I've got Apache 2.4 running on Windows Server 2012.

I've got mod_authnz_ldap working except if users put a blank username. This results in a 500 internal server error.

this is the entry in httpd.conf for the "staff" area...

<Location "/staff">
    AuthType Basic
    AuthName "Staff Area"
    LDAPReferrals Off
    AuthBasicProvider ldap
    AuthUserFile /dev/null
    AuthLDAPBindDN Administrator@school.com.au
    AuthLDAPBindPassword MyPassword
    AuthLDAPURL "ldap://server-dc1:389/ou=DomainUsers,dc=school,dc=com,dc=au?sAMAccountName?sub"
    Require ldap-group cn=staff,ou=staff,ou=DomainUsers,dc=school,dc=com,dc=au

Anything obvious that I'm missing? Does anyone else use mod_authnz_ldap? Does your server not like blank usernames?

  • The last two lines in my error.log are... [Mon Jan 20 11:41:43.965316 2014] [authnz_ldap:debug] [pid 2084:tid 956] mod_authnz_ldap.c(500): [client] AH01691: auth_ldap authenticate: using URL ldap://server-dc1:389/ou=DomainUsers,dc=school,dc=com,dc=au?sAMAccountName?sub [Mon Jan 20 11:41:43.965316 2014] [authnz_ldap:info] [pid 2084:tid 956] [client] AH01695: auth_ldap authenticate: user authentication failed; URI /staff/ [ldap_search_ext_s() for user failed][Filter Error] – jpgorton Jan 20 '14 at 1:04

I just had to add...

AuthLDAPBindAuthoritative off

I'm not 100% sure why this is. Perhaps something to do with mod_authnz_ldap passing the auth on to somewhere else? but it works.

Hope this helps someone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.