Changes between Version 2 and Version 3 of ActiveDirectory

Timestamp:

Nov 14, 2007, 2:16:24 PM (16 years ago)

Author:

wilsonbe@…

Comment:

—

ActiveDirectory

@@ -80 +80 @@
 </Location>
 }}}
+
+ === Using mm_mod_auth_ldap and authentication on bind ===
+Some LDAP providers require some form of authentication in order to check credentials.  There are two ways of handling this.  One is to put a specific username and password into the Apache configuration file.  This can be problematic in certain environments, and burying passwords in configuration files can be a maintenance problem.  The third party mm_mod_auth_ldap (http://muquit.com/muquit/software/mod_auth_ldap/mod_auth_ldap.html)provides an interesting solution, which is that it attempts to use the username/password supplied by the user to do the bind to the LDAP provider.  If the bind works that's part of the authentication.  If the bind doesn't work, then the user is presumed to not be real, and the authentication fails.  This does, however, have a couple of unfortunate side effects.  One is that if the user fat-fingers the password, the bind fails and the user sees a server configuration error (bad).  The other is that since the credentials are different on each bind, there's no caching or pooling of LDAP connections possible.  However, this is a useful concept, and one that can hopefully be improved.  The gist of the configuration is
+{{{
+LoadModule mm_auth_ldap_module /usr/lib/httpd/modules/mm_mod_auth_ldap.so
+
+<Location /test-ldap>
+     Options None
+
+     #Authentication
+     AuthType Basic
+     AuthBasicProvider mm_ldap
+     AuthName "Authenticate"
+     #Server information
+     LDAP_Port <LDAP port> #often 389
+     LDAP_Server <ldapserver.your.domain>
+     LDAP_StartTLS On
+     #Where to look
+     Base_DN "<base DN for where to bind>"  # e.g. "ou=People,dc=example,dc=com"
+     UID_Attr uid
+     #Require these users
+     require valid-user
+     #Authenticate on bind - important!
+     AuthOnBind On
+     #Debugging
+     LDAP_Debug Off
+</Location> 
+}}}
 Have fun!