LDAP authorization

[honestpuck]

Hi all,

I’m trying to get any of the LDAP authorization modules for Apache working on OS X Server 10.3.4 without any luck at all.

Anyone succeeded in doing this? Would love to hear which one you used and any tips.

Tony Williams

[honestpuck]

[quote:90a80d55e6=”MacTroll”]You’re probably running into password problems.

Is the module expecting to find the hashed password in the user record?

Joel[/quote:90a80d55e6]

Hard to tell. The code is fairly opaque. mod_auth_ldap has a debugging mode and appears to be writing nothing to the error log. I haven’t got logging working in auth_ldap either. It looks like both should write something to the log before getting as far as checking the password.

Tony

[honestpuck]

After some fairly intensive log reading and trying five different modules I’ve finally got LDAP authorization working in Apache.

The answer was to use an earlier Apache module, mod_LDAPauth from Piet Ruyssinck. This one did have some problems, though. It didn’t like Apple’s group model and didn’t allow uids longer than 8 characters.

Ive spent some time modifying it so it now works great with longer names and Apple’s groups. You can get a copy from my blog at http://honestpuck.com/Computers/Macintosh/mod_LDAPauth

Tony Williams

[Anonymous]

Does Your module work with Apache2?
I configured (standard distribution from apache.org) with
./configure –prefix=/opt/apache2 –with-ldap –enable-ldap –enable-auth-ldap

and I want to authenticate with the osx server openldap.

I got it working ok for “valid-user” or “require user” with:
***

AuthType Basic
AuthName “Internal” Order deny,allow
Deny from all
Allow from 192.168.1.0/255.255.255.0
AuthLDAPURL ldap://127.0.0.1/cn=users,dc=domain,dc=com?uid
Require valid-user
Satisfy any Require no-user
***

But I cant get it to accept a group member… I tried:

***

AuthType Basic
AuthName “Office” Order deny,allow
Deny from all
AuthLDAPURL ldap://127.0.0.1/cn=users,dc=domain,dc=com?uid
require group=office Require no-user
***

Why wont it work??
It do find the user, but cant see the group membership.
Maybe its a need of AuthLDAPGroupAttribute

Anyone familiar with this?

Joachim

[honestpuck]

No, my module won’t work in Apache 2.0, though you could do the same hack to the Apache 2.0 module.

The problem is the difference between the model of group membership used by Netscape’s LDAP server, which most modules are written for, and the one Apple use.

I may eventually write an Apache 2.0 version of my hack, but I don’t know when.

Tony

[Author]

Posts