Using Active Directory to authenticate Apache users

kenneho · 09-08-2008, 01:53 AM

Hi.

I've heard that using Active Directory to authenticate Apache users may be a bit of a struggle. Does anyone have experience with this, and can point me to documentation on how to do this properly?

Regards,
kenneho

acid_kewpie · 09-08-2008, 01:57 AM

many many quick hits on google... http://www.yolinux.com/TUTORIALS/Lin...tion.html#LDAP there's nothing particuarly interesting about AD compared to other LDAP interfaces, just that you're using sAMAccountName instead of a uid. this is only one way of doing it, and about the quickest and simplest. if you have specific problems post your configs and we'll go from there.

kenneho · 09-08-2008, 02:13 AM

Thanks I'll check it out.

kenneho · 09-08-2008, 07:28 AM

I've tried to set up apache to authenticate against AD, but are getting this error:

Code:

[Mon Sep 08 14:16:03 2008] [error] [client xxx.xxx.xxx.xxx] access to /folder failed, reason: verification of user id 'kenneho' not configured, referer: http://host.example.com/

This is from my httpd.conf:

Code:

AuthType Basic 
AuthName "Welcome!" 
AuthLDAPURL ldap://111.222.333.444:389/dc=example,dc=com?sAMAccountName 
AuthLDAPBindDN CN=user,OU=something,DC=example,DC=com 
AuthLDAPBindPassword secret 
Require vaild-user

General ldapsearch using the bind DN and password seems to work fine:

Code:

ldapsearch -x -D "CN=user,OU=something,DC=example,DC=com" -w secret

Any ideas on how to further debug this?

kenneho · 09-10-2008, 06:24 AM

Seems we may have suffered from a bug regarding using references in MS 2003 AD. What we did to get things going was to query the AD-server on port 3268, and make sure AuthzLDAPAuthoritative was set to "Off".