Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got Apache 2.4 running on Windows Server 2012.

I've got mod_authnz_ldap working except if users put a blank username. This results in a 500 internal server error.

this is the entry in httpd.conf for the "staff" area...

<Location "/staff">
    AuthType Basic
    AuthName "Staff Area"
    LDAPReferrals Off
    AuthBasicProvider ldap
    AuthUserFile /dev/null
    AuthLDAPBindPassword MyPassword
    AuthLDAPURL "ldap://server-dc1:389/ou=DomainUsers,dc=school,dc=com,dc=au?sAMAccountName?sub"
    Require ldap-group cn=staff,ou=staff,ou=DomainUsers,dc=school,dc=com,dc=au

Anything obvious that I'm missing? Does anyone else use mod_authnz_ldap? Does your server not like blank usernames?

share|improve this question
The last two lines in my error.log are... [Mon Jan 20 11:41:43.965316 2014] [authnz_ldap:debug] [pid 2084:tid 956] mod_authnz_ldap.c(500): [client] AH01691: auth_ldap authenticate: using URL ldap://server-dc1:389/ou=DomainUsers,dc=school,dc=com,dc=au?sAMAccountName?sub [Mon Jan 20 11:41:43.965316 2014] [authnz_ldap:info] [pid 2084:tid 956] [client] AH01695: auth_ldap authenticate: user authentication failed; URI /staff/ [ldap_search_ext_s() for user failed][Filter Error] – jpgorton Jan 20 '14 at 1:04
up vote 3 down vote accepted

I just had to add...

AuthLDAPBindAuthoritative off

I'm not 100% sure why this is. Perhaps something to do with mod_authnz_ldap passing the auth on to somewhere else? but it works.

Hope this helps someone.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.