Changes between Version 32 and Version 33 of TracModWSGI

Timestamp:

Feb 27, 2011, 5:55:33 PM (13 years ago)

Author:

Christian Boos

Comment:

refreshing the #UsingLDAPAuthentication, adding some details found in trunk/doc/install/apacheauth.rst

TracModWSGI

@@ -189 +189 @@
   AuthLDAPURL "ldap://127.0.0.1/dc=example,dc=co,dc=ke?uid?sub?(objectClass=inetOrgPerson)"
   authzldapauthoritative Off
-  require valid-user
+  Require valid-user
 </Location>
 }}}
 
-Or the LDAP interface to a Microsoft Active Directory:
-
+
+3. You can use the LDAP interface as a way to authenticate to a Microsoft Active Directory:
+
+
+Use the following as your LDAP URL:
+{{{
+    AuthLDAPURL "ldap://directory.example.com:3268/DC=example,DC=com?sAMAccountName?sub?(objectClass=user)"
+}}}
+
+You will also need to provide an account for Apache to use when checking
+credentials. As this password will be listed in plaintext in the
+config, you should be sure to use an account specifically for this task:
+{{{
+    AuthLDAPBindDN ldap-auth-user@example.com
+    AuthLDAPBindPassword "password"
+}}}
+
+The whole section looks like:
 {{{
 <Location /trac/>
@@ -215 +231 @@
 Note 1: This is the case where the LDAP search will get around the multiple OUs, conecting to Global Catalog Server portion of AD (Notice the port is 3268, not the normal LDAP 389). The GCS is basically a "flattened" tree which allows searching for a user without knowing to which OU they belong.
 
-Note 2: Active Directory requires an authenticating user/password to access records (AuthLDAPBindDN and AuthLDAPBindPassword).
-
-Note 3: The directive "require ldap-group ..."  specifies an AD group whose members are allowed access.
-
-
+Note 2: You can also require the user be a member of a certain LDAP group, instead of
+just having a valid login:
+{{{
+    Require ldap-group CN=Trac Users,CN=Users,DC=example,DC=com
+}}}
+
+See also:
+  - [http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html mod_authnz_ldap], documentation for mod_authnz_ldap
+    
+ - [http://httpd.apache.org/docs/2.2/mod/mod_ldap.html mod_ldap], documentation for mod_ldap, which provides connection pooling and a shared cache.
+ - [http://trac-hacks.org/wiki/LdapPlugin TracHacks:LdapPlugin] for storing TracPermissions in LDAP.
 
 === Example: Apache/mod_wsgi with Basic Authentication, Trac being at the root of a virtual host