Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In Apache, what would be the best way to only give access to users who pass the two following tests:

  1. User does not appear in blacklist (alternatively, appears in whitelist)
  2. User has valid LDAP user account

I already have the second test in place but I now need to bar some of the valid LDAP users. Note that I cannot create an AD group to represent my black/white list.

share|improve this question
    
Duplicate of stackoverflow.com/questions/4625372/… –  Rodrigue Feb 2 '11 at 12:16
add comment

2 Answers

appears in whitelist is easy -- just list individual users with require ldap-user (or require user in 2.0) instead of "require valid-user".

A blacklist is not possible without writing a short module or doing something hokey such as mod_rewrite in context + a rewritemap of the blacklist. You can then just look at the logged in username.

share|improve this answer
add comment
up vote 0 down vote accepted

I have managed to do that using

  • mod_auth_ldap to authenticate valid users
  • mod_authz_host to blacklist IP ranges

The config then looks something like:

    <Location /blacklisted >
        AuthType Basic
        AuthName "PAM"

        AuthBasicProvider ldap
        Require valid-user
        AuthLDAPURL ldap://ldap.example.com/?sAMAccountName?sub
        AuthzLDAPAuthoritative off
        AuthLDAPBindDN bindUser@example.com
        AuthLDAPBindPassword verySecurePasswd

        Order allow,deny
        Deny from 192.168.1
        Allow from all
    </Location>

However, I still don't know whether that would be feasible if I wanted to blacklist LDAP usernames instead of IP addresses. (Covener seems to suggest some complex config could do it but I haven't tried it).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.