I am configuring Apache to authenticate against LDAP and require multiple groups to be present. I have done this with require statements, however I need the authentication to be successful if all groups are there and not just one. How do I tell Apache to go through all require statements?
3 Answers
You cold try the "Satisfy" apache directive, e.g.: satisfy all.
Otherwise you could modify your filter to require the groups, e.g. (&(ou=foo)(ou=bar))
"Satisfy" won't work here because that only governs the interaction between "allow" and "require", not between multiple "require" directives.
If your LDAP has memberOf attributes (you can enable those with the memberof overlay in OpenLDAP), you can use "require ldap-filter" to require membership in more than one group.
Unfortunately, memberOf doesn't replicate reliably as of OpenLDAP 2.4.31, so don't rely on it if you also use syncrepl.
If you are using an ldap service that supports nested groups, you could create another group that contains the required groups, then have apache reference that group instead. Then when updating any of the original groups, the nested group is automatically updated.
This may not be an option for you, however.