Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to allow members of a certain LDAP-group into a site I'm hosting via Apache. I've read the documentaion on this, but as I have lacking LDAP skills, I could not determine how to accomplish this.

I have the following LDAP structure for the group:

dn: cn=icinga,ou=Groups,dc=mydomain,dc=no
objectClass: groupOfUniqeNames
objectClass: top
uniqeMember: uid=someuser,ou=People,dc=mydomain,dc=no
uniqeMember: ..... <more of these>

My top level looks like this:

dn: dc=mydomain,dc=no
objectClass: dcObject
objectClass: organization
objectClass: top
dc: mydomain
o: mydomain

So, what I've tried is this Apacehe-configruation:

AuthName "Icinga Access"
AuthType Basic

AuthBasicProvider ldap
AuthLDAPURL "ldap://myldapserver/ou=Groups,dc=mydomain,dc=no?uid"
AuthLDAPBindDN "MYBINDDN"
AuthLDAPBindPassword "XXXXXX"
AuthzLDAPAuthoritative off

require ldap-group cn=icinga

And, it doesn't work, because, obviously I'm doing it wrong.. However, I did manage to auth with LDAP when using ou=People in the AuthLDAPURL directive, and require ldap-user user otheruser foo to accomplish this before, but that doesn't scale too well...

share|improve this question
    
Oh! I fixed it! Changed the AuthLDAPURL back to ou=People, set the AuthzLDAPAuthoritative to on, and entered require ldap-group cn=icinga,ou=Groups,dc=mydomain,dc=no And voilla! In addition I figured out that Apache is caching the LDAP entries, so it will not detect changes in the uniqueMember. So, i turned the caching off with LDAPCacheEntries 0 –  LarsErikP Mar 1 '13 at 10:35
1  
Please provide your own answer to this question and accept it when able to do so. –  Iain Apr 4 '13 at 8:04
    
Welcome to Server Fault. This is not a forum. Answers to questions go in the Answer section below, not as comments, and not as edits to the question. –  Michael Hampton Apr 4 '13 at 15:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.