High there, Is it possible to mix mod_ssl and mod_auth_ldap so that the authentication is done with the client certificate and authorizations with mod_auth_ldap (Require group)? If so, can you give me some pointer? Thanks in advance
2 Answers
OK, for those interested, apache requires the presence of an AuthType directive and the validation of the username by some module.
So I have written a very short module that accepts AuthType Any and accepts any username.
The configuration looks like that:
<Location /slaptest>
Allow from all
SSLVerifyClient require
SSLVerifyDepth 1
SSLUserName SSL_CLIENT_S_DN_CN
AuthType Any
AuthAnyAuthoritative on
AuthLDAPURL "ldaps://vldap-rectech/ou=XXX,ou=YYY,o=ZZZ?cn"
AuthzLDAPAuthoritative on
AuthLDAPBindDN "cn=UUU,ou=Users,ou=XXX,ou=YYY,o=ZZZ"
AuthLDAPBindPassword "******"
AuthLDAPGroupAttributeIsDN on
AuthLDAPGroupAttribute member
AuthLDAPRemoteUserIsDN off
Require valid-user
Require ldap-group cn=ADMIN,ou=Groups,ou=XXX,ou=YYY,o=ZZZ
</Location>
The following has been tested in Apache HTTP Server 2.4.29 against Windows Server 2019 Active Directory:
<VirtualHost _default_:443>
SSLEngine on
SSLCertificateFile /etc/ssl/private/tls_server_cert_and_key.pem
SSLCACertificateFile /etc/ssl/certs/trusted_root_ca_for_client_certs.pem
SSLVerifyClient require
# Use the email from the succesfully authenticated client certificate to look up for the AD user.
SSLUserName SSL_CLIENT_S_DN_Email
<Location />
AuthBasicProvider ldap
# "userPrincipalName" allows to search by the AD user email.
# "(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" filters out disabled AD users, so only active AD users are allowed to be authorized.
AuthLDAPURL "ldap://<ACTIVE_DIRECTORY_IP>:3268/DC=example,DC=org?userPrincipalName?sub?(objectClass=person)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))"
AuthLDAPBindDN "CN=apache-bind-user,CN=Users,DC=example,DC=org"
AuthLDAPBindPassword "<apache-bind-user-password>"
<RequireAll>
Require ldap-group CN=Some Group,CN=Users,DC=example,DC=org
</RequireAll>
</Location>
</VirtualHost>
PS: I'm not an expert in Apache HTTP Server or Active Directory, so the previous configuration might not be optimal/secure.