LDAP Authentication fails with 500 or 401 depending on bind for Apache2

Question

I'm setting up LDAP authentication for our Subversion repository hosted through Apache on a RHEL 5 system. I run into two different issues when I try to authenticate against Active Directory.

<Location /svn/>
Dav svn
SvnParentPath /srv/subversion
SVNListParentPath On
AuthType Basic
AuthName "Subversion Repository"

AuthBasicProvider ldap

AuthLDAPBindDN "cn=userfoo,ou=Service Accounts,ou=User Accounts,dc=my,dc=example,dc=com"
AuthLDAPBindPassword "mypass"

AuthLDAPUrl "ldap://my.example.com:389/ou=User Accounts,dc=my,dc=example,dc=com?sAMAccountName?sub?(objectClass=user)" NONE

Require valid-user
</Location>

If I use the above configuration it continually prompts me with the Basic prompt and I have to eventually select Cancel, which returns a 401 (Authorization Required). If I comment out the bind parts it returns 500 (Internal Server Error), griping that authentication failed:

[Mon Nov 02 12:00:00 2009] [warn] [client x.x.x.x] [10744] auth_ldap authenticate: user myuser authentication failed; URI /svn [ldap_search_ext_s() for user failed][Operations error]

When I perform the bind using ldapsearch and filter for a simple attribute it returns correctly:

ldapsearch -h my.example.com -p 389 -D "cn=userfoo,ou=Service Accounts,ou=User Accounts,dc=my,dc=example,dc=com" -b "ou=User Accounts,dc=my,dc=example,dc=com" -w - "&(objectClass=user)(cn=myuser)" sAMAccountName

Unfortunately I have no control or insight into the AD part of the system, only the RHEL server. Does anyone know what the hang up is here?

Answer 1

Comparing your configuration to a working configuration with Active Directory on Apache 2.2.3 the only differences I'm seeing are:

• I am using the "DOMAIN\sAMAccountName" style username for my AuthLDAPBindDN
• I do not have NONE after my AuthLDAPURL

Aside from those suggestions, I'd recommend running tcpdump on the conversation between Apache and Active Directory to see what might be transpiring there, too.

Answer 2

I dont know about LDAP as I have used SSPI auth for my setup. But I found these pages with nice details on LDAP configuration. (Just in case you havent yet gotten to them):

http://blogs.open.collab.net/svn/2009/03/subversion-with-apache-and-ldap-updated.html

http://www.novell.com/communities/node/5679/installing-and-configuring-subversion-server-and-apache2-ldap-authentication-against-edire

The apache version seems to make a difference to the syntax.

Also the order in which the LDAP modules are loaded.

Answer 3

Your LDAPUrl makes apache create query: &(objectClass=user)(sAMAccountName=myuser)

And your command line query is: &(objectClass=user)(cn=myuser)

Which one is correct? If you say your command line test works ok, then you probably need:

AuthLDAPUrl "ldap://my.example.com:389/ou=User Accounts,dc=my,dc=example,dc=com?cn?sub?(objectClass=user)" NONE

Answer 4

I had the same problem. The identical configuration i tested on Ubuntu did not work on RHEL5. I ended up changing from port 389 to 3268 after reading this and that fixed my problem.