Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to set up different LDAP authorization rules for different levels of an URL. This is the config currently used

    <Location />
            AuthType Basic
            AuthName "Foo"
            AuthBasicProvider ldap
            AuthLDAPURL "..."
            AuthLDAPBindDN  "..."
            AuthLDAPBindPassword "..."
    </Location>

    <Location />
            Require ldap-group cn=foo,ou=Groups,dc=com,dc=company
    </Location>

    <Location /path/>
            Require ldap-user bar
    </Location>

The problem is that /path/ inherits the rules from /. Hence for user bar to be able to access /path/ he must also be in the foo group.

How can I configure the user bar to be able to access /path/ without also having to be a member of group foo?


EDIT: Changed ldap-group to ldap-user for /path/ for an accurate problem description.

share|improve this question
    
Mm ... try placing more specific ones first, i.e., /path/ and the main one / last in the list ... ? Unsure if it will work, but worth a try ... –  KM. Feb 21 '12 at 14:21
    
@km01, I tried that also without success –  Johan Sjöberg Feb 21 '12 at 15:20
add comment

1 Answer 1

My understanding (and I just struggled to find solid supporting documentation) is that Location directives are cumulative, so you're essentially applying two Require directives. What if you did something like this:

<LocationMatch "/[^path]">
    Require ldap-group cn=foo,ou=Groups,dc=com,dc=company
</Location>

<Location /path/>
    Require ldap-group cn=bar,ou=Groups,dc=com,dc=company
</Location>

You'll have to check if that regular expression is apache-compatible, but I believe this approach will work.

share|improve this answer
    
If that is a regular expression, then it will not do what you think! That expression matches anything that starts with a / not followed by any of the letters p, a, t, or h - thus it will reject /path but it will also reject /acct and /home. –  Mei Feb 21 '12 at 15:35
    
Hm, you're right. A regexp for ! /path would be more complicated, but possible. –  Kyle Smith Feb 21 '12 at 15:40
    
I can't seem to find a straight regexp for "don't match this string." I've tried sed and perl to no avail. In particular, these fail: /[^p][^a][^t][^h] and /(path){0,0}. Neither works. Is the only possibility to use a "don't match this regexp"? –  Mei Feb 21 '12 at 15:51
    
It's ugly, but this works (at least in ruby -ne): /^\/[^p]{1}[^a]{1}[^t]{1}[^h]{1}/. Would be nice if there was a LocationNotMatch directive :)... –  Kyle Smith Feb 21 '12 at 15:58
    
What would that regex do with /pathworks? Methinks it would treat it just the same as /path, yes? –  Mei Feb 21 '12 at 16:13
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.