So I'm trying to get apache 2.4 talking to active directory running on a freebsd box with 10.x

apache built from ports ... with the ldap turned on.... 2.4.12

Windows 2012 R2 active directory.... I checked the ldap ssl is not required by the default domain controllers GPO.

I've confirmed the group name listed in the config in ADSIEdit, and checked out the user that I'm connecting with....

Here's the config samples:

ServerAdmin administrator@domainname.com
ServerName hg.domainname.com
ServerAlias www.hg.domainname.com
ScriptAlias /hg  /usr/local/www/mercurial/hgweb.cgi
ErrorLog "/var/log/hg-http-error.log"
CustomLog "/var/log/hg-http-access.log" common
<Location /hg>
Options Indexes ExecCGI FollowSymlinks
AddHandler cgi-script .cgi .fcgi
    AllowOverride All

  Order allow,deny
  Allow from all
#Rem'd part of initial no auth testing
    #Require all granted
  AuthType Basic
  AuthName "Please use your Windows Logon"
  AuthBasicProvider ldap
  AuthzLDAPAuthoritative off
  # Active Directory requires an authenticating DN to access records
  AuthLDAPBindDN "[activedirectoryid]@domainname.com"

  # This is the password for the AuthLDAPBindDN user in Active Directory
  AuthLDAPBindPassword "[somepasswordthatworks]"

  # The LDAP query URL
  AuthLDAPURL "ldap://ldap.domainanme:3268/?userPrincipalName?sub"
  AuthUserFile /dev/null

  # Require a valid user
    AuthLDAPGroupAttribute member
    AuthLDAPCompareAsUser On
    Require ldap-group CN=mercurial,CN=Users,DC=tangent-animation,DC=com

When I go to try to logon with a user who's a member of the group, I either get in the httpd logs:

[Thu Jul 09 10:04:25.659371 2015] [authz_core:error] [pid 67495] [client] AH01631:

Or and error AH01618

Either way it's been driving me nuts for the last couple of days....

I tried to add the additional auth section to a site listed in the httpd.conf, instead of the vhosts, just in case I had something wrong in the vhosts file. But it still doesn't work, it does give me a server 500 error though. But the logs don't have anything in specific to point to.

I've googled, everything I can think of, and I've tried looking from the windows angle and the apache side. All the apache documentation or the info I've seen lists basically the same setup with either the ldap config lines pointing to the 389 port or the GC port.... and with either the samaccountname, or userprinciple....

On the same server, I do have samba4.1 working nicely and connected as a domain member.... and the file access/kerberos, etc are all working fine.

Also if I remove the auth ldap stuff, and just have it completely open the site works fine, so it's definitely something in the auth configuration.

Basically I'm stumped..... Thoughts on the obvious things to try?



Got it working with some assistance.....

So the majority of the users are stored in another OU, so even though I'm sure that I tried it, the search string (ldap:// needed to have just dc=domain, and not limit it to the cn=Users

 AuthName "Dialog-box-name"
 AuthType "Basic"
AuthBasicProvider ldap
AuthLDAPURL ldap://[AD-Server-Hostname.FQDN]:3268/dc=[domain],dc=com?sAMAccountName?sub?(objectCategory=*)
  AuthLDAPBindDN cn=[ad-search-user-account],cn=Users,dc=[domain],dc=com
 AUthLDAPBindPassword [Insert-Working-Password-here]
 #AuthLDAPAuthoritative on
 #AuthLDAPGroupAttributeIsDN off
 Require ldap-group CN=[GroupName-your-using],CN=Users,DC=domain,DC=com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.