httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Alun Coppack" <>
Subject [users@httpd] LDAP Authentication and Subgroups/Nested groups
Date Thu, 24 Nov 2005 14:03:11 GMT
I am running Apache 2.0.50 with mod_auth_ldap

When I use the 'require group' directive, members of nested groups do not
seem to be recognised.

I am trying to authenticate using:

'require group cn=Authenticated_users,ou=Roles,dc=sample,dc=com'

This group, (Authenticated_Users) has a group called
'cn=Everyone,ou=Groups,dc=sample,dc=com' as a uniqueMember. The user jbloggs
is a member of cn=Everyone.

Apache does not seem to follow the nesting of groups since if I add jbloggs
directly as a uniqueMember of Authenticated_users everything works fine but
when jbloggs is only a member of Everyone, authentication fails.

I am just wondering what the standard, accepted way of setting up LDAP and
apache is. Am I structuring my directory incorrectly? Any help resolving
this would be appreciated.


The sample ldif is included below:

# People OU - for holding records of all individuals
dn: ou=People,dc=sample,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit

# Groups OU - for holding records of groupings of individuals
dn: ou=Groups,dc=sample,dc=com
ou: Groups
objectClass: top
objectClass: organizationalUnit

# Roles OU - for holding records of roles and the groups to which those
roles have been assigned
dn: ou=Roles,dc=sample,dc=com
ou: Roles
objectClass: top
objectClass: organizationalUnit

dn: uid=jbloggs,ou=People,dc=sample,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
sn: Bloggs
cn: Joe
uid: jbloggs
userpassword: no3XJAZeeb9AKbGNY65/masWpZE=

dn: cn=Everyone,ou=Groups,dc=sample,dc=com
objectClass: top
objectClass: groupOfUniqueNames
cn: Everyone
uniqueMember: uid=jbloggs,ou=People,dc=sample,dc=com

dn: cn=Authenticated_users,ou=Roles,dc=sample,dc=com
objectClass: top
objectClass: groupOfUniqueNames
cn: Authenticated_users
uniqueMember: cn=Everyone,ou=Groups,dc=sample,dc=com

The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:> for more info.
To unsubscribe, e-mail:
   "   from the digest:
For additional commands, e-mail:

View raw message