Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've working LDAP authentication with the following setup

 AuthName            "whatever"
 AuthType            Basic
 AuthBasicProvider   ldap
 AuthLDAPUrl         "ldap://server/OU=SBSUsers,OU=Users,OU=MyBusiness,DC=company,DC=local?sAMAccountName?sub?(objectClass=*)"
 Require ldap-group  CN=MySpecificGroup,OU=Security Groups,OU=MyBusiness,DC=company,DC=local

This works, however I've to put all users I want to authenticate into MySpecificGroup. But on LDAP server I've configured that MySpecificGroup also contains the group MyOtherGroup with another list of users.

But those users in MyOtherGroup are not authenticated, I've to manually add them all to MySpecificGroup and basically can't use the nested grouping. I'm using Windows SBS 2003.

Is there a way to configure Apache LDAP to do this? Or is there a problem with possible infinite recursion and thus not allowed?

share|improve this question
add comment

3 Answers

up vote 9 down vote accepted
+150

You need to set AuthLDAPSubGroupDepth to make this work. The integer you provide here specifies the maximum sub-group nesting depth that will be evaluated before the user search is discontinued.

Add this to your config:

AuthLDAPSubGroupDepth 1

More Info: here and here.

share|improve this answer
    
I'm running apache 2.2, it's mod_authnz_ldap hasn't AuthLDAPSubGroupDepth directive: httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html –  Selivanov Pavel Nov 16 '11 at 10:48
    
So, why not update? –  Bart De Vos Nov 16 '11 at 10:50
2  
I'm running Debian Squeeze and I prefer using packages from stable distribution: well-tested, regular security updates. Apache 2.3 is still beta, it will appear in stable or stable-backports not soon. I've solved this problem by using AuthnProviderAlias for now. If nobody will offer solution for Apache 2.2, bounty is yours :) –  Selivanov Pavel Nov 16 '11 at 11:42
    
given the new information of the groups being on different servers, I don't think this method will still work. –  Jeff Strunk Nov 18 '11 at 13:43
    
Works like a charm on CentOS 6.3 with the default Apache 2.2.15 from the CentOS repo and in conjunction with MS Active Directory on Win Server 2008 R2. So easy and no fiddling with Active Directory handling under Linux. Thank you! –  user155025 Jan 18 '13 at 12:34
add comment

Besides AuthLDAPSubGroupDepth, that is available only in apache 2.4, it is possible, when using Microsoft AD LDAP, to do authorization using nested groups by using LDAP_MATCHING_RULE_IN_CHAIN matching rule. This is much faster than searching subgroups on the client, because it is done on the DC server with less queries over network.

Require ldap-filter memberof:1.2.840.113556.1.4.1941:=CN=Access to Apache,OU=My Organization Unit,DC=company,DC=com

1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN This rule is limited to filters that apply to the DN. This is a special "extended match operator that walks the chain of ancestry in objects all the way to the root until it finds a match.

See also:

share|improve this answer
    
I'd upvote this 10x if I could. For folks running RHEL 5, this is a great solution. Compiling vendor source to get the latest features is not always a desirable solution! –  Aaron Copley Nov 30 '12 at 21:50
    
I am glad it helped. I think this was the first documented usage of the LDAP_MATCHING_RULE_IN_CHAIN in apache. –  Mircea Vutcovici Nov 30 '12 at 22:58
add comment

It looks like your only option in Apache 2.2 is to list every group that is included by your main authorized group.

Require ldap-group  CN=MySpecificGroup,OU=Security Groups,OU=MyBusiness,DC=company,DC=local
Require ldap-group  CN=MyOtherGroup,OU=Security Groups,OU=MyBusiness,DC=company,DC=local

This should be reasonable if your nested groups aren't too complicated.


Crossing AD Domains(using two LDAP servers)

You can set up OpenLDAP with the slapd_meta overlay running on your web server to proxy your authentication.

/etc/ldap/slapd.conf should look something like:

database meta
suffix   "DC=company,DC=local"
uri      "ldap://a.foo.com/OU=MyBusiness,DC=company,DC=local"
uri      "ldap://b.foo.com/OU=otherdomainsuffix,DC=company,DC=local"

Then, your mod_authnz_ldap stanza would look something like:

AuthName            "whatever"
AuthType            Basic
AuthBasicProvider   ldap
AuthLDAPUrl         "ldapi:///DC=company,DC=local?sAMAccountName?sub?(objectClass=*)"
Require ldap-group  CN=MySpecificGroup,OU=Security Groups,OU=MyBusiness,DC=company,DC=local
Require ldap-group  CN=MyOtherGroup,OU=Security Groups,OU=otherdomainsuffix,DC=company,DC=local

This will require some massaging to get it to work, but I think this is the general idea.

share|improve this answer
1  
Unfortunately this doesn't work when groups are in different AD domains(Domain1_DomainLocal_Group includes Domain2_Global_Group). It was the first thing I tried :) –  Selivanov Pavel Nov 16 '11 at 18:57
    
Does that mean that one of the groups is on a different server? If that's true, I suspect AuthLDAPSubGroupDepth won't work for you either. –  Jeff Strunk Nov 17 '11 at 23:35
    
Yes, two servers, two domains. I considered about integrating Linux box in AD and using PAM authentification, but mod-auth-pam is not supported since apache 2.0, mod-authnz-external + pwauth does not support groups. This all is sadly :( –  Selivanov Pavel Nov 18 '11 at 9:14
1  
Oh, I haven't notice that you updated answer. Using OpenLDAP slapd_meta may be solution, but it kills main point of this configuration: get user rights managed in one single point(Active Directory) by adding/deleting users from groups and including groups in each other. Here is my analogue solution with AuthnProviderAlias without additional OpenLDAP service: <AuthnProviderAlias ldap first-ldap> AuthLDAPURL ... </AuthnProviderAlias> <AuthnProviderAlias ldap second-ldap> AuthLDAPURL ... </AuthnProviderAlias> ... AuthBasicProvider first-ldap second-ldap –  Selivanov Pavel Nov 18 '11 at 10:13
1  
I'v decided to give bounty to Bart De Vos: this is not my question; for original question(without my own specific) his solution is simple and will work –  Selivanov Pavel Nov 20 '11 at 18:36
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.