Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Apache, what would be the best way to only give access to users who pass the two following tests:

  1. User does not appear in blacklist (alternatively, appears in whitelist)
  2. User has valid LDAP user account

I already have the second test in place but I now need to bar some of the valid LDAP users. Note that I cannot create an AD group to represent my black/white list.

share|improve this question
Duplicate of… – Rodrigue Feb 2 '11 at 12:16

appears in whitelist is easy -- just list individual users with require ldap-user (or require user in 2.0) instead of "require valid-user".

A blacklist is not possible without writing a short module or doing something hokey such as mod_rewrite in context + a rewritemap of the blacklist. You can then just look at the logged in username.

share|improve this answer
up vote 0 down vote accepted

I have managed to do that using

  • mod_auth_ldap to authenticate valid users
  • mod_authz_host to blacklist IP ranges

The config then looks something like:

    <Location /blacklisted >
        AuthType Basic
        AuthName "PAM"

        AuthBasicProvider ldap
        Require valid-user
        AuthLDAPURL ldap://
        AuthzLDAPAuthoritative off
        AuthLDAPBindPassword verySecurePasswd

        Order allow,deny
        Deny from 192.168.1
        Allow from all

However, I still don't know whether that would be feasible if I wanted to blacklist LDAP usernames instead of IP addresses. (Covener seems to suggest some complex config could do it but I haven't tried it).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.