Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the difference between mod_authn_ldap and mod_authz_ldap?

share|improve this question
In Apache httpd 2.2 there is only mod_authnz_ldap ( What do you want to know exactly? – joschi Jul 5 '10 at 12:19

There is no such thing called mod_authn_ldap. There is only mod_authnz_ldap.

In versions of Apache before Apache2.2, the modules for "Access Control" were all called 'mod_authsomething'.

Apache 2.2 split the Auth* modules into modules which would keep authentication and authorization separate. See the Apache documentation, Authentication, Authorization and Access Control for a summary.

  • A mod_authn_* module will provide Authentication services (Hence the name 'authn')
  • A mod_authz_* module will provide Authorization services (Hence the name 'authz')
  • A mod_authnz_* module will provide both Authentication and Authorization.

mod_authnz_ldap is one of the few modules which provides both Authorization and Authentication. This can be confusing and can be a hassle when trying to integrate with other services.

It is very important to learn and understand the difference between Authentication vs. Authorization, especially with respect to security of LDAP, Apache webserver, PAM, etc.

  • Authentication determines that you are who you claim to be.
  • Authorization determines if you have the right to do something.
share|improve this answer

From memory these were the modules that handled the LDAP password checking and group membership checking functions, that were combined into mod_authnz_ldap. The authn module performed authentication (is the user valid?) and authz checked authorisation (is the user permitted to access this?). My memory could be fuzzy here though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.