1

I am trying to allow members of a certain LDAP-group into a site I'm hosting via Apache. I've read the documentaion on this, but as I have lacking LDAP skills, I could not determine how to accomplish this.

I have the following LDAP structure for the group:

dn: cn=icinga,ou=Groups,dc=mydomain,dc=no
objectClass: groupOfUniqeNames
objectClass: top
uniqeMember: uid=someuser,ou=People,dc=mydomain,dc=no
uniqeMember: ..... <more of these>

My top level looks like this:

dn: dc=mydomain,dc=no
objectClass: dcObject
objectClass: organization
objectClass: top
dc: mydomain
o: mydomain

So, what I've tried is this Apacehe-configruation:

AuthName "Icinga Access"
AuthType Basic

AuthBasicProvider ldap
AuthLDAPURL "ldap://myldapserver/ou=Groups,dc=mydomain,dc=no?uid"
AuthLDAPBindDN "MYBINDDN"
AuthLDAPBindPassword "XXXXXX"
AuthzLDAPAuthoritative off

require ldap-group cn=icinga

And, it doesn't work, because, obviously I'm doing it wrong.. However, I did manage to auth with LDAP when using ou=People in the AuthLDAPURL directive, and require ldap-user user otheruser foo to accomplish this before, but that doesn't scale too well...

Improve this question
3
  • Oh! I fixed it! Changed the AuthLDAPURL back to ou=People, set the AuthzLDAPAuthoritative to on, and entered require ldap-group cn=icinga,ou=Groups,dc=mydomain,dc=no And voilla! In addition I figured out that Apache is caching the LDAP entries, so it will not detect changes in the uniqueMember. So, i turned the caching off with LDAPCacheEntries 0
    – LarsErikP
    Mar 1, 2013 at 10:35
  • 1
    Please provide your own answer to this question and accept it when able to do so.
    – user9517
    Apr 4, 2013 at 8:04
  • Welcome to Server Fault. This is not a forum. Answers to questions go in the Answer section below, not as comments, and not as edits to the question.
    – Michael Hampton
    Apr 4, 2013 at 15:41

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .