Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server that currently uses htpasswd to authenticate users. I'm migrating to using LDAP, but my LDAP server is only for user authentication, not allowing me to add groups.

I still need to use groups as they are used for access control via the Apache Directory tags in my configuration. The alternative is to revisit the access control altogether, using php or something of the sort to limit access.

this works for 'basic' authentication

<Directory /misc/www/html/site>
#LDAP & other config stuff irrelevant to issue

Require ldap-group cn=<service>,ou=Groups,dc=<service>,dc=<org>,dc=com
</Directory>

attempted

<Directory /misc/www/html/site>
#LDAP & other config stuff irrelevant to issue

#groups file from previous configuration using htpasswd 
#tried to tweak to match new user format, but I don't think it looks up in here
AuthGroupFile   /misc/www/htpasswd/groups

#added the group, which is how it works when using htpasswd
Require ldap-group cn=<service>,ou=Groups,dc=<service>,dc=<org>,dc=com group xyz
</Directory>
share|improve this question
    
Why is your server not allowing you to add groups? This is a basic function of any LDAP server. –  EJP Dec 14 '12 at 21:20
    
I am looking into that possibility, but the LDAP server is typically used where the Access Control is in the app and LDAP is simply providing the authentication. –  Greg Ogle Dec 17 '12 at 17:33

1 Answer 1

As @EJP points out, the best solution would be to put the groups in LDAP. To answer your question, though, you could join the machine to the LDAP server so that LDAP accounts are OS users. Then you could put the users in OS groups (i.e., /etc/group on Unix) and use mod_authz_unixgroup.

share|improve this answer
    
Thanks, another possibility. –  Greg Ogle Dec 17 '12 at 17:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.