I guess you mean to look for attribute
mail (not filtering on those). It is not possible, straight away, to use 2 different attributes in the LDAP URL, although RFC 2255 allows for it.
mod_authnz_ldap alone: not possible
Apache mod_authnz_ldap documentation states the URL must be like:
- attribute: The attribute to search for. Although RFC 2255 allows a comma-separated list of attributes, only the first attribute will be used, no matter how many are provided. If no attributes are provided, the default is to use uid. It's a good idea to choose an attribute that will be unique across all entries in the subtree you will be using.
- filter: A valid LDAP search filter. If not provided, defaults to (objectClass=*), which will search for all objects in the tree. Filters are limited to approximately 8000 characters (the definition of MAX_STRING_LEN in the Apache source code). This should be more than sufficient for any application.
Using 2 providers with mod_authn_alias
However, adding another apache module, namely mod_authn_alias, you can use 2 different LDAPURL as different authentication providers. For this to work, you can add a new file (that'll include at the root of your apache configuration) containing:
# Different LDAP attributes to be used as login
<AuthnProviderAlias ldap ldap-uid>
<AuthnProviderAlias ldap ldap-mail>
Then, in your
<Location> statement, you use the following configuration:
AuthBasicProvider ldap-uid ldap-mail
require ldap-group cn=group01,o=test,c=com
This will first try to authenticate using the
uid and if it fails, try using the
mail attribute. With this type of configuration, you can add as many different LDAPURL providers as you wish.
You have to be careful about one thing though, the LDAP search must return a single value, otherwise you'll not be sure which of the multiple entries will be used to check the password to. To achieve that, you can use a scope (
one instead of
sub) or a search filter that will limit the number of entries returned.
The additional file must be added to your apache configuration outside the
<Location> or any
<VirtualHost> directives. It must be included at the root level of your apache configuration. And the
authn_alias module needs to be activated, of course.