Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It is possible to use a portion of the request URI as an input into mod_authnz_ldap's Require ldap-group directive?

I'm trying to dynamically check access to a bunch of different project directories, all under, such that a user accessing /projects/abc would be checked for membership in cn=abc,ou=groups,dc=test. Ideally I'd like to do this without creating a separate Location directive for each project, since there could well be hundreds of them.

I have come up with this, which illustrates the general concept, but which doesn't work (project_name doesn't retrive the actual variable contents):

<Location /projects>
    SetEnvIf Request_URI "/projects/([-a-z0-9A-Z_]+)/" project_name=$1

    AuthType Basic
    AuthBasicProvider ldap
    AuthName "Restricted Resource - SVN (LDAP)"
    AuthLDAPURL "ldap://"
    AuthLDAPGroupAttributeIsDN off
    AuthLDAPGroupAttribute memberUid
    Require ldap-group cn=%{project_name},ou=groups,dc=test


share|improve this question
Not possible. Your best bet is to try something like mod_auth_external. – h0tw1r3 Jul 23 '11 at 19:14

I believe Apache 2.4 has more to offer in this area than 2.2... might be worth looking at.

Alternatively, it may be worth looking at building your own custom module; it's not as scary as it seems -- assuming you are comfortable in C.

Similarly, doesn't mod_perl offer a lot in extending Apache via hooks?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.