Apache Authentication / LDAP Group based on URL

Question

I'm working on LDAP authentication for Apache2 HTTPD, and was wondering if it's possible to get Apache to authenticate to LDAP based on groups, but also depending on the URL that is provided. For example, if a user requests the following:

http://www.example.com/<a group name>/

Apache would request credentials and check against an LDAP directory service (OpenLDAP), to ensure that the user belongs to the "<a group name>" group. In essence, the user should be able to request any arbitrary resource, and Apache should be able to take the URL, extract the specific resource being requested, and ensure that the user belongs to a group by that same name.

I couldn't find any relevant information regarding extracting information from a URL request and processing that inside the Apache configuration files. Has anyone done something similiar to this?

Answer 1

While I haven't done exactly what you are asking, I'm relatively sure it is possible. At my work, we use LDAP authn/authz against an ActiveDirectory server.

You set up Apache to authenticate against LDAP by configuring a Location tag with the various AuthLDAP directives. A simple example using sAMAccountName against AD:

<Location /secured>
   AuthType Basic
   AuthzLDAPAuthoritative on
   AuthUserFile /dev/null
   AuthName "Authorization required"
   AuthBasicProvider ldap
   AuthLDAPURL "ldap://ldap.example.com/ou=MyOrg,dc=myDC,dc=myDC?sAMAccountName?sub?(objectClass=*)"
   AuthLDAPBindDN "ldapQueryUser"
   AuthLDAPBindPassword "ldapQueryPassword"
   require valid-user
</Location>

It seems like you should be able to set up locations for each of your <a group name> groups, each using a different LDAP query:

<Location /group_A>
    AuthSetups blah blahblah
    AuthLDAPURL "ldap://ldap.example.com/ou=MyOrg,dc=group_A?..."
</Location>

<Location /group_B>
    AuthSetups blah blahblah
    AuthLDAPURL "ldap://ldap.example.com/ou=MyOrg,dc=group_A?..."
</Location>

In working with Apache and LDAP, I found that it was best to work out the query that would return users correctly before trying to integrate it into Apache. My errors turned out to be LDAP errors almost every time, so getting the query right made the apache authn/z part easy.

Answer 2

You could use Virtual Hosts to that match against Locations, whether via Location or LocationMatch.

Here's an example that's been updated for Apache 2.4 and is run on a Windows 2012 Server that queries ActiveDirectory (Focus on the LocationMatch section):

<VirtualHost *:80>
 WSGIScriptAlias /bloodhound C:/apache/bloodhound/installer/bloodhound/site/cgi-bin/trac.wsgi
<Directory C:/apache/bloodhound/installer/bloodhound/site/cgi-bin>
      WSGIApplicationGroup %{GLOBAL}
      Require all granted
      <Files trac.wsgi>
        Require all granted
    </Files>
 </Directory>
 LogLevel debug
 <LocationMatch "/bloodhound/([^/]+/)?login">
      AuthLDAPURL "ldap://<HOST_NAME>:3268/<SEARCH_BASE>?sAMAccountName?sub?(objectClass=user)"
      AuthLDAPBindDN "<BIND_DN>"
      AuthLDAPBindPassword "<PASSWORD>"
      LDAPReferrals Off

      AuthType Basic
      AuthName "Bloodhound - Please Provide Your Credentials"
      AuthBasicProvider ldap
      #If you want to use an LDAP Filter, 
      #uncomment the following and use instead of the ldap-group and subsequent config
      #Require ldap-filter memberof:1.2.840.113556.1.4.1941:=<GROUP_DN>
      Require ldap-group <GROUP_DN>
      AuthLDAPMaxSubGroupDepth 1
      AuthLDAPSubgroupAttribute member
      AuthLDAPSubGroupClass group
      AuthLDAPGroupAttribute member
      AuthLDAPGroupAttributeIsDN on
 </LocationMatch>

The alternative is to go with what @khoxsey suggested. However, you can use LocationMatch instead of Location if that suits your needs better.