2

As part of the security policy we are upgrading out systems to comply with, I need to set our Apache LDAP Auth to have a idle-timeout of 15 minutes.

I.e. If the user stops using the system for over 15 minutes, the next time they go to use it they will need to re-authenticate.

Is this even possible? If so, how can I achieve it?

My auth config in my .htaccess file looks like this:

AuthName "AD Authentication"
AuthType Basic
AuthBasicProvider ldap
AuthLDAPUrl "URL"
AuthLDAPBindDN "DN"
AuthLDAPBindPassword "PASSWORD"
AuthzLDAPAuthoritative Off
require valid-user

Any ideas?

2
  • To clarify, do you mean that the connection to the LDAP server needs to time out, or the user's session needs to time out? May 4, 2011 at 1:54
  • The users session - so if they idle for longer than 15 minutes, they need to re-authenticate.
    – Stephen RC
    May 4, 2011 at 2:30

3 Answers 3

5

Unfortunately, basic authentication is not session-aware in any way. From the web server's perspective, they're actually forced to re-authenticate with every single request.

However, all browsers cache the credentials used for a basic auth connection, so that you don't need to re-enter credentials for every resource loaded from the server. The issue that this creates in your situation is that there's no way to 'expire' that data from the client browser; it keeps it as long as it wants.

To implement session timeouts, you may be stuck moving away from basic auth and toward a session-aware application.

2
  • Mmm... that will get annoying. Is there any way to tell the browser to forget the credentials and to re-authenticate?
    – Stephen RC
    May 4, 2011 at 3:03
  • I don't believe so. May 4, 2011 at 3:11
0

A way to manually tell the browser to forget current credentials is to open the current address with another/invalid user.

http://[email protected]
1
  • This is not portable and might not work on all browsers. In fact there's no portable way to logout when basic or digest authentication is used.
    – FINESEC
    Nov 6, 2012 at 17:47
-1

Try instructions from this site: http://search.cpan.org/~ksolomko/Apache2-AuthCookieLDAP-1.14/lib/Apache2/AuthCookieLDAP.pm

1
  • 3
    Welcome to Server Fault. Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. Jul 17, 2013 at 7:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .