httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Tony Rice (trice)" <tr...@cisco.com>
Subject RE: [users@httpd] group authorization via LDAP
Date Fri, 02 Oct 2009 14:36:42 GMT
Is our only choice changing all the .htaccess files with "require group
<group name>" to "require ldap-group cn=<group name>,ou=some long ldap
string" in order to make the switch group authorization via LDAP groups?

-Tony


> -----Original Message-----
> From: Tom Evans [mailto:tevans.uk@googlemail.com]
> Sent: Friday, October 02, 2009 4:36 AM
> To: users@httpd.apache.org
> Subject: Re: [users@httpd] group authorization via LDAP
> 
> On Thu, 2009-10-01 at 17:18 -0400, Tony Rice (trice) wrote:
> > I'm trying to convert from DBM file based authentication and
> > authorization to LDAP based authentication and authorization in
> Apache
> > 2.2.11.
> >
> > We've already got a large number of .htaccess files with specific
> > configs for individual directories that are using "require user" and
> > "require group".  Is it possible to configure the apache server to
> allow
> > those .htaccess to continue work as expected or must we change them
> to
> > "require ldap-user" and "require ldap-group"?
> >
> > I'm digging through the mod_authnz_ldap docs but the config to
> specify
> > the base for group authorization (in my case: "ou=GroupStuff,ou=Our
> > Groups,dc=Company,dc=Com") just isn't jumping out at me.
> >
> 
> This is how we do it:
> 
> AuthType Basic
> AuthName "Company"
> AuthBasicProvider "ldap"
> AuthLDAPURL "ldap://ldap/o=Company?mail?sub?(accountActive=TRUE)"
> AuthLDAPBindDN "cn=authuser,ou=System Accounts,o=Company"
> AuthLDAPBindPassword "authpass"
> AuthzLDAPAuthoritative "On"
> Require valid-user
> Require ldap-group cn=Department,ou=Groups,o=Company
> 
> 
> Cheers
> 
> Tom
> 
> 
> 
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>    "   from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message