Mailing-List: contact bugs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache HTTPD Bugs Notification List" <bugs@httpd.apache.org>
From: bugzilla@apache.org
To: bugs@httpd.apache.org
Subject: DO NOT REPLY [Bug 47676] New: mod_authnz_ldap successful
 authorization passed through to mod_authz_groupfile
Message-ID: <bug-47676-7868@https.issues.apache.org/bugzilla/>
Auto-Submitted: auto-generated
Content-Type: text/plain; charset="UTF-8"
MIME-Version: 1.0
Date: Tue, 11 Aug 2009 08:57:24 -0700 (PDT)

https://issues.apache.org/bugzilla/show_bug.cgi?id=47676

           Summary: mod_authnz_ldap successful authorization passed
                    through to mod_authz_groupfile
           Product: Apache httpd-2
           Version: 2.2.12
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_authz_ldap
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: holger.dippel@umassd.edu


--- Comment #0 from Holger Dippel <holger.dippel@umassd.edu> 2009-08-11 08:57:22 PDT ---
I am attempting to use a combination of CAS, LDAP, and local group files for
authentication and authorization.

mod_auth_cas (from JSIG) is loaded dynamically, mod_ldap, mod_authnz_ldap,
mod_authz_groupfile are compiled into our custom build of Apache.

The .htaccess file looks like this:

AuthType CAS
AuthName "Auth Test"
AuthGroupFile /path/to/groupfile/.groups
AuthLDAPUrl ldap://...?uid?sub
AuthzLDAPAuthoritative off
Require ldap-user userone
Require group testing

The .groups file looks like this:

testing: usertwo

CAS authentication is successful for both users, but userone is denied access
with a 401 Authorization Required. The error log says:

"Authorization of user userone to access ... failed, reason: user doesn't
appear in group file (/path/to/groupfile/.groups)"

usertwo is granted access without any problems based on the group file
authorization.

I've tried adding filters to the AuthLDAPUrl directive, and different Require
ldap-... directives, with and with out a Satisfy Any, but this behavior is
consistently the same.

The mod_authnz_ldap documentation seems to indicate under the
AuthzLDAPAuthoritative directive that authorization is only passed to a
lower-level module (mod_authz_groupfile in this case) if it fails with LDAP.

The actual behavior is that it is always passed on.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org