Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There's a related question with an answer at apache auth: combination of LDAP and htpasswd but I'd like to expand on that.

I want to allow users if they are in the htpasswd file or if they are in LDAP and members of a valid group.

So Require valid-user from the other question is not strict enough as it would allow anyone from LDAP.

share|improve this question

With a valid AuthnzLDAP setup, it's possible to require ldap-group, like so:

  Require ldap-group cn=Administrators, o=Airius

See for reference.

It's worth noting that you can also require ldap-dn, ldap-attribute, or even ldap-filter. The latter could also be used to require an ldap-group, like this:

  Require ldap-filter &(memberof=cn=Administrators,o=Airius)

..which is most useful to generate complex attribute-based requirements:

  Require ldap-filter &(eduPersonPrimaryAffiliation=*Staff)(objectClass=eduPrincipal)

Thanks, commenter @james-yale for the most relevant answer..

share|improve this answer
Or how about using Require ldap-group ref: – James Yale Feb 3 '11 at 17:30

require group X, where X is the LDAP group and then additionally use a AuthGroupFile that defines group X with all the local users in it.

(Note: not tested.)

share|improve this answer

It's also possible using different groups but the Users authenticated via AuthUserFile need to have a group membership too (via the AuthGroupFile). Then you can use something like:

    Require Group tehLDAPGroup
    Require Group tehAuthUserGroup
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.