Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to allow members of a certain LDAP-group into a site I'm hosting via Apache. I've read the documentaion on this, but as I have lacking LDAP skills, I could not determine how to accomplish this.

I have the following LDAP structure for the group:

dn: cn=icinga,ou=Groups,dc=mydomain,dc=no
objectClass: groupOfUniqeNames
objectClass: top
uniqeMember: uid=someuser,ou=People,dc=mydomain,dc=no
uniqeMember: ..... <more of these>

My top level looks like this:

dn: dc=mydomain,dc=no
objectClass: dcObject
objectClass: organization
objectClass: top
dc: mydomain
o: mydomain

So, what I've tried is this Apacehe-configruation:

AuthName "Icinga Access"
AuthType Basic

AuthBasicProvider ldap
AuthLDAPURL "ldap://myldapserver/ou=Groups,dc=mydomain,dc=no?uid"
AuthLDAPBindPassword "XXXXXX"
AuthzLDAPAuthoritative off

require ldap-group cn=icinga

And, it doesn't work, because, obviously I'm doing it wrong.. However, I did manage to auth with LDAP when using ou=People in the AuthLDAPURL directive, and require ldap-user user otheruser foo to accomplish this before, but that doesn't scale too well...

share|improve this question
Oh! I fixed it! Changed the AuthLDAPURL back to ou=People, set the AuthzLDAPAuthoritative to on, and entered require ldap-group cn=icinga,ou=Groups,dc=mydomain,dc=no And voilla! In addition I figured out that Apache is caching the LDAP entries, so it will not detect changes in the uniqueMember. So, i turned the caching off with LDAPCacheEntries 0 – LarsErikP Mar 1 '13 at 10:35
Please provide your own answer to this question and accept it when able to do so. – Iain Apr 4 '13 at 8:04
Welcome to Server Fault. This is not a forum. Answers to questions go in the Answer section below, not as comments, and not as edits to the question. – Michael Hampton Apr 4 '13 at 15:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.