1

Server is running RHEL 7 and Apache 2.4.6; this is a pretty new (about a week old) problem. My department Intranet uses authentication against the university's Active Directory environment, and authentication for end-users takes over 30 seconds. Subsequent page loads are nearly-instant, and after some time (timeout, I assume), the problem is back.

<Directory /var/www/html/intranet>
  AuthType Basic
  AuthName "Restricted files"
  AuthBasicProvider ldap
  AuthLDAPBindDN CN=dept-binder,OU=Generic-Logon,OU=Generic,DC=example,DC=edu
  AuthLDAPBindPassword lamepassword
  AuthLDAPURL ldaps://ldap-ad.example.edu:636/dc=example,dc=edu?sAMAccountName?sub

  <RequireAny>
    require ldap-group CN=ug-dept-intranet,OU=Deoartment,OU=Dept-Groups,DC=example,DC=edu
  </RequireAny>
</Directory>

Here are some relevant lines from error_log:

AH02034: Initial (No.1) HTTPS request received for child 36 (server dept.example.edu:443)
AH01626: authorization result of Require ldap-group CN=ug-psy-employees,OU=Dynamic,OU=Psychology,OU=FSU-Dept-Groups,DC=fsu,DC=edu: denied (no authenticated user yet)
AH01626: authorization result of Require ldap-group CN=ug-dept-intranet,OU=Dept,OU=Dept-Groups,DC=example,DC=edu: denied (no authenticated user yet)
AH01691: auth_ldap authenticate: using URL ldaps://ldap-ad.example.edu:636/dc=example,dc=edu?sAMAccountName?sub
AH02001: Connection closed to child 11 with standard shutdown (server dept.example.edu:443)

# 37 seconds pass

AH01697: auth_ldap authenticate: accepting jsmith
AH01713: auth_ldap authorize: require group: testing for group membership in "CN=ug-dept-intranet,OU=Department,OU=Dept-Groups,DC=example,DC=edu"
AH01714: auth_ldap authorize: require group: testing for member: CN=jsmith,OU=PEOPLE,DC=example,DC=edu (CN=ug-dept-intranet,OU=Department,OU=Dept-Groups,DC=example,DC=edu)
AH01715: auth_ldap authorize: require group: authorization successful (attribute member) [Comparison true (adding to cache)][6 - Compare True]
2

I've had exactly the same problem on Fedora 33 with Apache 2.4 and I've solved it by adding:

LDAPConnectionTimeout 1

to the Apache global configuration: https://httpd.apache.org/docs/2.4/mod/mod_ldap.html

The above parameter sets LDAP connection timeout to 1 second.
I'm using LDAPS with TLS and I suspect that delay was caused by Apache trying to resolve names or verify Active Directory/DC non-qualified (self enrolled) certificate.

0

if your directory is large (university, so it could be), queries could be slow out of the box. You need to tweak them. No silver bullet, but some pointers:

  • filter on indexed attributes
  • try using the global catalog port if the attributes are listed as global catalog replicated
  • avoid (if at allo possible) sub scoped searches. This is obviously not always possible, but it often is

There are more listed in this Microsoft document.

You can try debugging mod_ldap, maybe you can find some obvious problem that way, beware credentials could appear in the debug log.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.