BASH脚本 - OpenLDAP同步AD用户（减少）

用途：当AD中有删除用户时，可以使用此脚本进行同步

#!/bin/bash

# 预定义参数
AD_DOMAIN=""
AD_ADMIN_DN="CN=,OU=XXX,OU=XXX,DC=XXX,DC=XXX,DC=XXX"
AD_ADMIN_PWD=""
AD_BASE_DN="DC=XXX,DC=XXX,DC=XXX"
LDAP_DOMAIN=""
LDAP_ADMIN_DN="cn=Manager,dc=XXX,dc=XXX,dc=XXX"
LDAP_ADMIN_PWD=""
LDAP_BASE_DN=${AD_BASE_DN}
ADUSERNAME="^sAMAccountName: .+$"
LDAPUSERNAME="^uid: .+$"
LOGFILE="/root/OpenLdapShell/OpenLdapUserChangeLog.log"

# 把所有的OU都查出来，为一会导入用户做准备，因为现在AD的人数太多了，所以只能按OU分别导入/更新
/usr/bin/ldapsearch -x -H ldaps://${AD_DOMAIN}:636 "(&(objectClass=top)(objectClass=organizationalUnit))" dn -D "${AD_ADMIN_DN}" -w "${AD_ADMIN_PWD}" -b "${AD_BASE_DN}" -L |php /root/OpenLdapShell/utf8ldif.php > /root/OpenLdapShell/Tmp_ldapgroup_utf8.ldif

# 整理一下LDAP OU的文件，把version，注释之类的都去掉，只留dn:
/usr/bin/sed -i "/^#/d" /root/OpenLdapShell/Tmp_ldapgroup_utf8.ldif
/usr/bin/sed -i "/^version/d" /root/OpenLdapShell/Tmp_ldapgroup_utf8.ldif
/usr/bin/sed -i "/^[[:space:]]*$/d" /root/OpenLdapShell/Tmp_ldapgroup_utf8.ldif
/usr/bin/sed -i "s/^dn: //g" /root/OpenLdapShell/Tmp_ldapgroup_utf8.ldif

# 开始循环读取OU，一行就是一个OU
while read OU_LINE
do
    # 初始化一个文件用来存储待更新的用户
    echo "" > /root/OpenLdapShell/Tmp_UpdateUser.ldif

    # 读取AD上这个OU下的所有用户，存储到Tmp_ADUser.ldif文件里
    /usr/bin/ldapsearch -x -H ldaps://${AD_DOMAIN}:636 "(&(objectClass=organizationalPerson)(!(objectClass=computer)))" dn objectClass cn description sAMAccountName uSNCreated -D "${AD_ADMIN_DN}" -w "${AD_ADMIN_PWD}" -b "${OU_LINE}" -L > /root/OpenLdapShell/Tmp_ADUser.ldif

    # 读取OPENLDAP上这个OU下的所有用户，存储到Tmp_OpenLdapUser.ldif文件里
    /usr/bin/ldapsearch -x -H ldaps://${LDAP_DOMAIN} "(&(objectClass=organizationalPerson))" uid -D "${LDAP_ADMIN_DN}" -w "${LDAP_ADMIN_PWD}" -b "${OU_LINE}" -L > /root/OpenLdapShell/Tmp_OpenLdapUser.ldif

    # 比较Tmp_OpenLdapUser.ldif和Tmp_ADUser.ldif里面的用户，如果AD里面没有，就删掉
    while read LINE
    do
        if [[ "${LINE}" =~ ${LDAPUSERNAME} ]];then
            TMP1=${LINE/uid: /sAMAccountName: }
            grep -w "${TMP1}" /root/OpenLdapShell/Tmp_ADUser.ldif > /dev/null 2>&1
            if [ $? -ne 0 ];then
                TMP2=${TMP1##*:}
                UID_VALUE=${TMP2/ /}
                echo "[$(date '+%Y-%m-%d %H:%M:%S')] OpenLdap Server Del User, UID: ${UID_VALUE}" >> ${LOGFILE}
                /usr/bin/ldapsearch -x -H ldaps://${LDAP_DOMAIN} "(&(objectClass=inetOrgPerson)(uid=${UID_VALUE}))" dn uid -D "${LDAP_ADMIN_DN}" -w "${LDAP_ADMIN_PWD}" -b "${OU_LINE}" -L >> /root/OpenLdapShell/Tmp_UpdateUser.ldif
            fi
        fi
    done</root/OpenLdapShell/Tmp_OpenLdapUser.ldif

    # 给待删除的ldif文件增加changetype: delete字段
    /usr/bin/sed -i "/^uid:/i\changetype: delete" /root/OpenLdapShell/Tmp_UpdateUser.ldif
    /usr/bin/sed -i "/^uid:/d" /root/OpenLdapShell/Tmp_UpdateUser.ldif

    # 删除Tmp_UpdateUser.ldif中的用户
    /usr/bin/ldapmodify -c -x -w "${LDAP_ADMIN_PWD}" -D "${LDAP_ADMIN_DN}" -f /root/OpenLdapShell/Tmp_UpdateUser.ldif > /dev/null 2>&1
done</root/OpenLdapShell/Tmp_ldapgroup_utf8.ldif

# 删除临时文件
/usr/bin/rm -rf /root/OpenLdapShell/Tmp*