Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There's a related question with an answer at apache auth: combination of LDAP and htpasswd but I'd like to expand on that.

I want to allow users if they are in the htpasswd file or if they are in LDAP and members of a valid group.

So Require valid-user from the other question is not strict enough as it would allow anyone from LDAP.

share|improve this question

3 Answers 3

With a valid AuthnzLDAP setup, it's possible to require ldap-group, like so:

  Require ldap-group cn=Administrators, o=Airius

See http://httpd.apache.org/docs/current/mod/mod_authnz_ldap.html#reqgroup for reference.

It's worth noting that you can also require ldap-dn, ldap-attribute, or even ldap-filter. The latter could also be used to require an ldap-group, like this:

  Require ldap-filter &(memberof=cn=Administrators,o=Airius)

..which is most useful to generate complex attribute-based requirements:

  Require ldap-filter &(eduPersonPrimaryAffiliation=*Staff)(objectClass=eduPrincipal)

Thanks, commenter @james-yale for the most relevant answer..

share|improve this answer
2  
Or how about using Require ldap-group ref: httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html#reqgroup –  James Yale Feb 3 '11 at 17:30

require group X, where X is the LDAP group and then additionally use a AuthGroupFile that defines group X with all the local users in it.

(Note: not tested.)

share|improve this answer

It's also possible using different groups but the Users authenticated via AuthUserFile need to have a group membership too (via the AuthGroupFile). Then you can use something like:

<RequireAny>
    Require Group tehLDAPGroup
    Require Group tehAuthUserGroup
</RequireAny>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.