Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hi I want to combine LDAP and DBD auth in apache 2.2

I want to be able to express in Apache config language - if the user is a LDAP user then he is authorized only if he is part of a LDAP Group. However if he is a normal user then allow him as long as he is valid.

Here is what I have right now

AuthType basic AuthBasicProvider ldap dbd
AuthDBUserPWQuery "blah blah"

AuthLDAPURL "ldap://,DC=test,DC=com/CN=users,DC=test,DC=com?sAMAccountName?sub?(objectClass=*)
AuthLDAPBindDN "testuser"
AuthLDAPBindPasswd "testpass"

require valid-user
require ldap-group "CN=something,OU=whatever,DC=test,DC=com"
satisfy all

Now if I login as a AD user who is not part of the ldap group it will still allow me to login. I am guessing this is because require valid-user kicks in and it seems to be happy with that. If I put AuthzLDAPAuthoritative on then it wont allow me to login as the dbd user since it insists on checking for the ldap group. Howver ldap now works well and allows only the group users.

share|improve this question

Will the users that you want to auth with DBD change often? If not, you could do something similar to the following:

require user tom dick harry
require ldap-group "CN=something,OU=whatever,DC=test,DC=com"
satisfy any
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.