cd /data/
git clone https://github.com/nginxinc/nginx-ldap-auth

wget http://nginx.org/download/nginx-1.6.3.tar.gz
tar zxvf nginx-1.6.3.tar.gz
cd nginx-1.6.3
./configure --prefix=/data/nginx --with-http_realip_module --with-http_ssl_module --with-http_sub_module --with-http_auth_request_module --with-http_stub_status_module
make
make install

user                  nobody nobody;
worker_processes auto;
#worker_cpu_affinity auto;
worker_rlimit_nofile 65535;

error_log             logs/error.log;
pid                   logs/nginx.pid;

events {
    use epoll;
    #reuse_port on;   #used in tengine and linux kernel >= 3.9
    accept_mutex off;  #used in nginx
    worker_connections  65535;
}

http {
    include                     mime.types;
    default_type                application/octet-stream;
    server_tokens               off;

    log_format      main        '$remote_addr - $remote_user [$time_local] "$request" '
                                '$status $request_time $body_bytes_sent "$http_referer" '
                                '"$http_user_agent" "$http_x_forwarded_for"|body: $request_body';

    sendfile                    on;
    tcp_nopush                  on;
    tcp_nodelay                 on;
    keepalive_timeout           60;

    gzip                        on;
    gzip_vary                   on;
    gzip_comp_level             5;
    gzip_buffers                16 4k;
    gzip_min_length             1000;
    gzip_proxied                any;
    gzip_disable                "msie6";
    gzip_types                  text/plain text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript application/json;

    open_file_cache max=1000    inactive=20s;
    open_file_cache_valid       30s;
    open_file_cache_min_uses    2;
    open_file_cache_errors      on;

    client_max_body_size        50m;
    
    #缓存可以减少ldap验证频率，不然每个页面都需要ldap验证一次
    #你不在乎的话，不要缓存也是没有任何问题的 
    proxy_cache_path cache/ keys_zone=auth_cache:10m;

#kakfa-manager程序，跑在同一台机器的8000端口
upstream kafka-manager {
    server 127.0.0.1:8000;
}

server {
    listen 8081;
    server_name localhost;

    access_log logs/kafka-manager.log main;

    #后端程序，也就是kafka-manager
    location / {
        auth_request /auth-proxy;

        #nginx接收到nginx-ldap-auth-daemon.py返回的401和403都会重新跳转到登录页面
        error_page 401 403 =200 /login;

        proxy_pass http://kafka-manager/;
    }

    #登录页面，由backend-sample-app.py提供，跑在同一台机器的8082端口(默认不是8082端口)
    location /login {
        proxy_pass http://127.0.0.1:8082/login;
        proxy_set_header X-Target $request_uri;
    }

    location = /auth-proxy {
        internal;
        proxy_pass http://127.0.0.1:8888;     #nginx-ldap-auth-daemon.py运行端口
        #缓存设置
        proxy_cache auth_cache;
        proxy_cache_key "$http_authorization$cookie_nginxauth";
        proxy_cache_valid 200 403 10m;
        
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";

        #最最重要的ldap配置，请务必按照贵公司的ldap配置如下四项，我在这一步卡了好久，就是ldap配置不对
        #这些配置都会通过http头部传递给nginx-ldap-auth-daemon.py脚本
        proxy_set_header X-Ldap-URL      "ldap://ip:port";
        proxy_set_header X-Ldap-BaseDN   "DC=example,DC=com";
        proxy_set_header X-Ldap-BindDN   "cn=Admin,ou=People,dc=example,dc=com";
        proxy_set_header X-Ldap-BindPass "password";

        proxy_set_header X-CookieName "nginxauth";
        proxy_set_header Cookie nginxauth=$cookie_nginxauth;
    }
}
}

cd /data/nginx-ldap-auth/
./nginx-ldap-auth-daemon-ctl-rh.sh start
nohup python backend-sample-app.py &
/data/nginx/sbin/nginx