0

On my Debian server I have configured the LDAP server slapd to accept connections only via Unix domain socket file. This is the relevant part from /etc/defaults/slapd:

SLAPD_SERVICES="ldapi:///"

I have been happily living with this configuration, all sorts of PHP applications are nicely working with it. Now I am trying to configure Apache to authenticate via LDAP. I am doing this via the core module mod_authnz_ldap. Naively using the ldapi URL scheme doesn't work:

AuthLDAPUrl ldapi:///ou=users,dc=example,dc=com?uid?sub?(objectClass=*)

All I am seeing in the Apache error are TCP connection attempts to localhost:389 and 127.0.0.1:389, which are, of course, all refused because no one is listening on this port. I also tried two more URLs, both with the same negative result:

# Same as the 1st attempt, but with ldap:// instead of ldapi://
AuthLDAPUrl ldap:///ou=users,dc=example,dc=com?uid?sub?(objectClass=*)

# Getting desperate: Specify the file path of the Unix domain socket file
AuthLDAPUrl ldap:///var/run/slapd/ldapi/ou=users,dc=herzbube,dc=ch?uid?sub?(objectClass=*)

The Apache 2.4 docs for AuthLDAPUrl state this:

An RFC 2255 URL which specifies the LDAP search parameters to use.

RFC 2255 indeed does not mention the ldapi URL scheme, nor of any way how to specify a Unix domain socket file path.

Did I overlook something? Does anyone know how I can get mod_authnz_ldap to use the Unix domain socket file for connections? Or is it indeed, as I fear, impossible to do this with mod_authnz_ldap?

My setup:

  • Debian jessie
  • Apache 2.4.10
  • OpenLDAP 2.4.40
  • Unix domain socket file /var/run/slapd/ldapi is readable by web server user www-data
2
  • I fear it is not supported by mod_authnz_ldap, as the exact behaviour you are facing is described here bz.apache.org/bugzilla/show_bug.cgi?id=44302
    – krisFR
    Jul 23, 2016 at 13:44
  • @krisFR Thanks for digging this up. If you write this as an answer I will accept it.
    – herzbube
    Jul 23, 2016 at 13:47

1 Answer 1

2

I am afraid it is not supported by directive AuthLDAPURL from module mod_authnz_ldap.

At least at the time i wrote these lines.

A bug track report has been published and describes exactly the behaviour you are facing :

https://bz.apache.org/bugzilla/show_bug.cgi?id=44302

if you enter ldapi:///, it is (silently) treated as ldap://localhost:389, that is, the connection is still done over TCP to localhost

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .