Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As part of the security policy we are upgrading out systems to comply with, I need to set our Apache LDAP Auth to have a idle-timeout of 15 minutes.

I.e. If the user stops using the system for over 15 minutes, the next time they go to use it they will need to re-authenticate.

Is this even possible? If so, how can I achieve it?

My auth config in my .htaccess file looks like this:

AuthName "AD Authentication"
AuthType Basic
AuthBasicProvider ldap
AuthLDAPUrl "URL"
AuthLDAPBindDN "DN"
AuthLDAPBindPassword "PASSWORD"
AuthzLDAPAuthoritative Off
require valid-user

Any ideas?

share|improve this question
    
To clarify, do you mean that the connection to the LDAP server needs to time out, or the user's session needs to time out? –  Shane Madden May 4 '11 at 1:54
    
The users session - so if they idle for longer than 15 minutes, they need to re-authenticate. –  Valorin May 4 '11 at 2:30
add comment

3 Answers

Unfortunately, basic authentication is not session-aware in any way. From the web server's perspective, they're actually forced to re-authenticate with every single request.

However, all browsers cache the credentials used for a basic auth connection, so that you don't need to re-enter credentials for every resource loaded from the server. The issue that this creates in your situation is that there's no way to 'expire' that data from the client browser; it keeps it as long as it wants.

To implement session timeouts, you may be stuck moving away from basic auth and toward a session-aware application.

share|improve this answer
    
Mmm... that will get annoying. Is there any way to tell the browser to forget the credentials and to re-authenticate? –  Valorin May 4 '11 at 3:03
    
I don't believe so. –  Shane Madden May 4 '11 at 3:11
add comment

A way to manually tell the browser to forget current credentials is to open the current address with another/invalid user.

http://testuser@www.mypage.com
share|improve this answer
    
This is not portable and might not work on all browsers. In fact there's no portable way to logout when basic or digest authentication is used. –  FINESEC Nov 6 '12 at 17:47
add comment

Try instructions from this site: http://search.cpan.org/~ksolomko/Apache2-AuthCookieLDAP-1.14/lib/Apache2/AuthCookieLDAP.pm

share|improve this answer
3  
Welcome to Server Fault. Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Michael Hampton Jul 17 '13 at 7:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.