Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am configuring Apache to authenticate against LDAP and require multiple groups to be present. I have done this with require statements, however I need the authentication to be successful if all groups are there and not just one. How do I tell Apache to go through all require statements?

share|improve this question

3 Answers 3

You cold try the "Satisfy" apache directive, e.g.: satisfy all.

Otherwise you could modify your filter to require the groups, e.g. (&(ou=foo)(ou=bar))

share|improve this answer

"Satisfy" won't work here because that only governs the interaction between "allow" and "require", not between multiple "require" directives.

If your LDAP has memberOf attributes (you can enable those with the memberof overlay in OpenLDAP), you can use "require ldap-filter" to require membership in more than one group.

Unfortunately, memberOf doesn't replicate reliably as of OpenLDAP 2.4.31, so don't rely on it if you also use syncrepl.

share|improve this answer

If you are using an ldap service that supports nested groups, you could create another group that contains the required groups, then have apache reference that group instead. Then when updating any of the original groups, the nested group is automatically updated.

This may not be an option for you, however.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.