proxy\uff09<\/p>\n

                  \u4f7f\u7528OIDC\u63d0\u4f9b\u7a0b\u5e8f\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\u5e76\u8fdb\u884c\u5e10\u6237\u9a8c\u8bc1\u3002 OIDC\u662f\u201cOpenID Connect\u201d\u7684\u7f29\u5199\uff0c\u662f\u4e00\u79cd\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\u7684\u534f\u8bae\u4e4b\u4e00\u3002\uff08\u53c2\u8003\uff1a\u5173\u4e8eOAuth\u548cOpenID Connect\u7684\u8bf4\u660e\uff1a\u673a\u5236\u548c\u7279\u70b9\u7b49\u89e3\u91ca\uff09<\/p>\n

                  \u5c06Keycloak\u6784\u5efa\u4e3aDocker\u5bb9\u5668\u3002<\/h1>\n

                  \u6211\u5df2\u7ecf\u5c06\u4f7f\u7528\u7684\u6e90\u4ee3\u7801\u5b58\u653e\u5728GitHub\u4e0a\u3002<\/p>\n

                    v1tam1nb2\/keycloak-oauth2-proxy-ldap<\/ul>\n

                    \u8fd8\u6709\u4e00\u4e2a\u516c\u5f0f\u7684\u5feb\u901f\u5165\u95e8\u6307\u5357\u3002<\/p>\n

                      Get started with Keycloak on Docker<\/ul>\n

                      \u521b\u5efaDocker\u7f51\u7edc<\/h2>\n

                      \u521b\u5efa\u7528\u4e8e\u672c\u6b21\u9a8c\u8bc1\u7684\u5bb9\u5668\u7f51\u7edc\u3002<\/p>\n

                      docker network create oauth_network\r\n<\/code><\/pre>\n
                      Keycloak\u7684\u52a0\u5bc6\u534f\u8bae\u8f6c\u6362\u6210HTTPS.<\/h2>\n
                      cd <\/span>keycloak\r\nmkdir <\/span>certs\r\nopenssl req -x509<\/span> -sha256<\/span> -nodes<\/span> -days<\/span> 3650 -newkey<\/span> rsa:2048 -subj<\/span> \/CN=<\/span>localhost -keyout<\/span> server.key -out<\/span> server.crt\r\n<\/code><\/pre>\n
                      \u7701\u7565\u4e86\u4e00\u4e9b\u5185\u5bb9\uff0c\u4f46\u6587\u4ef6\u5939\u7684\u7ed3\u6784\u662f\u57fa\u4e8e\u4ee5\u4e0b\u72b6\u6001\u6765\u6784\u5efa\u7684\u3002<\/p>\n
                      .<\/span>\r\n\u251c\u2500\u2500 docker-compose.yaml\r\n\u251c\u2500\u2500 .env\r\n\u251c\u2500\u2500 keycloak\r\n\u2502   \u251c\u2500\u2500 certs\r\n\u2502   \u2502   \u251c\u2500\u2500 server.crt\r\n\u2502   \u2502   \u2514\u2500\u2500 server.key\r\n\u2502   \u2514\u2500\u2500 keycloak.yaml\r\n\u251c\u2500\u2500 openldap\r\n\u2502   \u2514\u2500\u2500  testuser.ldif\r\n\u2514\u2500\u2500 openresty\r\n    \u2514\u2500\u2500 nginx.conf\r\n<\/code><\/pre>\n
                      \u6784\u5efaKeycloak\u5bb9\u5668<\/h2>\n
                      version<\/span>:<\/span> '<\/span>3'<\/span>\r\nservices<\/span>:<\/span>\r\n  keycloak<\/span>:<\/span>\r\n    image<\/span>:<\/span> quay.io\/keycloak\/keycloak:latest<\/span>\r\n    container_name<\/span>:<\/span> keycloak<\/span>\r\n    tty<\/span>:<\/span> true<\/span>\r\n    ports<\/span>:<\/span>\r\n      -<\/span> \"<\/span>18080:8080\"<\/span>\r\n      -<\/span> \"<\/span>8443:8443\"<\/span>\r\n    volumes<\/span>:<\/span>\r\n      -<\/span> .\/keycloak\/data:\/opt\/keycloak\/data<\/span>\r\n      -<\/span> .\/keycloak\/certs:\/etc\/x509\/https<\/span>\r\n    environment<\/span>:<\/span>\r\n      KEYCLOAK_ADMIN<\/span>:<\/span> admin<\/span>\r\n      KEYCLOAK_ADMIN_PASSWORD<\/span>:<\/span> passwd<\/span>\r\n      KC_HOSTNAME_STRICT_HTTPS<\/span>:<\/span> '<\/span>false'<\/span>\r\n      KC_HTTPS_CERTIFICATE_FILE<\/span>:<\/span> \/etc\/x509\/https\/server.crt<\/span>\r\n      KC_HTTPS_CERTIFICATE_KEY_FILE<\/span>:<\/span> \/etc\/x509\/https\/server.key<\/span>\r\n    command<\/span>:<\/span>\r\n      -<\/span> start-dev<\/span>\r\n    networks<\/span>:<\/span>\r\n    -<\/span> oauth_network<\/span>\r\n\r\nnetworks<\/span>:<\/span>\r\n  oauth_network<\/span>:<\/span>\r\n    external<\/span>:<\/span> true<\/span>\r\n<\/code><\/pre>\n
                      \u542f\u52a8\u5bb9\u5668\u3002<\/p>\n
                      docker-compose -f<\/span> keycloak.yaml up -d<\/span>\r\n<\/code><\/pre>\n
                      \u7136\u800c\uff0c\u5982\u679c\u4ecd\u7136\u4fdd\u6301\u73b0\u72b6\uff0c\u7531\u4e8e\u97f3\u91cf\u7ba1\u7406\u6743\u9650\u95ee\u9898\uff0c\u542f\u52a8\u5c06\u5931\u8d25\uff0c\u56e0\u6b64\u8bf7\u6267\u884c\u4ee5\u4e0b\u64cd\u4f5c\u3002<\/p>\n
                      docker-compose -f<\/span> keycloak.yaml down\r\nchown<\/span> -R<\/span> 1000:0 data\/\r\nchown<\/span> -R<\/span> 1000:0 certs\/\r\n<\/code><\/pre>\n
                      \u518d\u6b21\u542f\u52a8\u5bb9\u5668\u3002<\/p>\n
                      docker-compose -f<\/span> keycloak.yaml up -d<\/span>\r\n<\/code><\/pre>\n
                      \u8bf7\u8bbf\u95ee\u4ee5\u4e0b\u5185\u5bb9\u3002<\/p>\n
                       <\/p>\n
                      Keycloak\u7684\u754c\u9762\u4f1a\u663e\u793a\u51fa\u6765\u3002<\/p>\n
                      \"keycloak_001.jpg\"<\/div>\n
                      \u9009\u62e9\u7ba1\u7406\u63a7\u5236\u53f0\u3002<\/p>\n
                      \u8bf7\u8f6c\u5230\u767b\u5f55\u754c\u9762\uff0c\u5e76\u8f93\u5165\u5728keycloak.yaml\u6587\u4ef6\u4e2d\u8bbe\u7f6e\u7684\u4ee5\u4e0b\u767b\u5f55\u4fe1\u606f\u3002<\/p>\n
                        \n
                      • \n
                          admin<\/ul>\n<\/li>\n<\/ul>\n
                           <\/p>\n
                            passwd<\/ul>\n
                            \"keycloak_002.jpg\"<\/div>\n
                            \u521b\u5efa\u9886\u57df<\/h2>\n
                            \"keycloak_003.jpg\"<\/div>\n
                            \u521b\u5efa\u5ba2\u6237<\/h2>\n
                            \u9009\u62e9”\u521b\u5efa\u5ba2\u6237”\u9009\u9879\u3002<\/p>\n
                            \u5728\u8f93\u5165oauth2-proxy\u4f5c\u4e3a\u5ba2\u6237\u7aefID\u540e\uff0c\u9009\u62e9\u4e0b\u4e00\u6b65\u3002<\/p>\n
                            \"keycloak_004.jpg\"<\/div>\n
                            \u5c06\u5ba2\u6237\u8eab\u4efd\u8ba4\u8bc1\u8bbe\u7f6e\u4e3a\u5f00\u542f\uff0c\u5e76\u9009\u62e9”\u4e0b\u4e00\u6b65”\u3002<\/p>\n
                            \"keycloak_005.jpg\"<\/div>\n
                            \u5728”Valid redirect URIs”\u548c”Web origins”\u680f\u76ee\u4e2d\u8f93\u5165*\uff0c\u7136\u540e\u9009\u62e9\u4fdd\u5b58\u3002<\/p>\n
                            \"keycloak_006.jpg\"<\/div>\n
                            \u590d\u5236\u51ed\u8bc1<\/h2>\n
                            \u4fdd\u7559\u4e0b\u6765\u540e\u9762\u4f1a\u5728OAuth2\u4ee3\u7406\u4e2d\u4f7f\u7528\u3002<\/p>\n
                            \"keycloak_007.jpg\"<\/div>\n
                            \u5728\u4e2d\u56fd\u672c\u571f\u5316\u7684\u60c5\u51b5\u4e0b\uff0c\u521b\u5efaOAuth2\u4ee3\u7406\/OpenLDAP\/Openresty\u5bb9\u5668\u3002<\/h1>\n
                            version<\/span>:<\/span> '<\/span>3'<\/span>\r\nservices<\/span>:<\/span>\r\n  webapp<\/span>:<\/span>\r\n    image<\/span>:<\/span> openresty\/openresty:latest<\/span>\r\n    container_name<\/span>:<\/span> webapp<\/span>\r\n    hostname<\/span>:<\/span> webapp<\/span>\r\n    networks<\/span>:<\/span>\r\n    -<\/span> oauth_network<\/span>\r\n\r\n  openresty<\/span>:<\/span>\r\n    image<\/span>:<\/span> openresty\/openresty:latest<\/span>\r\n    container_name<\/span>:<\/span> openresty<\/span>\r\n    hostname<\/span>:<\/span> openresty<\/span>\r\n    ports<\/span>:<\/span>\r\n    -<\/span> '<\/span>${HTTP_PORT}:80'<\/span>\r\n    env_file<\/span>:<\/span>\r\n    -<\/span> .\/.env<\/span>\r\n    volumes<\/span>:<\/span>\r\n    -<\/span> .\/openresty\/nginx.conf:\/usr\/local\/openresty\/nginx\/conf\/nginx.conf<\/span>\r\n    # - .\/openresty\/conf.d:\/usr\/local\/openresty\/nginx\/conf\/conf.d<\/span>\r\n    # - .\/openresty\/default.d:\/usr\/local\/openresty\/nginx\/conf\/default.d<\/span>\r\n    networks<\/span>:<\/span>\r\n    -<\/span> oauth_network<\/span>\r\n\r\n  oauth2-proxy<\/span>:<\/span>\r\n    container_name<\/span>:<\/span> oauth2-proxy<\/span>\r\n    hostname<\/span>:<\/span> oauth2-proxy<\/span>\r\n    image<\/span>:<\/span> quay.io\/oauth2-proxy\/oauth2-proxy:latest<\/span>\r\n    ports<\/span>:<\/span>\r\n      -<\/span> 4180:4180<\/span>\r\n    environment<\/span>:<\/span>\r\n      OAUTH2_PROXY_PROVIDER<\/span>:<\/span> oidc<\/span>\r\n      OAUTH2_PROXY_OIDC_EMAIL_CLAIM<\/span>:<\/span> sub<\/span>\r\n      OAUTH2_PROXY_SCOPE<\/span>:<\/span> \"<\/span>openid\"<\/span>\r\n      # keycloak\u3067\u8a2d\u5b9a\u3057\u305fClient ID\u3068\u540c\u3058<\/span>\r\n      OAUTH2_PROXY_CLIENT_ID<\/span>:<\/span> oauth2-proxy<\/span>\r\n      # keycloak\u3067\u53d6\u5f97\u3057\u305fCredentials<\/span>\r\n      OAUTH2_PROXY_CLIENT_SECRET<\/span>:<\/span> \"<\/span>taAhCUFAemBr3Q0pnTESj6Y2V0JBi6yo\"<\/span>\r\n      OAUTH2_PROXY_OIDC_ISSUER_URL<\/span>:<\/span> https:\/\/keycloak:8443\/realms\/demo_realm<\/span>\r\n      # OAUTH2_PROXY_COOKIE_SECRET\u306f\u300cpython -c 'import os,base64; print(base64.urlsafe_b64encode(os.urandom(32)).decode())'\u300d\u3067\u751f\u6210\u53ef\u3002<\/span>\r\n      OAUTH2_PROXY_COOKIE_SECRET<\/span>:<\/span> \"<\/span>5JEx-EnDmjnlN-1wd2EQDMrLLEly5NOUUSYsZCiy3Tc=\"<\/span>\r\n      # keycloak\u3067\u8a2d\u5b9a\u3057\u305fRealm\u306e\u540d\u524d<\/span>\r\n      OAUTH2_PROXY_COOKIE_NAME<\/span>:<\/span> \"<\/span>auth_demo\"<\/span>\r\n      OAUTH2_PROXY_EMAIL_DOMAINS<\/span>:<\/span> \"<\/span>*\"<\/span>\r\n      OAUTH2_PROXY_HTTP_ADDRESS<\/span>:<\/span> 0.0.0.0:4180<\/span>\r\n      OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER<\/span>:<\/span> \"<\/span>true\"<\/span>\r\n      OAUTH2_PROXY_PASS_ACCESS_TOKEN<\/span>:<\/span> \"<\/span>true\"<\/span>\r\n      OAUTH2_PROXY_PASS_USER_HEADERS<\/span>:<\/span> \"<\/span>true\"<\/span>\r\n      OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER<\/span>:<\/span> \"<\/span>true\"<\/span>\r\n      OAUTH2_PROXY_SSL_INSECURE_SKIP_VERIFY<\/span>:<\/span> \"<\/span>true\"<\/span>\r\n      OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL<\/span>:<\/span> \"<\/span>true\"<\/span>\r\n      # \u4ee5\u4e0b\u3001HTTPS \u3067\u306f\u306a\u304f HTTP \u3067\u52d5\u304b\u3059\u305f\u3081\u306e\u8a2d\u5b9a<\/span>\r\n      OAUTH2_PROXY_REDIRECT_URL<\/span>:<\/span> \"<\/span>\"<\/span>\r\n      OAUTH2_PROXY_COOKIE_SECURE<\/span>:<\/span> \"<\/span>false\"<\/span>\r\n      # OAUTH2_PROXY_COOKIE_EXPIRE: \"12h\"<\/span>\r\n      # OAUTH2_PROXY_COOKIE_SECURE: \"true\"<\/span>\r\n      # OAUTH2_PROXY_SET_XAUTHREQUEST: \"true\"<\/span>\r\n      # OAUTH2_PROXY_REVERSE_PROXY: \"true\"<\/span>\r\n      # OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: \"true\"<\/span>\r\n    networks<\/span>:<\/span>\r\n    -<\/span> oauth_network<\/span>\r\n\r\n  ldap-server<\/span>:<\/span>\r\n    image<\/span>:<\/span> osixia\/openldap:latest<\/span>\r\n    restart<\/span>:<\/span> always<\/span>\r\n    container_name<\/span>:<\/span> ldap-server<\/span>\r\n    environment<\/span>:<\/span>\r\n      LDAP_ORGANISATION<\/span>:<\/span> \"<\/span>My<\/span> Company\"<\/span>\r\n      LDAP_DOMAIN<\/span>:<\/span> \"<\/span>my-company.com\"<\/span>\r\n      LDAP_ADMIN_PASSWORD<\/span>:<\/span> \"<\/span>admin\"<\/span>\r\n      LDAP_READONLY_USER<\/span>:<\/span> \"<\/span>true\"<\/span>\r\n      LDAP_READONLY_USER_USERNAME<\/span>:<\/span> \"<\/span>readonly\"<\/span>\r\n      LDAP_READONLY_USER_PASSWORD<\/span>:<\/span> \"<\/span>readonly_password\"<\/span>\r\n      LDAP_TLS_VERIFY_CLIENT<\/span>:<\/span> \"<\/span>never\"<\/span> \r\n    ports<\/span>:<\/span>\r\n      -<\/span> \"<\/span>389:389\"<\/span>\r\n    volumes<\/span>:<\/span>\r\n      -<\/span> .\/openldap\/var\/lib\/ldap:\/var\/lib\/ldap<\/span>\r\n      -<\/span> .\/openldap\/etc\/ldap\/slapd.d:\/etc\/ldap\/slapd.d<\/span>\r\n      -<\/span> .\/openldap\/testuser.ldif:\/slapd\/assets\/custome\/testuser.ldif<\/span>\r\n    networks<\/span>:<\/span>\r\n    -<\/span> oauth_network<\/span>\r\n\r\n  # \u30ed\u30b0\u30a4\u30f3\u60c5\u5831<\/span>\r\n  # Login DN: cn=admin,dc=my-company,dc=com<\/span>\r\n  # Password: admin<\/span>\r\n  ldap-admin<\/span>:<\/span>\r\n    image<\/span>:<\/span> osixia\/phpldapadmin:latest<\/span>\r\n    container_name<\/span>:<\/span> ldap-admin<\/span>\r\n    restart<\/span>:<\/span> always<\/span>\r\n    environment<\/span>:<\/span>\r\n      PHPLDAPADMIN_LDAP_HOSTS<\/span>:<\/span> \"<\/span>ldap\"<\/span>\r\n      PHPLDAPADMIN_HTTPS<\/span>:<\/span> \"<\/span>false\"<\/span>\r\n    ports<\/span>:<\/span>\r\n      -<\/span> \"<\/span>8080:80\"<\/span>\r\n    links<\/span>:<\/span>\r\n      -<\/span> \"<\/span>ldap-server:ldap\"<\/span>\r\n    networks<\/span>:<\/span>\r\n    -<\/span> oauth_network<\/span>\r\n\r\nnetworks<\/span>:<\/span>\r\n  oauth_network<\/span>:<\/span>\r\n    external<\/span>:<\/span> true<\/span>\r\n<\/code><\/pre>\n
                            \u5728OpenResty\u4e2d\uff0c\u7aef\u53e3\u662f\u901a\u8fc7\u73af\u5883\u53d8\u91cf\u8fdb\u884c\u6307\u5b9a\u7684\u3002\u867d\u7136\u5728\u8fd9\u79cd\u60c5\u51b5\u4e0b\u6ca1\u6709\u592a\u5927\u610f\u4e49\uff0c\u4f46\u5982\u679c\u6709\u9700\u8981\u4eceOpenResty\u8bbf\u95ee\u73af\u5883\u53d8\u91cf\u7684\u60c5\u51b5\u51fa\u73b0\uff0c\u8fd9\u4f1a\u5f88\u6709\u5e2e\u52a9\u3002<\/p>\n
                            HTTP_PORT = \"80\"\r\n<\/code><\/pre>\n
                            docker-compose up -d<\/span>\r\n<\/code><\/pre>\n
                            \u4e3b\u673a\u7684\u914d\u7f6e<\/h2>\n
                            OAUTH2_PROXY_OIDC_ISSUER_URL: https:\/\/keycloak:8443\/realms\/demo_realm \u5728Docker\u7f51\u7edc\u4e2d\u901a\u8fc7\u670d\u52a1\u540d\u79f0\u8fdb\u884c\u89e3\u6790\uff0c\u4f46\u5982\u679c\u6ca1\u6709\u4ee5\u4e0b\u8bbe\u7f6e\uff0c\u5c06\u65e0\u6cd5\u6210\u529f\u8fdb\u884c\u8bbf\u95ee\u9a8c\u8bc1\u3002<\/p>\n
                            127.0.0.1 keycloak\r\n<\/code><\/pre>\n
                            \u4f7f\u7528 OpenLDAP \u5bf9\u7528\u6237\u8fdb\u884c\u6ce8\u518c\u3002<\/h2>\n
                            \u8fd9\u662f\u7528\u4e8e\u5728OpenLDAP\u4e2d\u6ce8\u518c\u6d4b\u8bd5\u7528\u6237\u7684\u914d\u7f6e\u6587\u4ef6\u3002
                            \ntest001\u7528\u6237\u7684\u5bc6\u7801\u662ftest001\u3002<\/p>\n
                            dn: cn=test001,dc=my-company,dc=com\r\ngivenName:test001\r\nsn:test001\r\ncn:test001\r\nmail:test001@my-company.com\r\nuserPassword::dGVzdDAwMQ==\r\nobjectClass: inetOrgPerson\r\nobjectClass: top\r\n<\/code><\/pre>\n
                            docker exec ldap-server ldapadd -x -D \"cn=admin,dc=my-company,dc=com\" -w admin -f \/slapd\/assets\/custome\/testuser.ldif -ZZ\r\n<\/code><\/pre>\n
                            \u4f7f\u7528Keycloak\u8bbe\u7f6eLdap<\/h2>\n
                            \u9009\u62e9”\u6dfb\u52a0LDAP\u63d0\u4f9b\u7a0b\u5e8f”\u6765\u8fdb\u884c\u7528\u6237\u8054\u90a6\u3002<\/p>\n
                            \u8fdb\u884c\u4ee5\u4e0b\u8bbe\u7f6e\u3002\u6700\u540e\u6309Save\u6309\u94ae\u4fdd\u5b58\u3002<\/p>\n
                            \"kecloak_ldap_001.jpg\"<\/div>\n
                            \"kecloak_ldap_002.jpg\"<\/div>\n
                            Openresty\u7684\u914d\u7f6e<\/h2>\n
                            \u51e0\u4e4e\u662f\u4ee5\u4e0b\u6587\u672c\u7684\u590d\u5236\u7c98\u8d34\u3002<\/p>\n
                              Configuring for use with the Nginx auth_request directive<\/ul>\n
                              # nginx.conf  --  docker-openresty\r\n#\r\n# This file is installed to:\r\n#   `\/usr\/local\/openresty\/nginx\/conf\/nginx.conf`\r\n# and is the file loaded by nginx at startup,\r\n# unless the user specifies otherwise.\r\n#\r\n# It tracks the upstream OpenResty's `nginx.conf`, but removes the `server`\r\n# section and adds this directive:\r\n#     `include \/etc\/nginx\/conf.d\/*.conf;`\r\n#\r\n# The `docker-openresty` file `nginx.vh.default.conf` is copied to\r\n# `\/etc\/nginx\/conf.d\/default.conf`.  It contains the `server section\r\n# of the upstream `nginx.conf`.\r\n#\r\n# See https:\/\/github.com\/openresty\/docker-openresty\/blob\/master\/README.md#nginx-config-files\r\n#\r\n<\/span>\r\n# \u74b0\u5883\u5909\u6570\uff08env\u306b\u8a2d\u5b9a\u3057\u305f\u30dd\u30fc\u30c8\u756a\u53f7\u3092\u53d6\u5f97\u3057\u305f\u3044\u5834\u5408\u306f\u5229\u7528\u3059\u308b\uff09\r\n# env HTTP_PORT;\r\n<\/span>\r\n#user  nobody;\r\n<\/span>worker_processes<\/span> 1<\/span>;\r\n\r\n# Enables the use of JIT for regular expressions to speed-up their processing.\r\n<\/span>pcre_jit<\/span> on<\/span>;\r\n\r\n\r\n# error_log  \/etc\/nginx\/lua\/error.log;\r\n#error_log  logs\/error.log;\r\n#error_log  logs\/error.log  notice;\r\n#error_log  logs\/error.log  info;\r\n<\/span>\r\n#pid        logs\/nginx.pid;\r\n<\/span>\r\nevents<\/span> {\r\n    worker_connections<\/span>  1024<\/span>;\r\n}\r\n\r\n\r\nhttp<\/span> {\r\n    include<\/span>       mime<\/span>.types<\/span>;\r\n    default_type<\/span>  application<\/span>\/octet<\/span>-stream<\/span>;\r\n    charset<\/span> UTF<\/span>-8<\/span>;\r\n\r\n    # Enables or disables the use of underscores in client request header fields.\r\n<\/span>    # When the use of underscores is disabled, request header fields whose names contain underscores are marked as invalid and become subject to the ignore_invalid_headers directive.\r\n<\/span>    # underscores_in_headers off;\r\n<\/span>\r\n    #log_format  main  '$remote_addr - $remote_user [$time_local] \"$request\" '\r\n<\/span>    #                  '$status $body_bytes_sent \"$http_referer\" '\r\n<\/span>    #                  '\"$http_user_agent\" \"$http_x_forwarded_for\"';\r\n<\/span>\r\n    #access_log  logs\/access.log  main;\r\n<\/span>\r\n\r\n    log_format<\/span>  main<\/span>  '$remote_addr - $remote_user [$time_local] \"$request\" '<\/span>\r\n                  '$status $body_bytes_sent \"$http_referer\" '<\/span>\r\n                  '\"$http_user_agent\" \"$http_x_forwarded_for\"'<\/span>;\r\n\r\n    #access_log  \/var\/log\/nginx\/access.log  main;\r\n<\/span>    access_log<\/span>  \/dev<\/span>\/stdout<\/span>;\r\n\r\n        # Log in JSON Format\r\n<\/span>        # log_format nginxlog_json escape=json '{ \"timestamp\": \"$time_iso8601\", '\r\n<\/span>        # '\"remote_addr\": \"$remote_addr\", '\r\n<\/span>        #  '\"body_bytes_sent\": $body_bytes_sent, '\r\n<\/span>        #  '\"request_time\": $request_time, '\r\n<\/span>        #  '\"response_status\": $status, '\r\n<\/span>        #  '\"request\": \"$request\", '\r\n<\/span>        #  '\"request_method\": \"$request_method\", '\r\n<\/span>        #  '\"host\": \"$host\",'\r\n<\/span>        #  '\"upstream_addr\": \"$upstream_addr\",'\r\n<\/span>        #  '\"http_x_forwarded_for\": \"$http_x_forwarded_for\",'\r\n<\/span>        #  '\"http_referrer\": \"$http_referer\", '\r\n<\/span>        #  '\"http_user_agent\": \"$http_user_agent\", '\r\n<\/span>        #  '\"http_version\": \"$server_protocol\", '\r\n<\/span>        #  '\"nginx_access\": true }';\r\n<\/span>        # access_log \/dev\/stdout nginxlog_json;\r\n<\/span>\r\n    # See Move default writable paths to a dedicated directory (#119)\r\n<\/span>    # https:\/\/github.com\/openresty\/docker-openresty\/issues\/119\r\n<\/span>    client_body_temp_path<\/span> \/var<\/span>\/run<\/span>\/openresty<\/span>\/nginx<\/span>-client<\/span>-body<\/span>;\r\n    proxy_temp_path<\/span>       \/var<\/span>\/run<\/span>\/openresty<\/span>\/nginx<\/span>-proxy<\/span>;\r\n    fastcgi_temp_path<\/span>     \/var<\/span>\/run<\/span>\/openresty<\/span>\/nginx<\/span>-fastcgi<\/span>;\r\n    uwsgi_temp_path<\/span>       \/var<\/span>\/run<\/span>\/openresty<\/span>\/nginx<\/span>-uwsgi<\/span>;\r\n    scgi_temp_path<\/span>        \/var<\/span>\/run<\/span>\/openresty<\/span>\/nginx<\/span>-scgi<\/span>;\r\n\r\n\r\n    sendfile<\/span>        on<\/span>;\r\n    #tcp_nopush     on;\r\n<\/span>\r\n    #keepalive_timeout  0;\r\n<\/span>    #keepalive_timeout  65;\r\n<\/span>    client_max_body_size<\/span> 0<\/span>;\r\n\r\n    #gzip  on;\r\n<\/span>\r\n\r\n    include<\/span> \/usr<\/span>\/local<\/span>\/openresty<\/span>\/nginx<\/span>\/conf<\/span>\/conf<\/span>.d<\/span>\/*.conf<\/span>;\r\n\r\n    # Don't reveal OpenResty version to clients.\r\n<\/span>    # server_tokens off;\r\n<\/span>\r\n    server<\/span> {\r\n      # http\r\n<\/span>\r\n        autoindex<\/span> off<\/span>;\r\n        server_tokens<\/span> off<\/span>;\r\n\r\n        resolver<\/span> local<\/span>=on<\/span> ipv6<\/span>=off<\/span>;\r\n\r\n        listen<\/span> 80<\/span>;\r\n\r\n        location<\/span> \/oauth2<\/span>\/ {\r\n            proxy_pass<\/span>       http<\/span>:\/\/oauth2<\/span>-proxy<\/span>:4180<\/span>;\r\n            proxy_set_header<\/span> Host<\/span>                    $host<\/span>;\r\n            proxy_set_header<\/span> X<\/span>-Real<\/span>-IP<\/span>               $remote_addr<\/span>;\r\n            proxy_set_header<\/span> X<\/span>-Scheme<\/span>                $scheme<\/span>;\r\n            proxy_set_header<\/span> X<\/span>-Auth<\/span>-Request<\/span>-Redirect<\/span> $request_uri<\/span>;\r\n            # or, if you are handling multiple domains:\r\n<\/span>            # proxy_set_header X-Auth-Request-Redirect $scheme:\/\/$host$request_uri;\r\n<\/span>        }\r\n        location<\/span> = \/oauth2<\/span>\/auth<\/span> {\r\n            proxy_pass<\/span>       http<\/span>:\/\/oauth2<\/span>-proxy<\/span>:4180<\/span>;\r\n            proxy_set_header<\/span> Host<\/span>             $host<\/span>;\r\n            proxy_set_header<\/span> X<\/span>-Real<\/span>-IP<\/span>        $remote_addr<\/span>;\r\n            proxy_set_header<\/span> X<\/span>-Scheme<\/span>         $scheme<\/span>;\r\n            # nginx auth_request includes headers but not body\r\n<\/span>            proxy_set_header<\/span> Content<\/span>-Length<\/span>   \"\"<\/span>;\r\n            proxy_pass_request_body<\/span>           off<\/span>;\r\n        }\r\n\r\n        location<\/span> \/ {\r\n            auth_request<\/span> \/oauth2<\/span>\/auth<\/span>;\r\n            error_page<\/span> 401<\/span> = \/oauth2<\/span>\/sign_in<\/span>;\r\n\r\n            # pass information via X-User and X-Email headers to backend,\r\n<\/span>            # requires running with --set-xauthrequest flag\r\n<\/span>            auth_request_set<\/span> $user<\/span>   $upstream_http_x_auth_request_user<\/span>;\r\n            auth_request_set<\/span> $email<\/span>  $upstream_http_x_auth_request_email<\/span>;\r\n            proxy_set_header<\/span> X<\/span>-User<\/span>  $user<\/span>;\r\n            proxy_set_header<\/span> X<\/span>-Email<\/span> $email<\/span>;\r\n\r\n            # if you enabled --pass-access-token, this will pass the token to the backend\r\n<\/span>            auth_request_set<\/span> $token<\/span>  $upstream_http_x_auth_request_access_token<\/span>;\r\n            proxy_set_header<\/span> X<\/span>-Access<\/span>-Token<\/span> $token<\/span>;\r\n\r\n            # if you enabled --cookie-refresh, this is needed for it to work with auth_request\r\n<\/span>            auth_request_set<\/span> $auth_cookie<\/span> $upstream_http_set_cookie<\/span>;\r\n            add_header<\/span> Set<\/span>-Cookie<\/span> $auth_cookie<\/span>;\r\n\r\n            # When using the --set-authorization-header flag, some provider's cookies can exceed the 4kb\r\n<\/span>            # limit and so the OAuth2 Proxy splits these into multiple parts.\r\n<\/span>            # Nginx normally only copies the first `Set-Cookie` header from the auth_request to the response,\r\n<\/span>            # so if your cookies are larger than 4kb, you will need to extract additional cookies manually.\r\n<\/span>            auth_request_set<\/span> $auth_cookie_name_upstream_1<\/span> $upstream_cookie_auth_cookie_name_1<\/span>;\r\n\r\n            # Extract the Cookie attributes from the first Set-Cookie header and append them\r\n<\/span>            # to the second part ($upstream_cookie_* variables only contain the raw cookie content)\r\n<\/span>            if<\/span> ($auth_cookie<\/span> ~* \"(; .*)\"<\/span>) {\r\n                set<\/span> $auth_cookie_name_0<\/span> $auth_cookie<\/span>;\r\n                set<\/span> $auth_cookie_name_1<\/span> \"auth_cookie_name_1=$auth_cookie_name_upstream_1$1\"<\/span>;\r\n            }\r\n\r\n            # Send both Set-Cookie headers now if there was a second part\r\n<\/span>            if<\/span> ($auth_cookie_name_upstream_1<\/span>) {\r\n                add_header<\/span> Set<\/span>-Cookie<\/span> $auth_cookie_name_0<\/span>;\r\n                add_header<\/span> Set<\/span>-Cookie<\/span> $auth_cookie_name_1<\/span>;\r\n            }\r\n\r\n            # \u30b3\u30f3\u30c6\u30ca\u30b5\u30fc\u30d3\u30b9\u540d\u3067\u6307\u5b9a\r\n<\/span>            proxy_pass<\/span> http<\/span>:\/\/webapp<\/span>\/;\r\n            # or \"root \/path\/to\/site;\" or \"fastcgi_pass ...\" etc\r\n<\/span>        }\r\n\r\n        error_page<\/span>   500<\/span> 502<\/span> 503<\/span> 504<\/span>  \/50<\/span>x<\/span>.html<\/span>;\r\n        location<\/span> = \/50<\/span>x<\/span>.html<\/span> {\r\n            root<\/span>   \/usr<\/span>\/local<\/span>\/openresty<\/span>\/nginx<\/span>\/nginx<\/span>\/html<\/span>;\r\n        }\r\n\r\n        # Load configuration files for the default server block.\r\n<\/span>        include<\/span> \/usr<\/span>\/local<\/span>\/openresty<\/span>\/nginx<\/span>\/conf<\/span>\/default<\/span>.d<\/span>\/*.conf<\/span>;\r\n\r\n    }\r\n}\r\n<\/code><\/pre>\n
                              \u786e\u8ba4\u8bbf\u95ee<\/h2>\n
                              \u70b9\u51fb\u4e0b\u65b9\u94fe\u63a5\u3002<\/p>\n
                               <\/p>\n
                              \u53ef\u4ee5\u663e\u793aOAuth2 Proxy\u7684\u8eab\u4efd\u9a8c\u8bc1\u754c\u9762\u3002\u53ef\u4ee5\u901a\u8fc7\u53c2\u6570OAUTH2_PROXY_SKIP_PROVIDER_BUTTON\u6765\u8bbe\u7f6e\u662f\u5426\u8df3\u8fc7\u6b64\u8eab\u4efd\u9a8c\u8bc1\u754c\u9762\u3002<\/p>\n
                              \u9009\u62e9\u4f7f\u7528 OpenID Connect \u8fdb\u884c\u767b\u5f55\u3002<\/p>\n
                              \"oauth2-proxy_001.jpg\"<\/div>\n
                              \u5728\u8f6c\u5230Keycloak\u7684\u8ba4\u8bc1\u754c\u9762\u540e\uff0c\u9700\u8981\u8f93\u5165\u5728Ldap\u4e2d\u6ce8\u518c\u7684\u7528\u6237\u540d\u548c\u5bc6\u7801\uff08\u672c\u6b21\u793a\u4f8b\u4e2d\u4e3atest001\u7528\u6237\uff09\u3002<\/p>\n
                              \"oauth2-proxy_002.jpg\"<\/div>\n
                              \u5982\u679c\u6253\u5f00OpenResty\uff08Web\u5e94\u7528\u7a0b\u5e8f\uff09\u7684\u6b22\u8fce\u9875\u9762\uff0c\u5c31\u8868\u793a\u4e00\u5207\u6b63\u5e38\u3002<\/p>\n
                              \"welcome_to_openresty.jpg\"<\/div>\n
                              \u603b\u7ed3<\/h1>\n
                              \u6211\u5c1d\u8bd5\u4f7f\u7528Keycloak+OAuth2 Proxy+OpenLDAP\u8fdb\u884cLdap\u8ba4\u8bc1\u3002<\/p>\n
                              \u56e0\u4e3a\u73b0\u5728\u5df2\u7ecf\u5efa\u7acb\u4e86\u4e00\u4e2a\u53ef\u4ee5\u5728\u672c\u5730\u8fdb\u884c\u9a8c\u8bc1\u7684\u73af\u5883\uff0c\u6240\u4ee5\u6211\u5728\u8fd9\u91cc\u5c31\u7ed3\u675f\u4e86\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
                              \u8fd9\u6b21\u5b9e\u65bd\u7684\u7ec4\u5408 \u73af\u5883 WSL Ubuntu 20.04   Docker version 20.10 […]<\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-32899","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"\n\u5c1d\u8bd5\u4f7f\u7528Keycloak+OAuth2\u4ee3\u7406+OpenLDAP\u8fdb\u884cLdap\u8ba4\u8bc1 - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u5c1d\u8bd5\u4f7f\u7528keycloakoauth2\u4ee3\u7406openldap\u8fdb\u884cldap\u8ba4\u8bc1\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u5c1d\u8bd5\u4f7f\u7528Keycloak+OAuth2\u4ee3\u7406+OpenLDAP\u8fdb\u884cLdap\u8ba4\u8bc1\" \/>\n<meta property=\"og:description\" content=\"\u8fd9\u6b21\u5b9e\u65bd\u7684\u7ec4\u5408 \u73af\u5883 WSL Ubuntu 20.04   Docker version 20.10 […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u5c1d\u8bd5\u4f7f\u7528keycloakoauth2\u4ee3\u7406openldap\u8fdb\u884cldap\u8ba4\u8bc1\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-01T04:42:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-30T14:06:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d14ba37434c4406bfc1f8\/1-0.jpeg\" \/>\n<meta name=\"author\" content=\"\u6587, \u7fd4\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u6587, \u7fd4\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/\",\"name\":\"\u5c1d\u8bd5\u4f7f\u7528Keycloak+OAuth2\u4ee3\u7406+OpenLDAP\u8fdb\u884cLdap\u8ba4\u8bc1 - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2023-09-01T04:42:52+00:00\",\"dateModified\":\"2024-04-30T14:06:18+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/64d5cc7727fffbff2f9a2a8da1de3e5c\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u5c1d\u8bd5\u4f7f\u7528Keycloak+OAuth2\u4ee3\u7406+OpenLDAP\u8fdb\u884cLdap\u8ba4\u8bc1\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/64d5cc7727fffbff2f9a2a8da1de3e5c\",\"name\":\"\u6587, \u7fd4\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/920c3d673e0bccacc98e5e6b7149bb3c22edd8d39cb753e5d7d7e471498118a1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/920c3d673e0bccacc98e5e6b7149bb3c22edd8d39cb753e5d7d7e471498118a1?s=96&d=mm&r=g\",\"caption\":\"\u6587, \u7fd4\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/wenxiang\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u5c1d\u8bd5\u4f7f\u7528Keycloak+OAuth2\u4ee3\u7406+OpenLDAP\u8fdb\u884cLdap\u8ba4\u8bc1 - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u5c1d\u8bd5\u4f7f\u7528keycloakoauth2\u4ee3\u7406openldap\u8fdb\u884cldap\u8ba4\u8bc1\/","og_locale":"zh_CN","og_type":"article","og_title":"\u5c1d\u8bd5\u4f7f\u7528Keycloak+OAuth2\u4ee3\u7406+OpenLDAP\u8fdb\u884cLdap\u8ba4\u8bc1","og_description":"\u8fd9\u6b21\u5b9e\u65bd\u7684\u7ec4\u5408 \u73af\u5883 WSL Ubuntu 20.04   Docker version 20.10 […]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u5c1d\u8bd5\u4f7f\u7528keycloakoauth2\u4ee3\u7406openldap\u8fdb\u884cldap\u8ba4\u8bc1\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2023-09-01T04:42:52+00:00","article_modified_time":"2024-04-30T14:06:18+00:00","og_image":[{"url":"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d14ba37434c4406bfc1f8\/1-0.jpeg"}],"author":"\u6587, \u7fd4","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u6587, \u7fd4","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"8 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/","name":"\u5c1d\u8bd5\u4f7f\u7528Keycloak+OAuth2\u4ee3\u7406+OpenLDAP\u8fdb\u884cLdap\u8ba4\u8bc1 - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2023-09-01T04:42:52+00:00","dateModified":"2024-04-30T14:06:18+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/64d5cc7727fffbff2f9a2a8da1de3e5c"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u5c1d\u8bd5\u4f7f\u7528Keycloak+OAuth2\u4ee3\u7406+OpenLDAP\u8fdb\u884cLdap\u8ba4\u8bc1"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/64d5cc7727fffbff2f9a2a8da1de3e5c","name":"\u6587, \u7fd4","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/920c3d673e0bccacc98e5e6b7149bb3c22edd8d39cb753e5d7d7e471498118a1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/920c3d673e0bccacc98e5e6b7149bb3c22edd8d39cb753e5d7d7e471498118a1?s=96&d=mm&r=g","caption":"\u6587, \u7fd4"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/wenxiang\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e5%b0%9d%e8%af%95%e4%bd%bf%e7%94%a8keycloakoauth2%e4%bb%a3%e7%90%86openldap%e8%bf%9b%e8%a1%8cldap%e8%ae%a4%e8%af%81\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/32899","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=32899"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/32899\/revisions"}],"predecessor-version":[{"id":94576,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/32899\/revisions\/94576"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=32899"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=32899"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=32899"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}