Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have Apache (on Windows Server) set up to authenticate one directory through Active Directory. Config settings are as follows:

<LocationMatch "/trac/[^/]+/login">

 Order deny,allow
 Allow from all
 AuthBasicProvider ldap
 AuthzLDAPAuthoritative Off
 AuthLDAPURL ldap://<ip-redacted>:3268/cn=Users,OU=MyBusiness,DC=<dc-redacted>,DC=local?sAMAccountName?sub?(objectClass=*)
 AuthLDAPBindDN       trac@<dc-redacted>.local
 AuthLDAPBindPassword "<password-redacted>"
 AuthType Basic
 AuthName "Protected"
 require valid-user


Watching, Wireshark, I see the following get sent through when I visit the page:

To the AD server:

bindRequest(1) "trac@<dc-redacted>.local" simple 

And from the AD server:

bindResponse(1) success 

I'm assuming this means that the auth was successful... but Apache doesn't think so. It returns a 500 server to me. Apache logs show the following:

[Thu Nov 18 16:21:12 2010] [debug] mod_authnz_ldap.c(379): [client 192.168.x.x] [7352] auth_ldap authenticate: using URL ldap://<ip-redacted>:3268/cn=Users,OU=MyBusiness,DC=<dc-redacted>,DC=local?sAMAccountName?sub?(objectClass=*), referer: http://192.168.x.x/trac/Trac/login
[Thu Nov 18 16:21:12 2010] [info] [client 192.168.x.x] [7352] auth_ldap authenticate: user  authentication failed; URI /trac/Trac/login [ldap_search_ext_s() for user failed][Filter Error], referer: http://192.168.x.x/trac/Trac/login

Now, that log file shows a failed auth for a blank user. I am confused.

Any idea what I am doing wrong... and how I can get the Apache authentication working? :)


share|improve this question
up vote 0 down vote accepted

The bind was successful, but that only means that "trac@<dc-redacted>.local" is acknowledged to have the password "<password-redacted>". Next, the LDAP library will search for the user name and password collected by the basic dialog and do a compare of the password field. That's what's likely failing for you, due to a problem with one or more of (a) the AuthLDAPURL (b) the user name or (c) the password. This has worked for me, but so far, only the unencrypted flavor (which you're using); as soon as I try to use SSL or TLS something goes wrong...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.