Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

(Debian Squeeze) I have Apache authenticating via Kerberos - that works fine. Now I want to restrict the site to a single group only, so I need to add LDAP authorization. I enabled authnz_ldap and edited the apache config. When I use the "Require ldap-group" directive I get the following error in the apache error log:

gss_display_name() failed: A required input parameter could not be read: An invalid name was supplied (, Unknown error)

The config in the apache.conf is:

<Directory /var/www/kerberos>
AuthType Kerberos
AuthName "Kerberos Login"
KrbMethodNegotiate On
KrbMethodK5Passwd On
KrbAuthRealms MYDOMAIN.LOCAL
Krb5KeyTab /etc/krb5.keytab
KrbServiceName HTTP/webserver.mydomain.local@MYDOMAIN.LOCAL
AuthLDAPURL "ldap://primarydc.mydomain.local/DC=mydomain,DC=local?sAMAccountName?sub?(objectClass=*)"
AuthLDAPBindDN "LDAPlookup@mydomain.local"
AuthLDAPBindPassword topsecretpassword
Require ldap-group CN=Mygroup,OU=mydomain,DC=local
</Directory>

I've tried adding "KrbLocalUserMapping On" but the same problem remained.

If I disable the Require ldap-group line everything works fine, I can authenticate via kerberos and see my username in the logs (either as firstname.last@MYDOMAIN.LOCAL or just firstname.last with KrbLocalUserMapping On)

How can I make this work?

Edit: I just tried

AuthLDAPURL ldap://oneaupwdc01.onevue.com.au.local/DC=onevue,DC=com,DC=au,DC=local?userPrincipalName

with KrbLocalUserMapping disabled, and had the same result.

share|improve this question
add comment

1 Answer 1

did you found a solution? I have the same problem.

This seems to be a bug in apache httpd 2.2. Have a look at http://sourceforge.net/mailarchive/forum.php?thread_name=4B138F1239B8ED429091551E6CF2D832440B9570%40BLUPRD0811MB425.namprd08.prod.outlook.com&forum_name=modauthkerb-help

Regards Jan

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.