0

I'm trying to setup an Apache web server that only allows access to users that are in an LDAP store. I am able to setup exactly what I want on my local Windows 7 machine using Apache 2.2.21 against the LDAP server. After trying to login through the prompt, the Linux version displays a 500 error page.

To setup the Apache on CentOS I ran the below commands:

yum install httpd mod_ssl mod_authz_ldap

I made sure that

LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so

were both uncommented in /etc/httpd/conf/httpd.conf.

My <Directory/> is the same between my Windows and Linux httpd.conf (except for the DocumentRoot of course)

AuthName "Login with email address"
AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative off
AuthLDAPURL ldap://ldap.sample.org:1389/ou=Users,dc=sample,dc=org?uid?sub
AuthLDAPBindDN "cn=Directory Manager"
AuthLDAPBindPassword ldappassword
Require valid-user

Options Indexes FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all

(note: our LDAP server is serving on port 1389.)

The /var/log/httpd/error_log from Apache on the Linux machine shows:

[Fri Dec 23 08:17:20 2011] [warn] [client 192.168.1.113] [8181] auth_ldap authenticate: user foo authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Can't contact LDAP server]

I can telnet to the LDAP port from both the Windows and Linux machines. As I mentioned before, the Windows version is working exactly as expected.

One thing I did notice between the Windows version and the Linux version of Apache httpd.conf is the Linux version has almost all the modules enabled by default while the Windows version has most of them commented out which leads me to believe that there could possibly be a module conflict.

Does anyone have any ideas?

Thanks!

Improve this question
4
  • The only that that looks "off" there to me is the bind DN - I've always given that the full distinguished name for the bind user, maybe try that?
    – Shane Madden
    Dec 23, 2011 at 20:01
  • We are using OpenDS on our LDAP server so as far as I can tell, "cn=Directory Manager" is the full DN. What's odd though is that the Windows Apache likes the bindDN. I'll do some more research to see if I can find a complete default bindDN for OpenDS. Thanks.
    – jrose
    Dec 23, 2011 at 20:15
  • 2
    I decided to change my SELinux settings on CentOS from "Enforcing" to "Permissive" and it works now. When I find the appropriate rule for SELinux I'll post it back here.
    – jrose
    Dec 23, 2011 at 21:04
  • 1
    Nice! Feel free to post it as an answer, for any future searchers that run into the same issue.
    – Shane Madden
    Dec 23, 2011 at 22:02

1 Answer 1

Reset to default
2

It turns out that SELinux was blocking Apache's connection to LDAP. Running the command:

grep -m 1 httpd /var/log/audit/audit.log | audit2why

I was able to find out that Apache was trying to connect to a port that SELinux didn't recognize. After following suggestions from this site and the CentOS/SELinux documentation I was able to reach a solution. My troubles were caused by the use of non-standard LDAP port (as recommended by OpenDS). By adding these ports to SELinux under "ldap_port_t" I was able to resolve the issue. As root (or "sudo") run the below commands replacing the port numbers with your own LDAP/LDAPS port numbers.

semanage port -a -t ldap_port_t -p tcp 1389
semanage port -a -t ldap_port_t -p tcp 8636
semanage port -a -t ldap_port_t -p udp 1389
semanage port -a -t ldap_port_t -p upd 8636

I hope this helps someone in the future from banging their head against the wall as much as I did.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .