Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can't solve this one, here's my .htaccess:

AuthPAM_Enabled Off

AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthName "MESSAGE"
Require ldap-group cn=CHANGED, cn=CHANGED

AuthLDAPURL "ldap://localhost/dc=CHANGED,dc=CHANGED?uid?sub?(objectClass=posixAccount)"
AuthLDAPBindDN CHANGED
AuthLDAPBindPassword CHANGED
AuthLDAPGroupAttribute memberUid

AuthLDAPURL is correct, BindDN and BindPassword are correct also (verified with ldapvi -D ..).

Apache version: Apache/2.2.9 (Debian)

The error message seems cryptic to me, I have AuthzLDAPAuthoritative on so where's the problem.

EDIT:

LDAP modules are loaded, the problem is not with them being missing.

# ls /etc/apache2/mods-enabled/*ldap*
/etc/apache2/mods-enabled/authnz_ldap.load  /etc/apache2/mods-enabled/ldap.load

EDIT2:

Solved it by changing funky

Require ldap-group cn=CHANGED, cn=CHANGED

line with

Require valid-user

Since AuthzLDAPAuthoritative is on, no other auth methods will be used and valid-user requirement will auth via LDAP. (right? :/)

share|improve this question
    
Do you have two "cn"s in your Require ldap-group, or is just your redacting? –  crb Jun 14 '09 at 15:00
    
Funny question, but you did do AllowOverride all in your <Directory "/"> definition, right? –  Matt Simmons Jun 14 '09 at 15:19
    
Was my comment enough that I should post it as an answer and you accept it? :) –  crb Jun 14 '09 at 23:04
    
Sure, go ahead :) –  Karolis T. Jun 15 '09 at 6:23
    
What LDAP source are you using? I have found that the Windows AD LDAP implementation does not allow for a 'sub' level search on a DC, but does work on an OU. –  Jeffrey Hulten Jun 17 '09 at 19:02

3 Answers 3

up vote 2 down vote accepted

Your 'Require' line reads

Require ldap-group cn=CHANGED, cn=CHANGED

That doesn't look write - I don't believe you can have have two cn's in a DN like that.

share|improve this answer
    
One note on Require ldap-group If you are connecting to the global catalog port, keep in mind that group memberships are NOT replicated to global catalogs UNLESS the group is a universal group. I.e. if you make a Global group AND try to authenticate using require ldap-group AND are connecting to port 3268 IT WILL NOT WORK. Convert it to a universal group and viola. –  user72853 Mar 2 '11 at 21:00

For me and apache 2.2.14, this works like a champ for access control on a per-group basis

AuthType Basic
AuthName "Secret Area for IT Only"
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthLDAPGroupAttributeIsDN off
AuthLDAPGroupAttribute memberUid
AuthLDAPURL "ldap://ldap1.example.int ldap2.company.int/cn=int"
Require ldap-group cn=it,ou=Groups,o=int

"int" is our internal domain for non-public servers.

share|improve this answer

Have you enabled the ldap and authnz_ldap modules?

You can do so with:

a2enmod ldap authnz_ldap; /etc/init.d/apache2 restart
share|improve this answer
    
Yes, I have them loaded. I've updated the question accordingly. –  Karolis T. Jun 14 '09 at 13:50
    
"No authoritative handler" implies that apache cannot use them for some reason. –  Brent Jun 14 '09 at 14:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.