3

Can't solve this one, here's my .htaccess:

AuthPAM_Enabled Off

AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthName "MESSAGE"
Require ldap-group cn=CHANGED, cn=CHANGED

AuthLDAPURL "ldap://localhost/dc=CHANGED,dc=CHANGED?uid?sub?(objectClass=posixAccount)"
AuthLDAPBindDN CHANGED
AuthLDAPBindPassword CHANGED
AuthLDAPGroupAttribute memberUid

AuthLDAPURL is correct, BindDN and BindPassword are correct also (verified with ldapvi -D ..).

Apache version: Apache/2.2.9 (Debian)

The error message seems cryptic to me, I have AuthzLDAPAuthoritative on so where's the problem.

EDIT:

LDAP modules are loaded, the problem is not with them being missing.

# ls /etc/apache2/mods-enabled/*ldap*
/etc/apache2/mods-enabled/authnz_ldap.load  /etc/apache2/mods-enabled/ldap.load

EDIT2:

Solved it by changing funky 

Require ldap-group cn=CHANGED, cn=CHANGED

line with

Require valid-user

Since AuthzLDAPAuthoritative is on, no other auth methods will be used and valid-user requirement will auth via LDAP. (right? :/)

Improve this question
5
  • Do you have two "cn"s in your Require ldap-group, or is just your redacting?
    – crb
    Jun 14, 2009 at 15:00
  • Funny question, but you did do AllowOverride all in your <Directory "/"> definition, right?
    – Matt Simmons
    Jun 14, 2009 at 15:19
  • Was my comment enough that I should post it as an answer and you accept it? :)
    – crb
    Jun 14, 2009 at 23:04
  • Sure, go ahead :)
    – Karolis T.
    Jun 15, 2009 at 6:23
  • What LDAP source are you using? I have found that the Windows AD LDAP implementation does not allow for a 'sub' level search on a DC, but does work on an OU.
    – Jeffrey Hulten
    Jun 17, 2009 at 19:02

3 Answers 3

Reset to default
2

Your 'Require' line reads

Require ldap-group cn=CHANGED, cn=CHANGED

That doesn't look write - I don't believe you can have have two cn's in a DN like that.

Improve this answer
1
  • One note on Require ldap-group If you are connecting to the global catalog port, keep in mind that group memberships are NOT replicated to global catalogs UNLESS the group is a universal group. I.e. if you make a Global group AND try to authenticate using require ldap-group AND are connecting to port 3268 IT WILL NOT WORK. Convert it to a universal group and viola.
    – user72853
    Mar 2, 2011 at 21:00
1

For me and apache 2.2.14, this works like a champ for access control on a per-group basis

AuthType Basic
AuthName "Secret Area for IT Only"
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthLDAPGroupAttributeIsDN off
AuthLDAPGroupAttribute memberUid
AuthLDAPURL "ldap://ldap1.example.int ldap2.company.int/cn=int"
Require ldap-group cn=it,ou=Groups,o=int

"int" is our internal domain for non-public servers.

Improve this answer
0

Have you enabled the ldap and authnz_ldap modules?

You can do so with:

a2enmod ldap authnz_ldap; /etc/init.d/apache2 restart
Improve this answer
2
  • Yes, I have them loaded. I've updated the question accordingly.
    – Karolis T.
    Jun 14, 2009 at 13:50
  • "No authoritative handler" implies that apache cannot use them for some reason.
    – Brent
    Jun 14, 2009 at 14:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .