httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Ed Avis <...@waniasset.com>
Subject [users@httpd] Re: Confused about LDAP authentication with Active Directory
Date Thu, 26 Feb 2009 15:21:15 GMT
Davide Bianchi <davide <at> walterisookeensufferukker.nl> writes:

>><http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html> imply that
>>Apache connects to the LDAP server using a fixed username and
>>password, and then merely queries the existence of an object in the
>>directory that matches the username. If so how does it check the
>>password supplied by the user?
>
>The problem is that in order to check the password, you need to 'bind'
>to the AD server using the correct DN, in order to find the DN you need
>to query the AD server with the username. But AD doesn't allow you to
>query it without first binding.

So what happens is this:

- Apache binds using a fixed username and password.
- It then tries to look up the username given using the query expression
specified in the config file.
- Then it binds again using this username and the password supplied by the user.

Is that correct?

If so, it seems unnecessary in the case of Active Directory, since AD allows you
to bind simply giving username and password (you don't have to give a full DN
when binding).

-- 
Ed Avis <eda@waniasset.com>



---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message