1

I configured apache2.2 (CentOS 5.6) to provide ldap authentication with Active Directory.

<Directory "/var/www/html">

        AuthType Basic
        AuthName "Authenticate with domain account."
        AuthBasicProvider ldap
        AuthzLDAPAuthoritative on
        AuthLDAPBindDN cn=Administrator,cn=users,dc=example,dc=com
        AuthLDAPBindPassword secret
        AuthLDAPURL ldap://192.168.56.110:389/dc=example,dc=com?sAMAccountName?sub?(objectClass=*)
        Require valid-user
        ...
</Directory>

It works, but it takes far too long. I analyzed the traffic with tcpdump.. the timestamps show exactly four minutes between the searchResEntry (when Active Directory respond with the DN of the user account I'm trying to log in) and the bindRequest (when apache try to bind as the requested user).

Here is the error_log output for this:

[Sat Dec 10 07:06:37 2011] [debug] mod_authnz_ldap.c(390): [client 192.168.56.1] [2488] auth_ldap authenticate: using URL ldap://192.168.56.110:389/dc=example,dc=com?sAMAccountName?sub?(objectClass=*)

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(489): [client 192.168.56.1] [2488] auth_ldap authenticate: accepting peter

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(971): [client 192.168.56.1] [2488] auth_ldap authorise: declining to authorise

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(390): [client 192.168.56.1] [2475] auth_ldap authenticate: using URL ldap://192.168.56.110:389 dc=example,dc=com?sAMAccountName?sub?(objectClass=*), referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(489): [client 192.168.56.1] [2475] auth_ldap authenticate: accepting peter, referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(971): [client 192.168.56.1] [2475] auth_ldap authorise: declining to authorise, referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [error] [client 192.168.56.1] File does not exist: /var/www/html/projeto/style.css, referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(390): [client 192.168.56.1] [2475] auth_ldap authenticate: using URL ldap://192.168.56.110:389/dc=example,dc=com?sAMAccountName?sub?(objectClass=*), referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(489): [client 192.168.56.1] [2475] auth_ldap authenticate: accepting peter, referer: http://192.168.56.200/projeto/

[Sat Dec 10 07:10:37 2011] [debug] mod_authnz_ldap.c(971): [client 192.168.56.1] [2475] auth_ldap authorise: declining to authorise, referer: http://192.168.56.200/projeto/

As you can see, it takes four minutes between the first and the second line.

Any clue?

Ps. Here is a link to the tcpdump capture displayed with wireshark. As you can see, Active Directory responds instantaneously. What takes too long is the bindRequest from apache (highlighted in the image).

1 Answer 1

2

im going to guess its your ldap query have you tried running that query directly from the the command line using ldap-search

from the looks of your filter:

ldap://192.168.56.110:389/dc=example,dc=com?sAMAccountName?sub?(objectClass=*)

thats a very broad search, what thats actually doing is searching from the base dc=example,dc=com for every record to see if it has an attribute called sAMAccountName, depending on how many entries you have in that tree this could take some time

your better off changing it to something like:

ldap://192.168.56.110:389/ou=People,dc=example,dc=com?sAMAccountName?one?(objectClass=*)

but verify your results using ldap-search utilities first

2
  • (objectClass=*) goes though all Active Directory catalog. Try using (objectClass=user) and, if possible, search in single OU or members of single group: (memberOf=CN=somegroup,OU=Users,DC=example,DC=com) Dec 13, 2011 at 5:12
  • The search works fine in the command line. As I said, it takes four minutes to apache try to bind with the user DN returned by the search - apache waits four min AFTER Active Directory's instantaneous response. I'll post a link to a wireshark screen shot..
    – beradero
    Dec 13, 2011 at 11:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .