httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Eric Covener <>
Subject Re: [users@httpd] Dynamic selection of mod_authnz_ldap's 'require ldap-group' object?
Date Fri, 24 Feb 2012 14:14:30 GMT
On Fri, Feb 24, 2012 at 8:59 AM, J.Lance Wilkinson <> wrote:
> Eric Covener wrote:
>> IIRC, there was a patch contributed that allowed the filter to be set
>> dynamically [but not the require]. Might turn something up in
>> bugzilla.
>        Shoot.  Don't really like to be selectively patching things
>        like that.  But will look into it.  Setting the filter dynamically
>        would probably do the trick.  Thanks.

LDAP attributes can be loaded into AUTHENTICATE_* vars and can be
queried, but you might not be able to express the rules you need using
attributes only.

Some directory servers allow group membership to be read as a "magic"
attribute in LDAP.  Notably, tivoli directory server allows an
ibm-allGroups element to be used (result only, not filtered on) which
you could them find a way to check more dynamically (setenvif, allow
from env=...).

The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:> for more info.
To unsubscribe, e-mail:
   "   from the digest:
For additional commands, e-mail:

View raw message