1

have a problem here. I have a domain (AD), i need to login SVN users via AD.

  • DC: 10.20.3.30
  • Svn server is on freebsd and it's not in domain
  • Apache 2.4
  • AD read user: "svnr" in OU SVN.
  • Svnr user tested and can login into domain.
  • Apache loaded modules: mod_ldap, mod_authnz_ldap, mod_authz_svn, mod_dav_svn
  • At the same server lighsquid reading users from AD via NET::LDAP.

Svn works with file auth. just fine. If i try to login with any domain user it rejects and apache logs shows "Password mismatch".

httpd-vhosts.conf  

<VirtualHost *:80>
ServerAdmin mail@domain.ru
DocumentRoot "/usr/local/www/svn"
ServerName svn
ServerAlias svn.domain.ru
ErrorLog "/var/log/svn.error.log"
CustomLog "/var/log/svn.access.log" common
<Location />
DAV svn
SVNParentPath /usr/local/www/svn
SVNListParentPath on
AuthType Basic
AuthName "SVN Server"
AuthBasicProvider ldap
AuthLDAPURL "ldap://10.20.3.30:389/DC=domain,DC=ru?sAMAccountName?sub?(objectClass=*)" NONE
AuthLDAPBindDN "CN=svnr,OU=SVN,DC=domain,DC=ru"
AuthLDAPBindPassword 123
Require valid-user
</Location>
</VirtualHost> 

If i try to use ldapsearch i get this:

ldapsearch -h 10.20.3.30 -D "CN=svnr,OU=SVN,DC=domain,DC=ru" -b "dc=domain,dc=ru" -x -W
Enter LDAP Password:
ldap_bind: Invalid credentials (49)
        additional info: 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1 

Debug of ldapsearch -d5 http://pastebin.com/myP0Y88m

Thanks for help!


Ok i made it, i changed AuthLDAPBindDN from CN=svnr,OU=SVN,DC=domain,DC=ru to svnr@domain.ru and it works, i have no idea why previous configuration not working, if you explain me i will be grateful.

  • the error is clear, your ldap bind user/bind combination is wrong (49, invalid credentials). So please verify the password of cn=svnr,ou=svn,dc=domain,dc=ru – natxo asenjo Sep 27 '16 at 18:39
  • Checked few times, also checked with 2 other users. I put them at root and use cn=user,dc=domain,dc=ru but still get same error. – Archiba Sep 28 '16 at 5:08
  • changing the dn is not going to solve your problem unless you know exactly what the correct one is ..., and combine it with the correct pasword. It sounds like you do not have administrative access to the AD, get in touch with your administrator and ask him/her what the correct dn is for the svn user, and verify its password. – natxo asenjo Sep 28 '16 at 5:46
  • you are now using the upn attribute, and that is another way to do it. – natxo asenjo Sep 28 '16 at 18:06
  • In order to find out what the cn is, you could now use something like this: ldapsearch -h 10.20.3.30 -D svnr@domain.ru -W -b dc=domain,dc=ru -W "samaccountname=svnr" -LLL cn and see what you get back – natxo asenjo Sep 28 '16 at 18:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.