Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Using Apache 2.2.14 on Ubuntu 10.04, I am trying to protect a folder with LDAP authentication. Our LDAP server is running Novell eDirectory.

All our users are in subgroups of ou=Users,ou=Directory,o=IC. Like this:

  • ou=Managers,ou=Users,ou=Directory,o=IC
  • ou=Employees,ou=Users,ou=Directory,o=IC
  • ou=Misc,ou=Users,ou=Directory,o=IC
  • ou=Outsiders,ou=Users,ou=Directory,o=IC

I want all of ou=Users,ou=Directory,o=IC to be able to access my folder, except those in ou=Outsiders,ou=Users,ou=Directory,o=IC.

I can get into my folder with my LDAP log in information using the following settings, but it doesn't block users in the Outsiders group:

AuthName "Login Required: please enter your L-number and PIN"
AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthLDAPURL ldaps://ldap.example.com/ou=Users,ou=Directory,o=IC?cn?sub?(objectclass=Person)
Require ldap-filter (|(cn=*,ou=Managers,ou=Users,ou=Directory,o=IC)(cn=*,ou=Employees,ou=Users,ou=Directory,o=IC)(cn=*,ou=Misc,ou=Users,ou=Directory,o=IC))
AuthLDAPBindDN cn=binder,ou=Admin,ou=Directory,o=IC
AuthLDAPBindPassword password

I've tried:

  • Require valid-user
  • Various AuthLDAPURLs
  • Require ldap-group for only the groups I want.
  • Other searches for the Require ldap-filter, like not having "cn=*" in it.

Everything either doesn't let me in, throws a 500 error, or lets members of ou=Outsiders,ou=Users,ou=Directory,o=IC in.

So, how do I keep members of ou=Outsiders,ou=Users,ou=Directory,o=IC out of my folder?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

Assuming that I have 2 groups with following structure:

dn: ou=IT,dc=domain,dc=com
ou: IT
objectClass: top
objectClass: organizationalUnit

dn: cn=bob,ou=IT,dc=domain,dc=com
cn: bob
sn: Bob
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
userPassword:: xx
...

dn: ou=HR,dc=domain,dc=com
ou: HR
objectClass: top
objectClass: organizationalUnit

dn: cn=alice,ou=HR,dc=domain,dc=com
cn: alice
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
userPassword:: xx
...

You can list all users either in IT or in HR department by executing:

$ ldapsearch -W -x -D "cn=binder,dc=domain,dc=com" \
    '(&(|(ou:dn:=IT)(ou:dn:=HR))(cn=*))'

So, you should try with ldapsearch from the command line first:

$ ldapsearch -W -x -D "cn=binder,ou=Users,ou=Directory,o=IC" \
    '(&(|(ou:dn:=Managers)(ou:dn:=Employees)(ou:dn:=Misc))(cn=*))'

If it work, edit the mod_authz_ldap configuration file as belows:

Require ldap-filter &(|(ou:dn:=Managers)(ou:dn:=Employees)(ou:dn:=Misc))(cn=*)
share|improve this answer
    
Thanks! Require ldap-filter &(|(ou:dn:=Managers)(ou:dn:=Employees)(ou:dn:=Misc))(cn=*) worked. –  David R. Nov 9 '11 at 23:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.