Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is the difference between mod_authn_ldap and mod_authz_ldap?

share|improve this question
    
In Apache httpd 2.2 there is only mod_authnz_ldap (httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html). What do you want to know exactly? –  joschi Jul 5 '10 at 12:19
add comment

2 Answers

There is no such thing called mod_authn_ldap. There is only mod_authnz_ldap.

In versions of Apache before Apache2.2, the modules for "Access Control" were all called 'mod_authsomething'.

Apache 2.2 split the Auth* modules into modules which would keep authentication and authorization separate. See the Apache documentation, Authentication, Authorization and Access Control for a summary.

  • A mod_authn_* module will provide Authentication services (Hence the name 'authn')
  • A mod_authz_* module will provide Authorization services (Hence the name 'authz')
  • A mod_authnz_* module will provide both Authentication and Authorization.

mod_authnz_ldap is one of the few modules which provides both Authorization and Authentication. This can be confusing and can be a hassle when trying to integrate with other services.

It is very important to learn and understand the difference between Authentication vs. Authorization, especially with respect to security of LDAP, Apache webserver, PAM, etc.

  • Authentication determines that you are who you claim to be.
  • Authorization determines if you have the right to do something.
share|improve this answer
add comment

From memory these were the modules that handled the LDAP password checking and group membership checking functions, that were combined into mod_authnz_ldap. The authn module performed authentication (is the user valid?) and authz checked authorisation (is the user permitted to access this?). My memory could be fuzzy here though.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.