I have a LAMP server setup using Apache2, mod_php, and mod_authnz_ldap to authenticate to Active Directory. This hosts a lightweight php application where users enter and manipulate data. Access is based on 'require ldap-group ...' directives, and a number of groups are valid.
We now need to add access for an additional group, but their access must be 'read-only'. In this case, we need to determine at the application level what group a user is in, and disable certain functions based on that group membership. The application is php, so something php can access easily is ideal.
The ideal solution:
The AD group name apache has used to grant access can easily be exposed to the application, similar to how
Solutions I'd like to avoid:
1. Accessing ldap through a php module
We are already authenticating via apache, so this creates unnecessary duplication, extra work to implement, and additional maintenance overhead (one more bind URL to change). Doable, but it's a pain.
2. Modifying the AuthLDAPURL
Again, requires we deviate from our standards just for this host, and maintain that going forward. Doable, but a slightly smaller pain. Adding other ldap directives or vhost changes however, would be trivial to do.
3. Adding a duplicate Vhost with more limited access
This actually seems like the best idea, however it would require we publish a new URL for the new group, which is a bad user experience and might possibly be rejected flat-out.
4. SQL based authentication
So much extra overhead that it's completely not viable for this case. (And technically wouldn't answer the question anyway).