1

Using Apache 2.2.14 on Ubuntu 10.04, I am trying to protect a folder with LDAP authentication. Our LDAP server is running Novell eDirectory.

All our users are in subgroups of ou=Users,ou=Directory,o=IC. Like this:

  • ou=Managers,ou=Users,ou=Directory,o=IC
  • ou=Employees,ou=Users,ou=Directory,o=IC
  • ou=Misc,ou=Users,ou=Directory,o=IC
  • ou=Outsiders,ou=Users,ou=Directory,o=IC

I want all of ou=Users,ou=Directory,o=IC to be able to access my folder, except those in ou=Outsiders,ou=Users,ou=Directory,o=IC.

I can get into my folder with my LDAP log in information using the following settings, but it doesn't block users in the Outsiders group:

AuthName "Login Required: please enter your L-number and PIN"
AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthLDAPURL ldaps://ldap.example.com/ou=Users,ou=Directory,o=IC?cn?sub?(objectclass=Person)
Require ldap-filter (|(cn=*,ou=Managers,ou=Users,ou=Directory,o=IC)(cn=*,ou=Employees,ou=Users,ou=Directory,o=IC)(cn=*,ou=Misc,ou=Users,ou=Directory,o=IC))
AuthLDAPBindDN cn=binder,ou=Admin,ou=Directory,o=IC
AuthLDAPBindPassword password

I've tried:

  • Require valid-user
  • Various AuthLDAPURLs
  • Require ldap-group for only the groups I want.
  • Other searches for the Require ldap-filter, like not having "cn=*" in it.

Everything either doesn't let me in, throws a 500 error, or lets members of ou=Outsiders,ou=Users,ou=Directory,o=IC in.

So, how do I keep members of ou=Outsiders,ou=Users,ou=Directory,o=IC out of my folder?

0

Assuming that I have 2 groups with following structure:

dn: ou=IT,dc=domain,dc=com
ou: IT
objectClass: top
objectClass: organizationalUnit

dn: cn=bob,ou=IT,dc=domain,dc=com
cn: bob
sn: Bob
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
userPassword:: xx
...

dn: ou=HR,dc=domain,dc=com
ou: HR
objectClass: top
objectClass: organizationalUnit

dn: cn=alice,ou=HR,dc=domain,dc=com
cn: alice
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
userPassword:: xx
...

You can list all users either in IT or in HR department by executing:

$ ldapsearch -W -x -D "cn=binder,dc=domain,dc=com" \
    '(&(|(ou:dn:=IT)(ou:dn:=HR))(cn=*))'

So, you should try with ldapsearch from the command line first:

$ ldapsearch -W -x -D "cn=binder,ou=Users,ou=Directory,o=IC" \
    '(&(|(ou:dn:=Managers)(ou:dn:=Employees)(ou:dn:=Misc))(cn=*))'

If it work, edit the mod_authz_ldap configuration file as belows:

Require ldap-filter &(|(ou:dn:=Managers)(ou:dn:=Employees)(ou:dn:=Misc))(cn=*)
  • Thanks! Require ldap-filter &(|(ou:dn:=Managers)(ou:dn:=Employees)(ou:dn:=Misc))(cn=*) worked. – David R. Nov 9 '11 at 23:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.