Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There is my config (httpd 2.4):

<AuthnProviderAlias ldap zzzldap>
   LDAPReferrals Off
   AuthLDAPURL "ldaps://ldap.zzz.com:636/o=zzz.com?uid?sub?(objectClass=*)"
   AuthLDAPBindDN "uid=zzz,ou=Applications,o=zzz.com"
   AuthLDAPBindPassword "zzz"
</AuthnProviderAlias>

<Location /svn>
   DAV svn
   SVNParentPath /DATA/svn
   AuthType Basic
   AuthName "Subversion repositories"
   SSLRequireSSL
   AuthBasicProvider zzzldap

   <RequireAll>
      Require valid-user
      Require ldap-attribute employeeNumber=12345
      Require ldap-group cn=yyy,ou=Groups,o=zzz.com
   </RequireAll>
</Location>

The Require valid-user is work. But ldap-attribite, ldap-filter, ldap-group does not work - denied in logs all time. I spent a lot of time but can't understand what's going on. This is the example of my logs:

[Tue Sep 25 16:42:26.772006 2012] [authz_core:debug] [pid 23087:tid 139684003014400] mod_authz_core.c(802): [client 1.1.1.1:52624] AH01626: authorization result of Require valid-user : granted
[Tue Sep 25 16:42:26.772014 2012] [authz_core:debug] [pid 23087:tid 139684003014400] mod_authz_core.c(802): [client 1.1.1.1:52624] AH01626: authorization result of Require ldap-attribute employeeNumber=12345: denied

I checked all info with ldapsearch: there is a valid username, employee ID and other...

share|improve this question
    
Just to make sure: Is the parameter in your config files and log files empoyeeNumber named exactly the same in the LDAP record or is it spelled correctly there (employeeNumber)? –  SvW Sep 25 '12 at 15:08
    
Sorry, it was a typo. However it's not work. Any ldap-* requirements... Even ldap-filter (objectClass=*) does not work. –  Dmytro Sep 25 '12 at 15:12
    
Does the user you're binding as have enough permissions to query those attributes? –  Shane Madden Sep 25 '12 at 15:40
    
Yes, I checked it with ldapsearch. –  Dmytro Sep 25 '12 at 15:56

1 Answer 1

Try this way:

<AuthnProviderAlias ldap zzzldap>
   LDAPReferrals Off
   AuthLDAPURL "ldaps://ldap.zzz.com:636/o=zzz.com?uid?sub?(objectClass=*)"
   AuthLDAPBindDN uid=zzz,ou=Applications,o=zzz.com
   AuthLDAPBindPassword zzz
</AuthnProviderAlias>

<AuthzProviderAlias ldap-group ldap-group-yyy cn=yyy,ou=Groups,o=zzz.com>
   AuthLDAPURL "ldaps://ldap.zzz.com:636/o=zzz.com"
   AuthLDAPBindDN uid=zzz,ou=Applications,o=zzz.com
   AuthLDAPBindPassword zzz
   Require ldap-group cn=yyy,ou=Groups,o=zzz.com
   #Require ldap-attribute employeeNumber=12345
</AuthzProviderAlias>

<Location /svn>
   DAV svn
   SVNParentPath /DATA/svn
   AuthType Basic
   AuthName "Subversion repositories"
   SSLRequireSSL
   AuthBasicProvider zzzldap

   <RequireAll>
      Require valid-user
      Require ldap-group-yyy
  </RequireAll>
</Location>

I'm not sure about the "Require ldap-attribute employeeNumber=12345" part but the group works for me now.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.