4

High there, Is it possible to mix mod_ssl and mod_auth_ldap so that the authentication is done with the client certificate and authorizations with mod_auth_ldap (Require group)? If so, can you give me some pointer? Thanks in advance

1
3

OK, for those interested, apache requires the presence of an AuthType directive and the validation of the username by some module.

So I have written a very short module that accepts AuthType Any and accepts any username.

The configuration looks like that:

<Location /slaptest>
    Allow from all
    SSLVerifyClient require
    SSLVerifyDepth 1

    SSLUserName SSL_CLIENT_S_DN_CN

    AuthType Any
    AuthAnyAuthoritative on

    AuthLDAPURL "ldaps://vldap-rectech/ou=XXX,ou=YYY,o=ZZZ?cn"
    AuthzLDAPAuthoritative on
    AuthLDAPBindDN "cn=UUU,ou=Users,ou=XXX,ou=YYY,o=ZZZ"
    AuthLDAPBindPassword "******"
    AuthLDAPGroupAttributeIsDN on
    AuthLDAPGroupAttribute member
    AuthLDAPRemoteUserIsDN off
    Require valid-user
    Require ldap-group cn=ADMIN,ou=Groups,ou=XXX,ou=YYY,o=ZZZ
</Location>
0

The following has been tested in Apache HTTP Server 2.4.29 against Windows Server 2019 Active Directory:

<VirtualHost _default_:443>
    SSLEngine on
    SSLCertificateFile /etc/ssl/private/tls_server_cert_and_key.pem
    SSLCACertificateFile /etc/ssl/certs/trusted_root_ca_for_client_certs.pem
    SSLVerifyClient require
    # Use the email from the succesfully authenticated client certificate to look up for the AD user.                                                         
    SSLUserName SSL_CLIENT_S_DN_Email
    <Location />
        AuthBasicProvider ldap
        # "userPrincipalName" allows to search by the AD user email.
        # "(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" filters out disabled AD users, so only active AD users are allowed to be authorized.
        AuthLDAPURL "ldap://<ACTIVE_DIRECTORY_IP>:3268/DC=example,DC=org?userPrincipalName?sub?(objectClass=person)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))"
        AuthLDAPBindDN "CN=apache-bind-user,CN=Users,DC=example,DC=org"
        AuthLDAPBindPassword "<apache-bind-user-password>"
        <RequireAll>
            Require ldap-group CN=Some Group,CN=Users,DC=example,DC=org
        </RequireAll>
    </Location>
</VirtualHost>

PS: I'm not an expert in Apache HTTP Server or Active Directory, so the previous configuration might not be optimal/secure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.