4

High there, Is it possible to mix mod_ssl and mod_auth_ldap so that the authentication is done with the client certificate and authorizations with mod_auth_ldap (Require group)? If so, can you give me some pointer? Thanks in advance

1

2 Answers 2

3

OK, for those interested, apache requires the presence of an AuthType directive and the validation of the username by some module.

So I have written a very short module that accepts AuthType Any and accepts any username.

The configuration looks like that:

<Location /slaptest>
    Allow from all
    SSLVerifyClient require
    SSLVerifyDepth 1

    SSLUserName SSL_CLIENT_S_DN_CN

    AuthType Any
    AuthAnyAuthoritative on

    AuthLDAPURL "ldaps://vldap-rectech/ou=XXX,ou=YYY,o=ZZZ?cn"
    AuthzLDAPAuthoritative on
    AuthLDAPBindDN "cn=UUU,ou=Users,ou=XXX,ou=YYY,o=ZZZ"
    AuthLDAPBindPassword "******"
    AuthLDAPGroupAttributeIsDN on
    AuthLDAPGroupAttribute member
    AuthLDAPRemoteUserIsDN off
    Require valid-user
    Require ldap-group cn=ADMIN,ou=Groups,ou=XXX,ou=YYY,o=ZZZ
</Location>
0

The following has been tested in Apache HTTP Server 2.4.29 against Windows Server 2019 Active Directory:

<VirtualHost _default_:443>
    SSLEngine on
    SSLCertificateFile /etc/ssl/private/tls_server_cert_and_key.pem
    SSLCACertificateFile /etc/ssl/certs/trusted_root_ca_for_client_certs.pem
    SSLVerifyClient require
    # Use the email from the succesfully authenticated client certificate to look up for the AD user.                                                         
    SSLUserName SSL_CLIENT_S_DN_Email
    <Location />
        AuthBasicProvider ldap
        # "userPrincipalName" allows to search by the AD user email.
        # "(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" filters out disabled AD users, so only active AD users are allowed to be authorized.
        AuthLDAPURL "ldap://<ACTIVE_DIRECTORY_IP>:3268/DC=example,DC=org?userPrincipalName?sub?(objectClass=person)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))"
        AuthLDAPBindDN "CN=apache-bind-user,CN=Users,DC=example,DC=org"
        AuthLDAPBindPassword "<apache-bind-user-password>"
        <RequireAll>
            Require ldap-group CN=Some Group,CN=Users,DC=example,DC=org
        </RequireAll>
    </Location>
</VirtualHost>

PS: I'm not an expert in Apache HTTP Server or Active Directory, so the previous configuration might not be optimal/secure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .