Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I configured apache2.2 (CentOS 5.6) to provide ldap authentication with Active Directory.

<Directory "/var/www/html">

        AuthType Basic
        AuthName "Authenticate with domain account."
        AuthBasicProvider ldap
        AuthzLDAPAuthoritative on
        AuthLDAPBindDN cn=Administrator,cn=users,dc=example,dc=com
        AuthLDAPBindPassword secret
        AuthLDAPURL ldap://192.168.56.110:389/dc=example,dc=com?sAMAccountName?sub?(objectClass=*)
        Require valid-user
        ...
</Directory>

It works, but it takes far too long. I analyzed the traffic with tcpdump.. the timestamps show exactly four minutes between the searchResEntry (when Active Directory respond with the DN of the user account I'm trying to log in) and the bindRequest (when apache try to bind as the requested user).

Here is the error_log output for this:

[Sat Dec 10 07:06:37 2011] [debug] mod_authnz_ldap.c(390): [client 192.168.56.1] [2488] auth_ldap authenticate: using URL ldap://192.168.56.110:389/dc=example,dc=com?sAMAccountName?sub?(objectClass=*)

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(489): [client 192.168.56.1] [2488] auth_ldap authenticate: accepting peter

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(971): [client 192.168.56.1] [2488] auth_ldap authorise: declining to authorise

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(390): [client 192.168.56.1] [2475] auth_ldap authenticate: using URL ldap://192.168.56.110:389 dc=example,dc=com?sAMAccountName?sub?(objectClass=*), referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(489): [client 192.168.56.1] [2475] auth_ldap authenticate: accepting peter, referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(971): [client 192.168.56.1] [2475] auth_ldap authorise: declining to authorise, referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [error] [client 192.168.56.1] File does not exist: /var/www/html/projeto/style.css, referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(390): [client 192.168.56.1] [2475] auth_ldap authenticate: using URL ldap://192.168.56.110:389/dc=example,dc=com?sAMAccountName?sub?(objectClass=*), referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(489): [client 192.168.56.1] [2475] auth_ldap authenticate: accepting peter, referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(971): [client 192.168.56.1] [2475] auth_ldap authorise: declining to authorise, referer: http://192.168.56.200/projeto/

As you can see, it takes four minutes between the first and the second line.

Any clue?

Ps. Here is a link to the tcpdump capture displayed with wireshark. As you can see, Active Directory responds instantaneously. What takes too long is the bindRequest from apache (highlighted in the image).

share|improve this question
add comment

1 Answer 1

im going to guess its your ldap query have you tried running that query directly from the the command line using ldap-search

from the looks of your filter:

ldap://192.168.56.110:389/dc=example,dc=com?sAMAccountName?sub?(objectClass=*)

thats a very broad search, what thats actually doing is searching from the base dc=example,dc=com for every record to see if it has an attribute called sAMAccountName, depending on how many entries you have in that tree this could take some time

your better off changing it to something like:

ldap://192.168.56.110:389/ou=People,dc=example,dc=com?sAMAccountName?one?(objectClass=*)

but verify your results using ldap-search utilities first

share|improve this answer
    
(objectClass=*) goes though all Active Directory catalog. Try using (objectClass=user) and, if possible, search in single OU or members of single group: (memberOf=CN=somegroup,OU=Users,DC=example,DC=com) –  Selivanov Pavel Dec 13 '11 at 5:12
    
The search works fine in the command line. As I said, it takes four minutes to apache try to bind with the user DN returned by the search - apache waits four min AFTER Active Directory's instantaneous response. I'll post a link to a wireshark screen shot.. –  beradero Dec 13 '11 at 11:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.