3

i would like to auhenticate and authorize all users of one LDAP group (ApacheDS 2.0.0-20 on Windows, using multiple uniqueMember attributes in the group and the "Require ldap-group" statement in httpd config) for access to a web ressource.

The user which tries to authenticate is also part of this LDAP group and is authorized if i use the "Require valid-user" statement instead of "Require ldap-group" in httpd config.

Setup:

  • Linux based Apache 2.4.23 (from OpenSuse 42.1 Apache Repository)
  • LDAP: MS windows based ApacheDS 2.0.0-20

Group configuration in ApacheDS LDAP:

LDAP group configuration

Excerpt of configuration of httpd:

<AuthnProviderAlias ldap ldapconfig>
        LDAPReferrals Off
        AuthLDAPBindDN "cn=query,ou=users,o=WJWext"
        AuthLDAPBindPassword secretpassword
        AuthLDAPURL "ldap://ldap.hostname:10389/o=WJWext?uid?sub"
</AuthnProviderAlias>

...
LogLevel trace7

<Location /xy>
...
        AuthType Basic
        AuthName "xy"
        AuthBasicProvider ldapconfig
        AuthLDAPGroupAttributeIsDN on
        AuthLDAPGroupAttribute uniqueMember
        AuthLDAPMaxSubGroupDepth 0
        AuthLDAPSubGroupClass groupOfUniqueNames
        Require ldap-group cn=groupname,ou=groups,o=WJWext
...
</Location>

The log file of httpd shows that the user can be authenticated but is not authorized by group:

[Tue Nov 08 21:44:23.601378 2016] [authz_core:debug] [pid 15148] mod_authz_core.c(809): [client a.b.c.d:59427] AH01626: authorization result of Require ldap-group cn=groupname,ou=groups,o=WJWext)
[Tue Nov 08 21:44:23.601415 2016] [authz_core:debug] [pid 15148] mod_authz_core.c(809): [client a.b.c.d:59427] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
[Tue Nov 08 21:44:23.601547 2016] [authnz_ldap:debug] [pid 15148] mod_authnz_ldap.c(516): [client a.b.c.d:59427] AH01691: auth_ldap authenticate: using URL ldap://ldap.hostname:10389/o=WJWext?uid?sub
[Tue Nov 08 21:44:23.601590 2016] [authnz_ldap:trace1] [pid 15148] mod_authnz_ldap.c(537): [client a.b.c.d:59427] auth_ldap authenticate: final authn filter is (&(objectclass=*)(uid=hudson))
[Tue Nov 08 21:44:23.615090 2016] [ldap:trace5] [pid 15148] util_ldap.c(1843): [client a.b.c.d:59427] LDC 55e4b4a94070 used for authn, must be rebound
[Tue Nov 08 21:44:23.615236 2016] [authnz_ldap:debug] [pid 15148] mod_authnz_ldap.c(613): [client a.b.c.d:59427] AH01697: auth_ldap authenticate: accepting hudson
[Tue Nov 08 21:44:23.615410 2016] [authz_core:debug] [pid 15148] mod_authz_core.c(809): [client a.b.c.d:59427] AH01626: authorization result of Require ldap-group cn=groupname,ou=groups,o=WJWext:denied

What is somewhat surprising: In the log files and looking at a network traffic trace it seems that there's no search request for gathering the group membership of the user.

Is there any idea what we are doing wrong?

  • I would try first to get the desired results using ldapsearch, and then to use that filter on the apache configuration – natxo asenjo Mar 11 '17 at 9:28
  • I don't work with Apache much, but it looks like LDAP-GROUP is a component of AuthZ, and not AuthN – NonSecwitter Oct 27 '17 at 20:55
  • It's actually not very clear which specific module you're trying to use. Can you clarify? mod_authnz_ldap mod_auth_ldap mod_authn_core ? – NonSecwitter Oct 27 '17 at 20:59
  • @matt-simmons Regarding your bounty comment - what is wrong with "Require valid-user" and why to remove it? It can work together with "Require ldap-group", grouped within <RequireAll>. – sam_pan_mariusz Oct 31 '17 at 19:55
  • To clarify the things: is the user 'hudson' really a direct member of the group 'groupname'? You've disabled recursive searching with the 'AuthLDAPMaxSubGroupDepth 0'. – sam_pan_mariusz Oct 31 '17 at 19:58
1
+500

In answer to the bounty comment/request, here's the minimum Apache configuration that uses AD authentication and requires group membership, tested on RHEL 7.x which is using mod_authnz_ldap:

<Directory "/some/path/">
  AuthType Basic
  AuthName "Top Secret"
  AuthBasicProvider ldap
  AuthLDAPURL "ldaps://example.com/dc=EXAMPLE,dc=COM?sAMAccountname"
  AuthLDAPBindDN "CN=apache,OU=Accounts,DC=example,DC=com"
  AuthLDAPBindPassword "password"
  AuthLDAPMaxSubGroupDepth 0
  AuthLDAPSubGroupAttribute member
  AuthLDAPSubGroupClass group
  Require ldap-group CN=example,OU=Groups,DC=example,DC=com
</Directory>

Tweaking the AuthLDAPMaxSubGroupDepth allows me to use groups that have nested membership but when set to 0 requires my user to be an immediate member of the necessary group.

In addition to the logs the OP posted, I see this instead of the failure:

AH01697: auth_ldap authenticate: accepting user
AH01713: auth_ldap authorize: require group: testing for group membership in "CN=example,OU=Groups,DC=example,DC=com"
AH01714: auth_ldap authorize: require group: testing for member: CN=User Name,OU=Accounts,DC=example,DC=com (CN=example,OU=Groups,DC=example,DC=com)
AH01715: auth_ldap authorize: require group: authorization successful (attribute member) [Comparison true (cached)][6 - Compare True]
AH01626: authorization result of Require ldap-group CN=example,OU=Groups,DC=example,DC=com: granted
AH01626: authorization result of <RequireAny>: granted

Edit: I managed to reproduce the problem using the provider alias syntax, I believe the OP is missing an <AuthzProviderAlias ...> block. I rejigged my example config to look like this:

<AuthnProviderAlias ldap myldap>
  AuthLDAPURL "ldaps://example.com/dc=EXAMPLE,dc=COM?sAMAccountname"
  AuthLDAPBindDN "CN=apache,OU=Accounts,DC=example,DC=com"
  AuthLDAPBindPassword "password"
</AuthnProviderAlias>

<AuthzProviderAlias ldap-group ldap-group-alias "CN=example,OU=Groups,DC=example,DC=com">
  AuthLDAPURL "ldaps://example.com/dc=EXAMPLE,dc=COM"
  AuthLDAPBindDN "CN=apache,OU=Accounts,DC=example,DC=com"
  AuthLDAPBindPassword "password"
  AuthLDAPMaxSubGroupDepth 0
  AuthLDAPSubGroupAttribute member
  AuthLDAPSubGroupClass group
</AuthzProviderAlias>

<Directory "/some/path/">
  AuthType Basic
  AuthName "Top Secret"
  AuthBasicProvider myldap
  Require ldap-group-alias
</Directory>

This also works, but you end up duplicating the URL, bind DN & password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.