Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently trying to add LDAP support to supplement a file auth system. Unfortunately, I can't just phase out the file system in it's entirety because of when the LDAP server goes down. The current status is that I have a system that works for both LDAP and file login, if the LDAP server is online and responding. But, when the LDAP server goes down, that is when I encounter issues. I can't just have the file validation come before ldap, because then if the username matches but password doesn't, it fails as well. (This is important because passwords are not guaranteed to be the same between LDAP and htpasswd file.)

Here is my current setup:

<Directory /file/path>
  AuthType Basic
  AuthName "Password Required"
  AuthBasicProvider ldap file
  AuthUserFile /file/path/htpasswd
  AuthLDAPURL "ldap://, dc=net"
  AuthLDAPBindAuthoritative off
  AuthzLDAPAuthoritative off
  Require valid-user

The ideas I've been looking at for a solution are as follows:

  1. Get it to actually recognize the LDAP timeout
  2. Find a way for basic auth to fall through when username matches but password doesn't

I'm open to any suggestions. I have playing with LDAPConnectionTimeout and could not get that to make a difference.

share|improve this question
What about fixing your LDAP server issues so you can get from file auth? – David Aug 2 '12 at 0:37
@David: If it was that easy, I would. Right now the issue is that LDAPConnectionTimeout does nothing (as far as I can tell) to help it actually detect the timeout. I can not figure a way to get that to work, so I'm all ears. :) – Chris Dessonville Aug 2 '12 at 4:32
Why is it OK if the passwords don't match when the file provider comes second but not when it comes first? – EJP Aug 12 '12 at 1:04
@EJP: That is how it is handled by Apache. I actually want it to not matter and that is really my question. – Chris Dessonville Aug 12 '12 at 3:57

Don't you just need to add Satisfy Any?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.