Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

(Debian Squeeze) I have Apache authenticating via Kerberos - that works fine. Now I want to restrict the site to a single group only, so I need to add LDAP authorization. I enabled authnz_ldap and edited the apache config. When I use the "Require ldap-group" directive I get the following error in the apache error log:

gss_display_name() failed: A required input parameter could not be read: An invalid name was supplied (, Unknown error)

The config in the apache.conf is:

<Directory /var/www/kerberos>
AuthType Kerberos
AuthName "Kerberos Login"
KrbMethodNegotiate On
KrbMethodK5Passwd On
KrbAuthRealms MYDOMAIN.LOCAL
Krb5KeyTab /etc/krb5.keytab
KrbServiceName HTTP/webserver.mydomain.local@MYDOMAIN.LOCAL
AuthLDAPURL "ldap://primarydc.mydomain.local/DC=mydomain,DC=local?sAMAccountName?sub?(objectClass=*)"
AuthLDAPBindDN "LDAPlookup@mydomain.local"
AuthLDAPBindPassword topsecretpassword
Require ldap-group CN=Mygroup,OU=mydomain,DC=local
</Directory>

I've tried adding "KrbLocalUserMapping On" but the same problem remained.

If I disable the Require ldap-group line everything works fine, I can authenticate via kerberos and see my username in the logs (either as firstname.last@MYDOMAIN.LOCAL or just firstname.last with KrbLocalUserMapping On)

How can I make this work?

Edit: I just tried

AuthLDAPURL ldap://oneaupwdc01.onevue.com.au.local/DC=onevue,DC=com,DC=au,DC=local?userPrincipalName

with KrbLocalUserMapping disabled, and had the same result.

share|improve this question
    
did you found a solution? I have the same problem. This seems to be a bug in apache httpd 2.2. Have a look at sourceforge.net/mailarchive/… Regards Jan –  roehrijn Jun 14 '13 at 11:39
    
Your "AuthName" kerberos login. Is this set on the other side? It seems like it doesn't recognizes this name. Try something else. –  Arif Dolgunyurek Dec 16 at 14:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.