GSuite LDAP Authentication from Apache 2.4 User not found

Question

We've just started looking at migrating some of our applications' authentication over to GSuite's Secure LDAP. I've gone through their setup instructions, and have it working through ldapsearch. But when I setup ldap auth in my apache config, no matter what it comes back with a [User not found][No such object] error.

I'm not great with LDAP configurations, so apologies if there's something glaringly wrong. I'm just wondering if anyone on here has gotten apache to authenticate with Secure LDAP and if there's just some dumb gotcha I'm missing.

Everything works fine with ldapsearch:

~$ ldapsearch -H ldaps://ldap.google.com -b dc=domain,dc=com"(&(objectclass=posixAccount)(uid=test_user))"
SASL/EXTERNAL authentication started
SASL username: st=California,c=US,ou=GSuite,cn=LDAP Client,l=Mountain View,o=Google Inc.
SASL SSF: 0
# extended LDIF
#
# LDAPv3
# base <dc=domain,dc=com> with scope subtree
# filter: (&(objectclass=*)(uid=test_user))
# requesting: ALL
#

# test_user, Users, domain.com
dn: uid=test_user,ou=Users,dc=domain,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
... etc ...

But when I try logging into an apache site using mod_ldap with this configuration:

<LocationMatch "/folder/">
    AuthType Basic
    AuthName "TestSite"
    AuthBasicProvider ldap

    AuthLDAPUrl "ldaps://ldap.google.com/dc=domain,dc=com?uid"        
    Require valid-user

    # Client auth
    LDAPTrustedClientCert KEY_BASE64 ***FILE.key
    LDAPTrustedClientCert CERT_BASE64 ***FILE.crt
</LocationMatch>

I end up with a missing object error:

[authnz_ldap:debug] mod_authz_core.c(809): AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
[authnz_ldap:debug] mod_authnz_ldap.c(523): [client ***:38544] AH01691: auth_ldap authenticate: 
    using URL ldaps://ldap.google.com/dc=domain,dc=com?uid
....
[authnz_ldap:trace1] mod_authnz_ldap.c(544): [client ***:38544] auth_ldap authenticate: final authn filter is (&(objectclass=*)(uid=test_user))
....
[authnz_ldap:info] [client ****:38544] AH01695: auth_ldap authenticate: user test_user authentication failed; 
    URI /folder/site [User not found][No such object]
[auth_basic:error] [client ***:38544] AH01618: user test_user not found: /folder/site

Given that the posixUser is definitely there, and I feel like I've setup the LDAP application correctly, I'm thinking the error has to be on the apache config side of things. Anyone have any suggestions on things to try next?

Answer 1

So I was able to get this to work by using stunnel and user/pass auth.

<LocationMatch "/folder/">
    AuthType Basic
    AuthName "TestSite"
    AuthBasicProvider ldap

    AuthLDAPUrl "ldaps://localhost:1636/dc=domain,dc=com?uid"  
    AuthLDAPBindDN <USER>
    AuthLDAPBindPassword <PASSWORD>  
    Require valid-user
</LocationMatch>

and an stunnel config of

[ldap]
client = yes
accept = 0.0.0.0:16360
connect = ldap.google.com:636
cert = ldap.crt
key = ldap.key

However, I'm seeing that group authorization is not working correctly and I'm getting a protocol error. To limit access to specific groups; I'm doing the following.

AuthLDAPUrl "ldaps://localhost:1636/dc=domain,dc=com?uid?sub?(memberOf=<GROUP>,ou=Groups,dc=domain,dc=com)"