LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)
-   -   Apache 2.4 mod_authnz_ldap cannot restrict authentication to specific group (https://www.linuxquestions.org/questions/linux-server-73/apache-2-4-mod_authnz_ldap-cannot-restrict-authentication-to-specific-group-4175557065/)

ariva 10-24-2015 05:26 PM
Apache 2.4 mod_authnz_ldap cannot restrict authentication to specific group
 
Hello!
I am trying to restrict authenticated A.D. users to "Only_This_Group" OU, but instead any A.D. user can successfully login.
I am using Apache 2.4 on CentOS 7.

This is my actual (anonymised) VirtualHost config:

Code:
<VirtualHost *:443>
    ServerName  somesite.example.com
    ServerAlias somesite
    DocumentRoot /var/www/html/somesite

    ErrorLog    logs/somesite.example.com-error_log
    TransferLog logs/somesite.example.com-access_log
    CustomLog  logs/somesite.example.com-request_log "t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
    LogLevel    warn

    SSLEngine      on
    SSLHonorCipherOrder on
    SSLProtocol    all -SSLv2
    SSLCipherSuite HIGH:MEDIUM:!ADH:!AECDH:-ADH-DES-CBC3-SHA:-ADH-RC4-MD5:-ADH-AES128-SHA:-ADH-AES256-SHA

    SSLCertificateFile    /etc/pki/tls/certs/example.com.crt
    SSLCertificateKeyFile /etc/pki/tls/private/example.com.key
    SSLCertificateChainFile /etc/pki/tls/certs/intermediate.example.com.crt
    SSLCACertificateFile /etc/pki/tls/certs/intermediate.example.com.crt

    <Location />
        AuthLDAPBindDN "cn=ldapuser,ou=tec,ou=accounts,DC=example,DC=com"
        AuthLDAPBindPassword "ultra_sophisticated_password"
        AuthLDAPURL "ldap://192.168.0.1 192.168.0.2/ou=employees,ou=accounts,DC=example,DC=com?sAMAccountName?sub?(objectClass=*)" NONE
        AuthLDAPBindAuthoritative On

        AuthType Basic
        AuthName "LDAP Authentication"
        AuthBasicProvider ldap
        AuthUserFile /dev/null

        Require ldap-attribute nsAccountLock!="True"
        Require ldap-group CN=Only_This_Group,OU=Dist,OU=Groups,DC=example,DC=com
        Require valid-user
    </Location>
I did try, but couldn't find the cause, why any A.D. user is successfully authenticated.
All users were double-check. They are not members of "Only_This_Group" OU.
Thanks a lot for help!

ariva 10-29-2015 05:55 PM
Restrict AuthLDAPURL
 
Ok, it can be managed by restrict the AuthLDAPURL:

## AuthLDAPURL "ldap://192.168.0.1 192.168.0.2/ou=employees,ou=accounts,DC=example,DC=com?sAMAccountName?sub?(objectClass=*)" NONE

AuthLDAPURL "ldap://192.168.0.1 192.168.0.2/ou=employees,ou=accounts,DC=example,DC=com?sAMAccountName?sub?(&(objectCategory=person)(objectClass= user)(memberOf=Only_This_Group,OU=Dist,OU=Groups,DC=example,DC=com))" NONE

After that no additional Require ldap-group nor Require ldap-filter directive is needed.


All times are GMT -5. The time now is 01:50 AM.