We are using Apache for LDAP Authentication for webservices defined in tomcat. Using AJP Connector for proxypass, proxyserverpass. The problem we are facing is that we are unable to retrieve User Information in tomcat application. Even though we have an attribute has been set to false like thistomcatAuthentication = false . The way we are trying to retrieve via webservice is by a login webservice which is supposed to retrieve the user information using HttpServletRequest.getRemoteUser() but I don't see any user name getting returned by this webservice which mean AJP isn't working for us I believe.

Please let me know if I can answer more specific question.

How to troubleshoot ?

Adding Configuration we have on our Apache server for the LDAP authentication as requested by Unbeliever in the comment:

<Directory "/var/lib/apache-tomcat-8.0.33/app/foo/">
#<Directory "/foo">
        AuthType Basic
        AuthName "AD Apache Login"
        AuthBasicProvider ldap
        #AuthzLDAPAuthoritative on
        AuthLDAPURL "ldap://ad.one.example.com:3268/dc=one,dc=example,dc=com?sAMAccountName?sub?(objectClass=*)"
        AuthLDAPBindDN "registration@one.example.com"
        AuthLDAPBindPassword "123456"
        Require valid-user
        Options FollowSymLinks
        Options -MultiViews
        AllowOverride None
        Order allow,deny
        Allow from all
Servername one.example.com
#ProxyPreserveHost On
ProxyPass "/app/foo" "ajp://one.example.com:8009/"
ProxyPassReverse "/app/foo" "ajp://one.example.com:8009/"
#Servername localhost
ErrorLog /var/log/httpd/ajp.error.log
CustomLog /var/log/httpd/ajp.log combined

  • Can you add the configuration you have on your Apache server for the LDAP authentication to your post? – Unbeliever Nov 25 '16 at 9:54
  • @Unbeliever Thanks for your comment. I have added the requested information. Please take a look and let me know if any other information is needed. – Dan Nov 28 '16 at 15:37

The problem here is that the basic authentication is purely between Apache and the browser, nothing (or at least very little) is passed onto any proxied resource. I should say at this point I do not have direct experience of this when use LDAP as the underlying authentication method, but certainly the problem of the REMOTE_USER not being available to a proxied resource, when using basic authentication, is not a new problem at all.

Here is a configuration snippet that you should be able to either use directly, if it is just the REMOTE_USER you need, or may be able to tailor to your own needs otherwise:

RewriteEngine On
# Use mod_rewrite to 'look ahead' and determine the REMOTE_USER variable
# And set an Environment Variable
# Set a new request header 'THE_REMOTE_USER' based on that new environment vaiable
RequestHeader set THE_REMOTE_USER "%{MY_REMOTE_USER}e"

You can then access the 'THE_REMOTE_USER' HTTP header in your proxied application.

  • For LDAP authentication.. After authentication it is directly taking to location without passproxy.. If uses </Location> it is directly taking to website without authentication... How to fix this problem – Dan Nov 30 '16 at 15:29
  • Sorry, I do not understand the question. The use of <Location> should not make any difference. – Unbeliever Dec 1 '16 at 1:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.