Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a working Kerberos authentication on my Apache. My AuthGroupFile directive points to a file where there is one group called rnd (rnd: user@my.domain.com).

This works just fine, but I don't know how to grant access to all the users in the domain my.domain.com. Do you know how to do this?

share|improve this question

migrated from stackoverflow.com Dec 28 '09 at 14:43

This question came from our site for professional and enthusiast programmers.

2  
If there is only one domain, you don't need AuthGroupFile. Just allow everyone (require valid-user). –  chutz Oct 31 '12 at 19:06

2 Answers 2

If this is within your own network, why not restrict/allow access via IP address or IP range? This example blocks for all—and forces a user/password combo—but allows localhost & the whole 10.x.x.x & 192.x.x.x ranges.

<Location /protected>
  AuthName "My Protected Server"
  AuthType Basic
  require valid-user
  AuthUserFile /etc/apache2/my_server_passwords

  Order Deny,Allow
  Deny from all
  Allow from 127.0.0.1 ::1
  Allow from localhost
  Allow from 10.0.0.0/8
  Allow from 192.0.0.0/8
  Satisfy Any
</Location>

Or what about using LDAP as described in this article? Config from that article here, but adding the Allow from… from above:

<Location /protected>
  # Using this to bind
  AuthLDAPBindDN "CN=John Doe,OU=IT Department,OU=Germany,DC=example,DC=com"
  AuthLDAPBindPassword "XXX"
  # search user
  AuthLDAPURL "ldap://IP-DOMAIN-CONTROLLER/ou=Germany,dc=example,dc=com?sAMAccountName?sub?(objectClass=*)"

  AuthType Basic
  AuthName "USE YOUR WINDOWS ACCOUNT"
  AuthBasicProvider ldap
  # Important, otherwise "(9)Bad file descriptor: Could not open password file: (null)"
  AuthUserFile /dev/null
  require valid-user

  Allow from 127.0.0.1 ::1
  Allow from localhost
  Allow from 10.0.0.0/8
  Allow from 192.0.0.0/8
  Satisfy Any
</Location>
share|improve this answer

Could you not specify a user group rather than a user name, and then you can have a nice group of "AuthorizedWebUsers" ?

share|improve this answer
    
The user group does not support wild cards either. I would like to state that "allow access from every user in the domain 'master'". Currently I have to list every user name I wish to grant access to my application. Obviously, this is not suitable in environments where the users are changing constantly. –  Lauri L Jan 4 '10 at 7:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.