Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to authenticate domain admins through apache and it is not working. Error i get is as follows

[Mon Sep 24 14:54:45 2012] [debug] src/mod_auth_kerb.c(1432): [client 172.16.0.85] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Mon Sep 24 14:54:45 2012] [debug] src/mod_auth_kerb.c(915): [client 172.16.0.85] Using HTTP/intranet.xxx.com@xxx.COM as server principal for password verification
[Mon Sep 24 14:54:45 2012] [debug] src/mod_auth_kerb.c(655): [client 172.16.0.85] Trying to get TGT for user sharifu@xxx.COM
[Mon Sep 24 14:54:45 2012] [debug] src/mod_auth_kerb.c(569): [client 172.16.0.85] Trying to verify authenticity of KDC using principal HTTP/intranet.xxx.com@xxx.COM
[Mon Sep 24 14:54:45 2012] [debug] src/mod_auth_kerb.c(994): [client 172.16.0.85] kerb_authenticate_user_krb5pwd ret=0 user=sharifu@xxx.COM authtype=Basic
[Mon Sep 24 14:54:45 2012] [debug] mod_authnz_ldap.c(561): [client 172.16.0.85] ldap authorize: Creating LDAP req structure
[Mon Sep 24 14:54:45 2012] [debug] mod_authnz_ldap.c(573): [client 172.16.0.85] auth_ldap authorise: User DN not found, LDAP: ldap_simple_bind_s() failed

Below is what I have in my httpd file

Alias /compass "/data/intranet/html/compass"

<Directory "/data/intranet/html/compass">
        AuthType Kerberos
        AuthName KerberosLogin
        KrbServiceName HTTP/intranet.xxx.com
        KrbMethodNegotiate On
        KrbMethodK5Passwd On
        KrbAuthRealms xxx.COM
        Krb5KeyTab /etc/httpd/conf/intranet.keytab
       # require valid-user
       # Options Indexes MultiViews FollowSymLinks
       # AllowOverride All
       # Order allow,deny
       # Allow from all
       #        SetOutputFilter DEFLATE


# taken from http://blogs.freebsdish.org/tmclaugh/2010/07/15/mod_auth_kerb-ad-and-ldap-authorization/
# download extra module and install

        # Strip the kerberos realm from the principle.
#   MapUsernameRule (.*)@(.*) "$1"

        AuthLDAPURL "ldap://echo.uk.xxx.com akhutan.usa.xxx.com/dc=xxx,dc=com?sAMAccountName"
        AuthLDAPBindDN cn=Administrator,ou=Users,dc=xxx,dc=com
        AuthLDAPBindPassword ***
        Require ldap-group cn=Domain Admins,ou=Users,dc=xxx,dc=com
</Directory>

I have followed this guide. I have download and install the tarball. when I try to uncomment MapUsernameRule i get failed error when restarting apache

Reloading httpd: not reloading due to configuration syntax error

I am using centos 5 64bit.

I have added the following line but i still get syntax error

LoadModule mod_map_user modules/mod_map_user.so

httpd: Syntax error on line 199 of /etc/httpd/conf/httpd.conf: Can't locate API module structure `mod_map_user' in file /etc/httpd/modules/mod_map_user.so: /etc/httpd/modules/mod_map_user.so: undefined symbol: mod_map_user
[root@hero mod_map_user]# ll /etc/httpd/modules/mod_map_user.so
-rwxr-xr-x 1 root root 39444 Sep 24 16:23 /etc/httpd/modules/mod_map_user.so

I have updated the load module part and it works now, how ever it is still not working for me. Error i get is as follows

[Mon Sep 24 17:19:05 2012] [debug] src/mod_auth_kerb.c(1432): [client 172.16.0.85] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Mon Sep 24 17:19:05 2012] [debug] src/mod_auth_kerb.c(915): [client 172.16.0.85] Using HTTP/intranet.xxx.com@xxx.COM as server principal for password verification
[Mon Sep 24 17:19:05 2012] [debug] src/mod_auth_kerb.c(655): [client 172.16.0.85] Trying to get TGT for user sharifu@xxx.COM
[Mon Sep 24 17:19:05 2012] [debug] src/mod_auth_kerb.c(569): [client 172.16.0.85] Trying to verify authenticity of KDC using principal HTTP/intranet.xxx.com@xxx.COM
[Mon Sep 24 17:19:05 2012] [debug] src/mod_auth_kerb.c(994): [client 172.16.0.85] kerb_authenticate_user_krb5pwd ret=0 user=sharifu@xxx.COM authtype=Basic
[Mon Sep 24 17:19:05 2012] [info] [client 172.16.0.85] Applying pattern '^(.*)@(.*)$' to user 'sharifu@xxx.COM', mech:'Any'
[Mon Sep 24 17:19:05 2012] [info] [client 172.16.0.85] Pattern matched
[Mon Sep 24 17:19:05 2012] [notice] [client 172.16.0.85] User name 'sharifu@xxx.COM' rewritten to 'sharifu'
[Mon Sep 24 17:19:05 2012] [debug] mod_authnz_ldap.c(561): [client 172.16.0.85] ldap authorize: Creating LDAP req structure
[Mon Sep 24 17:19:05 2012] [debug] mod_authnz_ldap.c(573): [client 172.16.0.85] auth_ldap authorise: User DN not found, LDAP: ldap_simple_bind_s() failed

httdp conf ffile now has:

Alias /compass "/data/intranet/html/compass"

<Directory "/data/intranet/html/compass">
        AuthType Kerberos
        AuthName KerberosLogin
        KrbServiceName HTTP/intranet.xxx.com
        KrbMethodNegotiate On
        KrbMethodK5Passwd On
        KrbAuthRealms xxx.COM
        Krb5KeyTab /etc/httpd/conf/intranet.keytab
       # require valid-user
       # Options Indexes MultiViews FollowSymLinks
       # AllowOverride All
       # Order allow,deny
       # Allow from all
       #        SetOutputFilter DEFLATE
# taken from http://blogs.freebsdish.org/tmclaugh/2010/07/15/mod_auth_kerb-ad-and-ldap-authorization/
# download extra module and install

        # Strip the kerberos realm from the principle.
        MapUsernameRule (.*)@(.*) "$1"

        AuthLDAPURL "ldap://echo.uk.xxx.com akhutan.usa.xxx.com/cn=users,dc=xxx,dc=com?sAMAccountName"
        AuthLDAPBindDN cn=Administrator,ou=users,dc=xxx,dc=com
        AuthLDAPBindPassword xxx
        Require ldap-group cn=Domain Admins,ou=users,dc=xxx,dc=com
</Directory>
share|improve this question
1  
Try running apachectl configtest, see if it says anything more specific about the error. –  Chris S Sep 24 '12 at 15:47
    
Updated question –  sharif Sep 24 '12 at 16:06
1  
Modules are commonly named "map_user_module", so the line might be LoadModule map_user_module modules/mod_map_user.so. I'm not sure if CentOS messes with this default (many of the Linux distros screw with Apache, I can't remember them all). –  Chris S Sep 24 '12 at 16:10
    
updated question –  sharif Sep 24 '12 at 16:21
1  
Your AuthLDAPBindDN line is wrong (assuming you're using Active Directory). There is no OU=Users, Users is a special folder, you'd reference it by CN=Users. So the line should be AuthLDAPBindDN CN=Administrator,CN=Users,DC=example,DC=com. Side note: you really shouldn't be using the Administrator account (you should create a service account of some kind just for this server, MS recommends Apache$httpd$server01, replace server name as appropriate); and the Administrator account should be renamed (not Admin or root either; but just about anything else). –  Chris S Sep 24 '12 at 16:52
show 1 more comment

1 Answer

up vote 0 down vote accepted

As Chris S has mentioned my AuthLDAPBindDN was wrong

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.