Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of covener@gmail.com designates
 209.85.218.208 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=T7q6FomKtrnn3SPkB1ii9whgtcWGHd31aFDYlTNj9SzmZ5qw4qn2xsjqB/p4vnrZbe
         MJQMl9SRrPYcl9fXFl3X3uMAiADpXQ88WSzGt+wQGLQOL7tTdcnf7sBfT3i0K+XPzM60
         qtj2zc3LZlrlLoWBTCFVc8A0GG814Z5t2Ojjs=
MIME-Version: 1.0
In-Reply-To: <4AC5F45F.50807@ofd-sth.niedersachsen.de>
References: 
 <BA93D6382397BB4D812580F1AB75B99B03BBD69C@xmb-rtp-215.amer.cisco.com>
	 <1254472558.54871.16.camel@strangepork.london.mintel.ad>
	 <4AC5F45F.50807@ofd-sth.niedersachsen.de>
Date: Fri, 2 Oct 2009 11:05:00 -0400
Message-ID: <1404e5910910020805m5285334fk935a67d5ab502126@mail.gmail.com>
From: Eric Covener <covener@gmail.com>
To: users@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [users@httpd] group authorization via LDAP

On Fri, Oct 2, 2009 at 8:38 AM, Marc Patermann
<hans.moser@ofd-sth.niedersachsen.de> wrote:
> Hi,
>
> Tom Evans schrieb:
>>
>> On Thu, 2009-10-01 at 17:18 -0400, Tony Rice (trice) wrote:
>
>> This is how we do it:
>> [...]
>> AuthzLDAPAuthoritative "On"
>> Require valid-user
>> Require ldap-group cn=3DDepartment,ou=3DGroups,o=3DCompany
>
> Does this work?
> When I read the docs:
> "Require valid-user
> If this directive exists, mod_authnz_ldap grants access to any user that =
has
> successfully authenticated during the search/bind phase."
> and:
> "Other Require values may also be used which may require loading addition=
al
> authorization modules. Note that if you use a Require =A0value from anoth=
er
> authorization module, you will need to ensure that AuthzLDAPAuthoritative
> =A0is set to off to allow the authorization phase to fall back to the mod=
ule
> providing the alternate Require value."
> -> http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html
>

> This seems to me like either "Require valid-user" is not working at all -
> because AuthzLDAPAuthoritative is "On" - or it overrules any ldap-group
> setting. Hm!?

The doc is poor in this regard.  mod_authnz_ldap does not handle
"valid-user", it allows another module to handle it [if the request
gets that far].  This is why the AuthzLDAPAuthoritiative does not
apply to the "Require valid-user", and this quoted config boils down
to the same as if you'd removed the first two quoted directives
[IIUC].


--=20
Eric Covener
covener@gmail.com

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org