You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2006/09/25 20:50:16 UTC
DO NOT REPLY [Bug 40603] New: - AuthLDAPURL does not work with space-separated hosts
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40603>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40603
Summary: AuthLDAPURL does not work with space-separated hosts
Product: Apache httpd-2
Version: 2.2-HEAD
Platform: PC
OS/Version: FreeBSD
Status: NEW
Severity: normal
Priority: P2
Component: mod_authz_ldap
AssignedTo: bugs@httpd.apache.org
ReportedBy: twp@rnktel.com
[Note: this is actually a bug report for mod_authnz_ldap, which is not listed in
the available components.]
I am running httpd 2.2.3, built via the FreeBSD ports tree on an up-to-date
FreeBSD 6.1 system using the following flags:
make WITH_LDAP_MODULES=yes WITH_AUTH_MODULES=yes WITH_MISC_MODULES=yes
WITH_SSL_MODULES=yes
The documentation for mod_authnz_ldap says that multiple servers may be listed
by separating them with spaces. This feature worked on a 2.2.2 system but I
have not been able to make it work in 2.2.3.
This setting:
AuthLDAPURL ldaps://ldap0.foo.com ldap1.foo.com/ou=people,dc=foo,dc=com
generates this error:
[Mon Sep 25 14:08:40 2006] [alert] [client xxx.xxx.xxx.xxx] /foo/.htaccess:
Invalid LDAP connection mode setting: must be one of NONE, SSL, or TLS/STARTTLS,
referer: ...
This setting:
AuthLDAPURL "ldaps://ldap0.foo.com ldap1.foo.com/ou=people,dc=foo,dc=com"
generates this error:
[Mon Sep 25 14:12:46 2006] [warn] [client xxx.xxx.xxx.xxx] [94852] auth_ldap
authenticate: user bar authentication failed; URI /foo/uri [LDAP:
ldap_simple_bind_s() failed][Can't contact LDAP server], referer: ...
This setting:
AuthLDAPURL ldaps://ldap0.foo.com ldap1.foo.com/ou=people,dc=foo,dc=com SSL
generates this error:
[Mon Sep 25 14:13:02 2006] [alert] [client xxx.xxx.xxx.xxx] /foo/uri:
AuthLDAPURL takes 1-2 arguments, URL to define LDAP connection. This should be
an RFC 2255 complaint\nURL of the form
ldap://host[:port]/basedn[?attrib[?scope[?filter]]].\n<ul>\n<li>Host is the name
of the LDAP server. Use a space separated list of hosts \nto specify redundant
servers.\n<li>Port is optional, and specifies the port to connect
to.\n<li>basedn specifies the base DN to start searches from\n<li>Attrib
specifies what attribute to search for in the directory. If not provided, it
defaults to <b>uid</b>.\n<li>Scope is the scope of the search, and can be either
<b>sub</b> or <b>one</b>. If not provided, the default is
<b>sub</b>.\n<li>Filter is a filter to use in the search. If not provided,
defaults to <b>(objectClass=*)</b>.\n</ul>\nSearches are performed using the
attribute and the filter combined. For example, assume that the\nLDAP URL is
<b>ldap://ldap.airius.com/ou=People, o=Airius?uid?sub?(posixid=*)</b>. Searches
will\nbe done using the filter <b>(&((posixid=*))(uid=<i>username</i>))</b>,
where <i>username</i>\nis the user name passed by the HTTP client. The search
will be a subtree search on the branch <b>ou=People, o=Airius</b>., referer: ...
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 40603] - AuthLDAPURL does not work with space-separated hosts
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40603>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40603
bnicholes@apache.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
------- Additional Comments From bnicholes@apache.org 2006-09-26 18:09 -------
If multiple ldap hosts are included in the LDAPUrl, the entire url must be
encapsulated in "" (double quotes). Otherwise, the configuration file parser
will interprete the LDAPUrl directive as having multiple values which is
invalid.
In your second example which includes the "", Apache appears to load and
start up correctly. The error that you are getting has more to do with your
LDAP SSL connection to the primary and/or secondary LDAP hosts, than it does
with mod_authnz_ldap. Most likely a certificate issue.
The only thing that changed between 2.2.2 and 2.2.3 is that way that an
error that is returned by the util_ldap_cache_checkuserid() function is
evaluated within mod_authnz_ldap. This change would not have any affect on
whether the request suceeded or failed.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org