1

I am trying to configure ldaps authentication on a CentOS 6.x server running Apache 2.2. I have successfully been using ldap authentication for a couple years, but need to get it to work over SSL. I do have ldap_module and authnz_ldap_module loaded. My issue is that no matter where in the stack I try to include any directives like LDAPTrustedClientCert or LDAPTrustedGlobalCert I get the 'directive not allowed here' messages. I have tried in the root configuration, I have tried within a block within the vhost configuration, I have tried allowing all overrides and putting it within an .htaccess file... all to no avail.

I'd welcome any suggestions.

Improve this question

3 Answers 3

Reset to default
2

If for some reason you need to supply a client certificate when making an ldap connection, then you should supply these directives in the same place as your AuthType directive.

    <Location /secure-ldap-basic>
            AuthType basic
            AuthName "LDAP signin required"
            AuthBasicProvider ldap
            AuthLDAPUrl ldaps://ldap.example.com/ SSL
            LDAPTrustedClientCert KEY_BASE64 /etc/pki/tls/private/www.example.com.key
            LDAPTrustedClientCert CERT_BASE64 /etc/pki/tls/certs/www.example.com.cert
            Require valid-user
    </Location>
    <Location /secure-ldap-form>
            AuthType form
            AuthName realm
            AuthFormProvider ldap
            AuthLDAPUrl ldap://ldap.example.com/ STARTTLS
            LDAPTrustedClientCert KEY_BASE64 /etc/pki/tls/private/www.example.com.key
            LDAPTrustedClientCert CERT_BASE64 /etc/pki/tls/certs/www.example.com.cert
            Require valid-user
            AuthFormLoginRequiredLocation /login?%{REQUEST_URI}

            Session On
            SessionCookieName session path=/
            SessionCryptoPassphrase <passphrase>
     </Location>
Improve this answer
2
  • Thank you for this. This is the sort of example I have been trying. When I put it in the .htaccess file, I get "<Location" not allowed here, even though I have AllowOverride All set. When I put it in the vhost container, I get "LDAPTrustedClientCert not allowed here" with the httpd configtest. If I do not include LDAPTrustedClientCert and just set the AuthLDAPUrl to ldaps:// I get the generic 500 error in the browser and cannot find where that is getting logged.
    – verdonv
    Apr 17, 2018 at 19:21
  • What I ended up doing was using the directive "LDAPVerifyServerCert Off". Even though the documentation led me to believe that I had to put that within a location or directory block, it produced error until I moved it out of those and just put it up near the top of my httpd.conf file. That seems to have worked.
    – verdonv
    Apr 19, 2018 at 15:42
0

LDAPTrustedClientCert and LDAPTrustedGlobalCert are for client certificates. As such, they aren't needed generally needed to secure LDAP communication from a webserver.

This directive is secure in much the same way that most https connections are secure:

AuthLDAPUrl ldaps://ldap.example.com/ SSL
Improve this answer
1
  • Thank you. I had tried that initially, but it is just resulting in 500 errors, that I can't find logged anywhere.
    – verdonv
    Apr 17, 2018 at 18:28
-1

According to the apache 2.2 documentation:

https://httpd.apache.org/docs/2.2/mod/mod_ldap.html#ldaptrustedclientcert

that should go within a directory setting.

<directory /the/directory/of/stuff>
    LDAPTrustedClientCert type directory-path/filename/nickname [password]
</directory>

Also, since you are dealing with certs, you should be in a SSL virtualhost.

Improve this answer
2
  • 1
    The last sentence is incorrect; it's entirely possible to use a client certificate for LDAP authentication from a non-SSL virtualhost. (Though it's generally ill-advised to send passwords in cleartext, so SSL is certainly recommended.)
    – Jenny D
    Apr 14, 2018 at 7:50
  • You are correct. My choice of wording was poor and I've edited. Thank you.
    – JohnA
    Apr 15, 2018 at 19:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .