On my Debian server I have configured the LDAP server slapd
to accept connections only via Unix domain socket file. This is the relevant part from /etc/defaults/slapd
:
SLAPD_SERVICES="ldapi:///"
I have been happily living with this configuration, all sorts of PHP applications are nicely working with it. Now I am trying to configure Apache to authenticate via LDAP. I am doing this via the core module mod_authnz_ldap
. Naively using the ldapi
URL scheme doesn't work:
AuthLDAPUrl ldapi:///ou=users,dc=example,dc=com?uid?sub?(objectClass=*)
All I am seeing in the Apache error are TCP connection attempts to localhost:389
and 127.0.0.1:389
, which are, of course, all refused because no one is listening on this port. I also tried two more URLs, both with the same negative result:
# Same as the 1st attempt, but with ldap:// instead of ldapi://
AuthLDAPUrl ldap:///ou=users,dc=example,dc=com?uid?sub?(objectClass=*)
# Getting desperate: Specify the file path of the Unix domain socket file
AuthLDAPUrl ldap:///var/run/slapd/ldapi/ou=users,dc=herzbube,dc=ch?uid?sub?(objectClass=*)
The Apache 2.4 docs for AuthLDAPUrl
state this:
An RFC 2255 URL which specifies the LDAP search parameters to use.
RFC 2255 indeed does not mention the ldapi
URL scheme, nor of any way how to specify a Unix domain socket file path.
Did I overlook something? Does anyone know how I can get mod_authnz_ldap
to use the Unix domain socket file for connections? Or is it indeed, as I fear, impossible to do this with mod_authnz_ldap
?
My setup:
- Debian jessie
- Apache 2.4.10
- OpenLDAP 2.4.40
- Unix domain socket file
/var/run/slapd/ldapi
is readable by web server userwww-data
mod_authnz_ldap
, as the exact behaviour you are facing is described here bz.apache.org/bugzilla/show_bug.cgi?id=44302