Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a problem with Apache2 authentication using authnz_ldap_module in order to authenticate users from Active Directory. My Apache version is 2.2.16-6+squeeze10.

Here is the configuration I am trying to use with no luck (one of many combinations, to be precise):

AuthzLDAPAuthoritative off
AuthBasicProvider ldap
AuthType Basic
AuthName "Active Directory"
AuthLDAPURL "ldap://server1.my.company.tld:3268 server2.my.company.tld:3268/dc=my,dc=company,dc=tld?sAMAccountName?sub"
AuthLDAPBindDN "uid=my_user,dc=my,dc=company,dc=tld"
AuthLDAPBindPassword "mypassword"
Require valid-user

And I get following entries in Apache's error.log:

[debug] mod_authnz_ldap.c(379): [client some_ip_here] [12391] auth_ldap authenticate: using URL ldap://server1.my.company.tld:3268 server2.my.company.tld:3268/dc=my,dc=company,dc=tld?sAMAccountName?sub
[info] [client some_ip_here] [12391] auth_ldap authenticate: user my_user authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Invalid credentials]
[error] [client some_ip_here] user my_user: authentication failure for "/": Password Mismatch

Of course I enter correct password each time, I would get blocked in AD about hundred times already, didn't happen single time so far.

I cannot verify, that I can connect to my AD controller, because when I try:

ldapsearch -h server1.my.company.tld -p 3268 -D "dc=my,dc=company,dc=tld"

I get following error:

text: 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1

I have absolutely no idea how to bind with ldapsearch and manual didn't help me so far.

What am I doing wrong with Apache2 configuration and how can I bind with ldapsearch?

I will provide additional information, if these are needed.

share|improve this question

2 Answers 2

You have to tell ldapsearch who you are binding as so, per ldapsearch --help, use the -U switch and give it a user name... i.e.

ldapsearch -h server1.my.company.tld -p 3268 -D "dc=my,dc=company,dc=tld" -U <username>
share|improve this answer
    
Thanks, this helped me, I don't know why, but couldn't find it on my own. Now I know more about what might cause problem with APACHE, but still got no solution. –  tymik Feb 20 '13 at 10:24
up vote 1 down vote accepted

The most problematic case was AuthLDAPBindDN, which had to be in syntax of "user@my.company.tld" and not of syntax "domain\user" neither simply "user" nor "uid=my_user,dc=my,dc=company,dc=tld". Below is the proper configuration that did work for me, which I provide here as solution for the case.

            AuthzLDAPAuthoritative off
            AuthBasicProvider ldap
            AuthType Basic
            AuthName "Active Directory"
            AuthLDAPURL "ldap://server1.my.company.tld:3268 server2.my.company.tld:3268/DC=ad,DC=upos,DC=pl?sAMAccountName?sub?(objectClass=*)"
            AuthLDAPBindDN "bind_user@my.company.tld"
            AuthLDAPBindPassword "some_random_password"
            Require valid-user

It has taken me long time to provide the answer, what I am sorry for.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.