Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know there are other posts on this issue, but the symptoms are quite a bit different from the few other threads I've reviewed already.

I have Apache 2.2 installed and I'm trying to get the LDAP authentication to work.

I've added the following configuration to my .conf file:

    <Location "/">          
        AuthBasicProvider ldap
        AuthType Basic
        AuthzLDAPAuthoritative on
        AuthName "Enter Credentials"            
        AuthLDAPURL "ldap://server.mydomain.local:3268/CN=Users,DC=mydomain,DC=local?sAMAccountName"
        AuthLDAPBindDN myaccount@mydomain.local
        AuthLDAPBindPassword myP@ssw0rd         

        Require valid-user      
    </Location>

The AuthLDAPURL is valid as I can connect to it using an LDAP browser.

The key difference is that when I connect, it seems that the request "stalls" in Apache. Browser spins around for a good 2-3 minutes and then gives me a 500 error.

In the actual log all I see is:

auth_ldap authenticate: using URL ldap://server.mydomain.local:3268/CN=Users,DC=MYDOMAIN,DC=local?samAccountName
auth_ldap authenticate: using URL ldap://server.mydomain.local:3268/CN=Users,DC=MYDOMAIN,DC=local?samAccountName
auth_ldap authenticate: using URL ldap://server.mydomain.local:3268/CN=Users,DC=MYDOMAIN,DC=local?samAccountName
auth_ldap authenticate: using URL ldap://server.mydomain.local:3268/CN=Users,DC=MYDOMAIN,DC=local?samAccountName
auth_ldap authenticate: using URL ldap://server.mydomain.local:3268/CN=Users,DC=MYDOMAIN,DC=local?samAccountName
auth_ldap authenticate: using URL ldap://server.mydomain.local:3268/CN=Users,DC=MYDOMAIN,DC=local?samAccountName
auth_ldap authenticate: using URL ldap://server.mydomain.local:3268/CN=Users,DC=MYDOMAIN,DC=local?samAccountName

Until I stop Apache at which point, I see:

auth_ldap authenticate: user MYDOMAIN\\myacount authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Server Down]

As you can see, I've already tried connecting to the Global Catalog (port 3268) -- the most commonly suggested remedy on the web it seems. I am able to connect successfully using an LDAP browser, but getting stonewalled by Apache.

Any ideas or suggestions would be much appreciated!

-- Chuck

share|improve this question

1 Answer 1

up vote 4 down vote accepted

your AuthLdapBindDN should be in the format of "CN=Display Name,CN=Users,DC=domain,DC=local" not user@domain.local

share|improve this answer
    
You can use "adsiedit.msc" (start -> run -> adsiedit.msc) to look at the LDAP data in AD more closely... and drill down to the user you're trying to auth with... and then use the value stored in distinguishedName to get the BindDN. Be-careful with adsiedit.msc as you have access to AD in it's fullness. You can break a lot of stuff VERY easily with it. –  TheCompWiz Aug 31 '11 at 20:06
    
I've tried both formats. "user@domain.local" is said to work fine (jejik.com/articles/2007/06/…) for AD, but yeah, I've tried both formats already. –  Charles Chen Aug 31 '11 at 21:00
    
BANG! Fixed the issue. Caught a little note in the article: "Officially the base, attribute, scope and filter are all optional variables but Active Directory refused to play ball if I did not specify everything. Also, I have no idea why the URL needs to be in double quotes and why it needs to be followed by the word NONE. All I know is that it doesn't work if I omit it." This fixed it for me. –  Charles Chen Aug 31 '11 at 22:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.