I have a server that currently uses htpasswd to authenticate users. I'm migrating to using LDAP, but my LDAP server is only for user authentication, not allowing me to add groups.

I still need to use groups as they are used for access control via the Apache Directory tags in my configuration. The alternative is to revisit the access control altogether, using php or something of the sort to limit access.

this works for 'basic' authentication

<Directory /misc/www/html/site>
#LDAP & other config stuff irrelevant to issue

Require ldap-group cn=<service>,ou=Groups,dc=<service>,dc=<org>,dc=com


<Directory /misc/www/html/site>
#LDAP & other config stuff irrelevant to issue

#groups file from previous configuration using htpasswd 
#tried to tweak to match new user format, but I don't think it looks up in here
AuthGroupFile   /misc/www/htpasswd/groups

#added the group, which is how it works when using htpasswd
Require ldap-group cn=<service>,ou=Groups,dc=<service>,dc=<org>,dc=com group xyz
  • Why is your server not allowing you to add groups? This is a basic function of any LDAP server. – user207421 Dec 14 '12 at 21:20
  • I am looking into that possibility, but the LDAP server is typically used where the Access Control is in the app and LDAP is simply providing the authentication. – Greg Ogle Dec 17 '12 at 17:33

As @EJP points out, the best solution would be to put the groups in LDAP. To answer your question, though, you could join the machine to the LDAP server so that LDAP accounts are OS users. Then you could put the users in OS groups (i.e., /etc/group on Unix) and use mod_authz_unixgroup.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.