2

I'd like to set up different LDAP authorization rules for different levels of an URL. This is the config currently used

    <Location />
            AuthType Basic
            AuthName "Foo"
            AuthBasicProvider ldap
            AuthLDAPURL "..."
            AuthLDAPBindDN  "..."
            AuthLDAPBindPassword "..."
    </Location>

    <Location />
            Require ldap-group cn=foo,ou=Groups,dc=com,dc=company
    </Location>

    <Location /path/>
            Require ldap-user bar
    </Location>

The problem is that /path/ inherits the rules from /. Hence for user bar to be able to access /path/ he must also be in the foo group.

How can I configure the user bar to be able to access /path/ without also having to be a member of group foo?


EDIT: Changed ldap-group to ldap-user for /path/ for an accurate problem description.

2
  • Mm ... try placing more specific ones first, i.e., /path/ and the main one / last in the list ... ? Unsure if it will work, but worth a try ...
    – KM.
    Feb 21, 2012 at 14:21
  • @km01, I tried that also without success Feb 21, 2012 at 15:20

2 Answers 2

1

I had the same issue, and by seeking around, I found the apache directive AuthMerging which handles such situation.

The documentation says that the default is AuthMerging Off (last authorization is the only one), but the above described effect seems to imply that the value is And (last authorization restricts the previous one). The other possibility is Or (last authorization extends the previous one). In my case, this is this Or value that I wanted, and it worked when adding the Auth;Merging Or directive inside the lower Location level.

Maybe the default value is different for Directory and Location sections, but I didn't find anything about that.

0

My understanding (and I just struggled to find solid supporting documentation) is that Location directives are cumulative, so you're essentially applying two Require directives. What if you did something like this:

<LocationMatch "/[^path]">
    Require ldap-group cn=foo,ou=Groups,dc=com,dc=company
</Location>

<Location /path/>
    Require ldap-group cn=bar,ou=Groups,dc=com,dc=company
</Location>

You'll have to check if that regular expression is apache-compatible, but I believe this approach will work.

6
  • If that is a regular expression, then it will not do what you think! That expression matches anything that starts with a / not followed by any of the letters p, a, t, or h - thus it will reject /path but it will also reject /acct and /home.
    – Mei
    Feb 21, 2012 at 15:35
  • Hm, you're right. A regexp for ! /path would be more complicated, but possible.
    – Kyle Smith
    Feb 21, 2012 at 15:40
  • I can't seem to find a straight regexp for "don't match this string." I've tried sed and perl to no avail. In particular, these fail: /[^p][^a][^t][^h] and /(path){0,0}. Neither works. Is the only possibility to use a "don't match this regexp"?
    – Mei
    Feb 21, 2012 at 15:51
  • It's ugly, but this works (at least in ruby -ne): /^\/[^p]{1}[^a]{1}[^t]{1}[^h]{1}/. Would be nice if there was a LocationNotMatch directive :)...
    – Kyle Smith
    Feb 21, 2012 at 15:58
  • What would that regex do with /pathworks? Methinks it would treat it just the same as /path, yes?
    – Mei
    Feb 21, 2012 at 16:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .