My soul is dying a little more at each passing moment I try to work out this setup. I have a Windows XP machine on which there is a xampplite installation with Apache 2.2.11. I would like to be able to authenticate users with the company's Active Directory (Server 2003).

I cannot use IIS because the product we want to run doesn't work on it; and I cannot use a UNIX server because our use of the product requires Windows features.

My first thought was to use mod_auth_kerb5. It does sound like the best idea; loginless authentication would be great. The problem is that I couldn't find a Windows binary for it, and compiling it seems like a world of pain: first get MinGW/Cygwin, then get the sources for the module, which require the sources for Kerberos 5, themselves requiring Perl, figure out all the dependencies and compile them all too, really isn't something appealing to me.

So instead, as a weak compromise, I thought I could resort to LDAP authentication. However, using LDAP over SSL won't work, and Apache reports something that looks like this:

[LDAP: ldap_simple_bind_s() failed][Server down]

So I decided to drop SSL to at least see if it works, and it turns out it doesn't:

[client] [4984] auth_ldap authenticate: user foobar authentication
failed; URI /app/webroot/ [ldap_search_ext_s() for user failed][Operations Error]

Googling the error gave me several results, and I adapted my config to reflect most fixes people suggested, but to no avail.

This is my config file:

AuthType basic
AuthName "Super-secret area"
AuthBasicProvider ldap
AuthzLDAPAuthoritative off
AuthLDAPUrl "ldap://server1:3268 server2:3268 server3:3268/dc=domain,dc=ext?sAMAccountName?sub?(objectClass=*)"
Require valid-user

At this point, any suggestion would be welcome, as long as I get to authenticate with the AD server.


I found out that you need to bind with a username/password to make it work. Simply adding:

AuthLDAPBindDN "John Doe"
AuthLDAPBindPassword secret

will do the trick.

I also have to add that the order of the directives is relevant (or there's some seriously dark magic playing against me). This is my directive order, and it works (putting AuthLDAPBindDN and AuthLDAPBindPassword after AuthLDAPUrl will fail):

AuthBasicProvider ldap
AuthType basic
AuthName Bromine
AuthzLDAPAuthoritative off
AuthLDAPBindDN john.doe@example.com
AuthLDAPBindPassword secret
AuthLDAPUrl "ldap://example.com/DC=example,DC=com?sAMAccountName?sub?(objectClass=*)" NONE
Require valid-user

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.