So I'm trying to get apache 2.4 talking to active directory running on a freebsd box with 10.x
apache built from ports ... with the ldap turned on.... 2.4.12
Windows 2012 R2 active directory.... I checked the ldap ssl is not required by the default domain controllers GPO.
I've confirmed the group name listed in the config in ADSIEdit, and checked out the user that I'm connecting with....
Here's the config samples:
vhosts.conf <VirtualHost 10.1.1.10:80> ServerAdmin firstname.lastname@example.org ServerName hg.domainname.com ServerAlias www.hg.domainname.com ScriptAlias /hg /usr/local/www/mercurial/hgweb.cgi ErrorLog "/var/log/hg-http-error.log" CustomLog "/var/log/hg-http-access.log" common <Location /hg> Options Indexes ExecCGI FollowSymlinks AddHandler cgi-script .cgi .fcgi AllowOverride All Order allow,deny Allow from all #Rem'd part of initial no auth testing #Require all granted AuthType Basic AuthName "Please use your Windows Logon" AuthBasicProvider ldap AuthzLDAPAuthoritative off # Active Directory requires an authenticating DN to access records AuthLDAPBindDN "[activedirectoryid]@domainname.com" # This is the password for the AuthLDAPBindDN user in Active Directory AuthLDAPBindPassword "[somepasswordthatworks]" # The LDAP query URL AuthLDAPURL "ldap://ldap.domainanme:3268/?userPrincipalName?sub" AuthUserFile /dev/null # Require a valid user AuthLDAPGroupAttribute member AuthLDAPCompareAsUser On Require ldap-group CN=mercurial,CN=Users,DC=tangent-animation,DC=com
When I go to try to logon with a user who's a member of the group, I either get in the httpd logs:
[Thu Jul 09 10:04:25.659371 2015] [authz_core:error] [pid 67495] [client 10.1.1.2:50371] AH01631:
Or and error AH01618
Either way it's been driving me nuts for the last couple of days....
I tried to add the additional auth section to a site listed in the httpd.conf, instead of the vhosts, just in case I had something wrong in the vhosts file. But it still doesn't work, it does give me a server 500 error though. But the logs don't have anything in specific to point to.
I've googled, everything I can think of, and I've tried looking from the windows angle and the apache side. All the apache documentation or the info I've seen lists basically the same setup with either the ldap config lines pointing to the 389 port or the GC port.... and with either the samaccountname, or userprinciple....
On the same server, I do have samba4.1 working nicely and connected as a domain member.... and the file access/kerberos, etc are all working fine.
Also if I remove the auth ldap stuff, and just have it completely open the site works fine, so it's definitely something in the auth configuration.
Basically I'm stumped..... Thoughts on the obvious things to try?