Can't solve this one, here's my .htaccess:

AuthPAM_Enabled Off

AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthName "MESSAGE"
Require ldap-group cn=CHANGED, cn=CHANGED

AuthLDAPURL "ldap://localhost/dc=CHANGED,dc=CHANGED?uid?sub?(objectClass=posixAccount)"
AuthLDAPBindPassword CHANGED
AuthLDAPGroupAttribute memberUid

AuthLDAPURL is correct, BindDN and BindPassword are correct also (verified with ldapvi -D ..).

Apache version: Apache/2.2.9 (Debian)

The error message seems cryptic to me, I have AuthzLDAPAuthoritative on so where's the problem.


LDAP modules are loaded, the problem is not with them being missing.

# ls /etc/apache2/mods-enabled/*ldap*
/etc/apache2/mods-enabled/authnz_ldap.load  /etc/apache2/mods-enabled/ldap.load


Solved it by changing funky

Require ldap-group cn=CHANGED, cn=CHANGED

line with

Require valid-user

Since AuthzLDAPAuthoritative is on, no other auth methods will be used and valid-user requirement will auth via LDAP. (right? :/)

  • Do you have two "cn"s in your Require ldap-group, or is just your redacting?
    – crb
    Jun 14, 2009 at 15:00
  • Funny question, but you did do AllowOverride all in your <Directory "/"> definition, right? Jun 14, 2009 at 15:19
  • Was my comment enough that I should post it as an answer and you accept it? :)
    – crb
    Jun 14, 2009 at 23:04
  • Sure, go ahead :)
    – Karolis T.
    Jun 15, 2009 at 6:23
  • What LDAP source are you using? I have found that the Windows AD LDAP implementation does not allow for a 'sub' level search on a DC, but does work on an OU. Jun 17, 2009 at 19:02

3 Answers 3


Your 'Require' line reads

Require ldap-group cn=CHANGED, cn=CHANGED

That doesn't look write - I don't believe you can have have two cn's in a DN like that.

  • One note on Require ldap-group If you are connecting to the global catalog port, keep in mind that group memberships are NOT replicated to global catalogs UNLESS the group is a universal group. I.e. if you make a Global group AND try to authenticate using require ldap-group AND are connecting to port 3268 IT WILL NOT WORK. Convert it to a universal group and viola.
    – user72853
    Mar 2, 2011 at 21:00

For me and apache 2.2.14, this works like a champ for access control on a per-group basis

AuthType Basic
AuthName "Secret Area for IT Only"
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthLDAPGroupAttributeIsDN off
AuthLDAPGroupAttribute memberUid
AuthLDAPURL "ldap://ldap1.example.int ldap2.company.int/cn=int"
Require ldap-group cn=it,ou=Groups,o=int

"int" is our internal domain for non-public servers.


Have you enabled the ldap and authnz_ldap modules?

You can do so with:

a2enmod ldap authnz_ldap; /etc/init.d/apache2 restart
  • Yes, I have them loaded. I've updated the question accordingly.
    – Karolis T.
    Jun 14, 2009 at 13:50
  • "No authoritative handler" implies that apache cannot use them for some reason.
    – Brent
    Jun 14, 2009 at 14:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.