I have CentOs 5.5 with Apache 2.2 and SVN installed. Also I have Windows 2003 R2 with Active Directory.
I'm trying to authorize users via AD so each user have access to repo if he is a member of corespondent group in AD.
Here is my apache config:

LoadModule dav_svn_module      modules/mod_dav_svn.so
LoadModule authz_svn_module    modules/mod_authz_svn.so
LDAPVerifyServerCert off
ServerName svn.mydomain.com
DocumentRoot /var/www/svn.mydomain.com/htdocs
RewriteEngine On
[Location /]
 AuthType basic
 AuthBasicProvider ldap
 AuthzLDAPAuthoritative on
 AuthLDAPURL ldaps://comp1.mydomain.com:636/DC=mydomain,DC=com?sAMAccountName?sub?(objectClass=*)
 AuthLDAPBindDN [email protected]
 AuthLDAPBindPassword binduserpassword
[Location /repos/test]
 DAV svn
 SVNPath /var/svn/repos/test
 AuthName "SVN repository for test"
 Require ldap-group CN=test,CN=ProjectGroups,DC=mydomain,DC=com

When I'm using "Require valid-user" everything goes fine, "Require ldap-user" also works.
But as soon as I use "Require ldap-group" authorization fails.
Trere are no errors in apache logs, but Active Directory shows folowing error:

Event Type: Information
Event Source: NTDS LDAP
Event Category: LDAP Interface 
Event ID: 1138
Date:  10/9/2010
Time:  1:28:52 PM
User:  MYDOMAIN\binduser
Computer: COMP1
Internal event: Function ldap_compare entered.

Event Type: Error
Event Source: NTDS General
Event Category: Internal Processing 
Event ID: 1481
Date:  10/9/2010
Time:  1:28:52 PM
User:  MYDOMAIN\binduser
Computer: COMP1
Internal error: The operation on the object failed. 

Additional Data 
Error value:
2 0000208D: NameErr: DSID-031001CD, problem 2001 
(NO_OBJECT), data 0, best match of:

I'm confused by this problem. What I'm doing wrong?

3 Answers 3


Not sure if this is your problem, but that LDAPBindDN doesn't look like a DN to me. Without knowing how you've got your AD tree set up, I would guess it should be something like cn=binduser,dc=mydomain,dc=com or cn=binduser,ou=Users,dc=mydomain,dc=com or what have you.

  • The LDAP bind DN is the name of a Kerberos principal, which is perfectly valid in Active Directory. Nov 3, 2010 at 16:49

Two steps come to mind:

  • What comes back if you do an ldapsearch from the command line on the provided sAMAccountName? Is it the object you expect?
  • What happens if you use the global catalog port (3268 unencrypted, 3269 SSL)?

These are required when using Active Directory with mod_authnz_ldap; they might also help here:

   AuthLDAPGroupAttribute member
   AuthLDAPGroupAttributeISDN on

You must log in to answer this question.