High there, Is it possible to mix mod_ssl and mod_auth_ldap so that the authentication is done with the client certificate and authorizations with mod_auth_ldap (Require group)? If so, can you give me some pointer? Thanks in advance
OK, for those interested, apache requires the presence of an AuthType directive and the validation of the username by some module.
So I have written a very short module that accepts AuthType Any and accepts any username.
The configuration looks like that:
<Location /slaptest> Allow from all SSLVerifyClient require SSLVerifyDepth 1 SSLUserName SSL_CLIENT_S_DN_CN AuthType Any AuthAnyAuthoritative on AuthLDAPURL "ldaps://vldap-rectech/ou=XXX,ou=YYY,o=ZZZ?cn" AuthzLDAPAuthoritative on AuthLDAPBindDN "cn=UUU,ou=Users,ou=XXX,ou=YYY,o=ZZZ" AuthLDAPBindPassword "******" AuthLDAPGroupAttributeIsDN on AuthLDAPGroupAttribute member AuthLDAPRemoteUserIsDN off Require valid-user Require ldap-group cn=ADMIN,ou=Groups,ou=XXX,ou=YYY,o=ZZZ </Location>
The following has been tested in Apache HTTP Server 2.4.29 against Windows Server 2019 Active Directory:
<VirtualHost _default_:443> SSLEngine on SSLCertificateFile /etc/ssl/private/tls_server_cert_and_key.pem SSLCACertificateFile /etc/ssl/certs/trusted_root_ca_for_client_certs.pem SSLVerifyClient require # Use the email from the succesfully authenticated client certificate to look up for the AD user. SSLUserName SSL_CLIENT_S_DN_Email <Location /> AuthBasicProvider ldap # "userPrincipalName" allows to search by the AD user email. # "(!(UserAccountControl:1.2.840.1135184.108.40.2063:=2))" filters out disabled AD users, so only active AD users are allowed to be authorized. AuthLDAPURL "ldap://<ACTIVE_DIRECTORY_IP>:3268/DC=example,DC=org?userPrincipalName?sub?(objectClass=person)(!(UserAccountControl:1.2.840.1135220.127.116.113:=2))" AuthLDAPBindDN "CN=apache-bind-user,CN=Users,DC=example,DC=org" AuthLDAPBindPassword "<apache-bind-user-password>" <RequireAll> Require ldap-group CN=Some Group,CN=Users,DC=example,DC=org </RequireAll> </Location> </VirtualHost>
PS: I'm not an expert in Apache HTTP Server or Active Directory, so the previous configuration might not be optimal/secure.