You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Rodney Ramos <ro...@gmail.com> on 2008/10/21 18:59:30 UTC
[users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server
I´m trying to use the mod_authnz_ldap module to authenticate the users in a
Microsoft AD LDAP Server, but I´m having a lot of problems.
The only configuration that worked was:
AuthName "XXXX"
AuthType Basic
AuthBasicProvider ldap
AuthLDAPUrl "ldap://ldapserver:3268/dc=domain,dc=com?cn"
AuthLDAPBindDN "ldap_bind_user"
AuthLDAPBindPassword "ldap_bind_psw"
AuthzLDAPAuthoritative off
Require valid-user
Questions:
1) Why should we use the port 3268 instead of the default one, 389?
2) Why must we set the AuthzLDAPAuthoritative directive to off?
The second problem occurred when I tried to make Apache authenticate the
users first in a LDAP server and after, if it doens´t find the user there,
in a flat file. So I add the follow line, before the "Require valid-user"
line:
AuthUserFile /tmp/htpasswd.txt
The problem is that Apache doesn´t try to use the flat file to authenticante
the users. It only uses the LDAP authenticate module, even though the
directive AuthzLDAPAuthoritative is set to off.
Can anyone help me?
Thanks
Re: [users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server
Posted by Rodney Ramos <ro...@gmail.com>.
Thank you, André.
That´s because I´m migrating an application from Apache 1.3 to Apache 2.
On Apache 1.3 I was used to Apache::DBI, Apache::AuthDBI, mod_perl,
mod_auth_ldap etc.
Everything worked fine, but ....
Thank you again.
Rodney.
On Wed, Oct 22, 2008 at 11:52 AM, André Warnier <aw...@ice-sa.com> wrote:
> Rodney Ramos wrote:
>
>> Great! That´s it!
>>
>> I´ve tried to use a user called "admin" that exists in the LDAP server.
>>
>> So, to make the test, I´ve created a crazy username and put it into the
>> flat
>> file, and it works!
>>
>> The Apache tries to consult the flat file only if it doesn´t find the user
>> in the LDAP server.
>>
>> Now, another problem (sorry for boring you). Instead of use a flat file as
>> a
>> second option, I want to use a database.
>>
>> So, I´ve installed the Apache::DBI module and tried to use the
>> Apache::AuthDBI to authenticate in a MySQL database.
>>
>> Now the problem is that Apache only try to use the Apache::AuthDBI module.
>> It doesn´t looking for in the LDAP server any more.
>>
>> Any idea? Maybe I shoud try to use the mod_authn_dbd instead of
>> Apache::AuthDBI?
>>
>> What do you think?
>>
>>
> Hi.
> I think indeed that you try with mod_authn_dbd instead of Apache::AuthDBI,
> in this case.
>
> There are others here that will explain that better than I can (Torsten,
> are you there ?), but in a nutshell :
>
> Modules like mod_xxx are Apache add-on modules written in C.
> Modules like Apache::AuthDBI are Apache add-on modules written in Perl, who
> themselves work within the framework provided by the mod_perl add-on module
> (and the embedded perl interpreter that it carries with it).
> mod_perl itself "insinuates itself" fairly deeply into Apache, so that many
> times you can do the same things as what C add-on modules achieve (or even
> more things), but mod_perl add-on modules and C add-on modules do not always
> "cooperate" so well with eachother.
>
> In the latest Apache 2.x versions, the various mod_authxxxx C modules have
> apparently been rewritten so that they cooperate with eachother well.
> On the other hand, Apache::DBI is older, and does not cooperate so nicely
> with the others.
> So you shouldn't mix the two types of add-ons, at least not when it is
> within the same Apache "authentication phase".
>
> This was a very summary explanation, and probably quite insufficient from a
> purist technical point of view. If you need more details, ask and I'll try.
>
>
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Re: [users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server
Posted by André Warnier <aw...@ice-sa.com>.
Rodney Ramos wrote:
> Great! That´s it!
>
> I´ve tried to use a user called "admin" that exists in the LDAP server.
>
> So, to make the test, I´ve created a crazy username and put it into the flat
> file, and it works!
>
> The Apache tries to consult the flat file only if it doesn´t find the user
> in the LDAP server.
>
> Now, another problem (sorry for boring you). Instead of use a flat file as a
> second option, I want to use a database.
>
> So, I´ve installed the Apache::DBI module and tried to use the
> Apache::AuthDBI to authenticate in a MySQL database.
>
> Now the problem is that Apache only try to use the Apache::AuthDBI module.
> It doesn´t looking for in the LDAP server any more.
>
> Any idea? Maybe I shoud try to use the mod_authn_dbd instead of
> Apache::AuthDBI?
>
> What do you think?
>
Hi.
I think indeed that you try with mod_authn_dbd instead of
Apache::AuthDBI, in this case.
There are others here that will explain that better than I can (Torsten,
are you there ?), but in a nutshell :
Modules like mod_xxx are Apache add-on modules written in C.
Modules like Apache::AuthDBI are Apache add-on modules written in Perl,
who themselves work within the framework provided by the mod_perl add-on
module (and the embedded perl interpreter that it carries with it).
mod_perl itself "insinuates itself" fairly deeply into Apache, so that
many times you can do the same things as what C add-on modules achieve
(or even more things), but mod_perl add-on modules and C add-on modules
do not always "cooperate" so well with eachother.
In the latest Apache 2.x versions, the various mod_authxxxx C modules
have apparently been rewritten so that they cooperate with eachother well.
On the other hand, Apache::DBI is older, and does not cooperate so
nicely with the others.
So you shouldn't mix the two types of add-ons, at least not when it is
within the same Apache "authentication phase".
This was a very summary explanation, and probably quite insufficient
from a purist technical point of view. If you need more details, ask
and I'll try.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server
Posted by Rodney Ramos <ro...@gmail.com>.
Great! That´s it!
I´ve tried to use a user called "admin" that exists in the LDAP server.
So, to make the test, I´ve created a crazy username and put it into the flat
file, and it works!
The Apache tries to consult the flat file only if it doesn´t find the user
in the LDAP server.
Now, another problem (sorry for boring you). Instead of use a flat file as a
second option, I want to use a database.
So, I´ve installed the Apache::DBI module and tried to use the
Apache::AuthDBI to authenticate in a MySQL database.
Now the problem is that Apache only try to use the Apache::AuthDBI module.
It doesn´t looking for in the LDAP server any more.
Any idea? Maybe I shoud try to use the mod_authn_dbd instead of
Apache::AuthDBI?
What do you think?
Thank you again.
Rodney.
On Tue, Oct 21, 2008 at 6:09 PM, Eric Covener <co...@gmail.com> wrote:
> On Tue, Oct 21, 2008 at 1:43 PM, André Warnier <aw...@ice-sa.com> wrote:
> > Eric Covener wrote:
> >>
> >> On port 389, MSAD might send you on a lengthy wild goose-chase of LDAP
> >> referrals.
> >>
> > Eric, can you elaborate a bit on that, or direct me/us to some additional
> > information ?
> > This is not directly related to the OP's issue, but I'm doing a lot of
> AAA
> > related stuff these days, and like to learn these things.
>
>
> LDAP has a notion of referrals, like HTTP redirects. When you have a
> complicated AD domain, you might talk to what you think of as the
> master AD server, but it may send you to go ask other servers (dept.
> x, dept y, AD servers from some remote site, recent acquisitions,
> etc). I don't know if it is misconfiguration, but I've seen some
> where conceptually none of the referrals seem to be needed based on
> the user you're looking up (and may take you across some slow links)
>
> When you use that high port, you're talking to the "global catalog"
> where all info across the "forest" is aggregated on one LDAP server
> and you just get a regular/direct result if you query or try to login.
> If you use unusual data for authz, i believe you have to tell it what
>
> MS also has a tool called ADAM (AD Application Mode) that frontends AD
> for traditional LDAP applications:
> http://www.microsoft.com/windowsserver2003/adam/default.mspx
>
>
> --
> Eric Covener
> covener@gmail.com
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Re: [users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server
Posted by André Warnier <aw...@ice-sa.com>.
Thanks.
That info might very well save me a couple of days of scratching my head
some time soon.
André
Eric Covener wrote:
> On Tue, Oct 21, 2008 at 1:43 PM, André Warnier <aw...@ice-sa.com> wrote:
>> Eric Covener wrote:
>>> On port 389, MSAD might send you on a lengthy wild goose-chase of LDAP
>>> referrals.
>>>
>> Eric, can you elaborate a bit on that, or direct me/us to some additional
>> information ?
>> This is not directly related to the OP's issue, but I'm doing a lot of AAA
>> related stuff these days, and like to learn these things.
>
>
> LDAP has a notion of referrals, like HTTP redirects. When you have a
> complicated AD domain, you might talk to what you think of as the
> master AD server, but it may send you to go ask other servers (dept.
> x, dept y, AD servers from some remote site, recent acquisitions,
> etc). I don't know if it is misconfiguration, but I've seen some
> where conceptually none of the referrals seem to be needed based on
> the user you're looking up (and may take you across some slow links)
>
> When you use that high port, you're talking to the "global catalog"
> where all info across the "forest" is aggregated on one LDAP server
> and you just get a regular/direct result if you query or try to login.
> If you use unusual data for authz, i believe you have to tell it what
>
> MS also has a tool called ADAM (AD Application Mode) that frontends AD
> for traditional LDAP applications:
> http://www.microsoft.com/windowsserver2003/adam/default.mspx
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server
Posted by Eric Covener <co...@gmail.com>.
On Tue, Oct 21, 2008 at 1:43 PM, André Warnier <aw...@ice-sa.com> wrote:
> Eric Covener wrote:
>>
>> On port 389, MSAD might send you on a lengthy wild goose-chase of LDAP
>> referrals.
>>
> Eric, can you elaborate a bit on that, or direct me/us to some additional
> information ?
> This is not directly related to the OP's issue, but I'm doing a lot of AAA
> related stuff these days, and like to learn these things.
LDAP has a notion of referrals, like HTTP redirects. When you have a
complicated AD domain, you might talk to what you think of as the
master AD server, but it may send you to go ask other servers (dept.
x, dept y, AD servers from some remote site, recent acquisitions,
etc). I don't know if it is misconfiguration, but I've seen some
where conceptually none of the referrals seem to be needed based on
the user you're looking up (and may take you across some slow links)
When you use that high port, you're talking to the "global catalog"
where all info across the "forest" is aggregated on one LDAP server
and you just get a regular/direct result if you query or try to login.
If you use unusual data for authz, i believe you have to tell it what
MS also has a tool called ADAM (AD Application Mode) that frontends AD
for traditional LDAP applications:
http://www.microsoft.com/windowsserver2003/adam/default.mspx
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server
Posted by André Warnier <aw...@ice-sa.com>.
Eric Covener wrote:
>
> On port 389, MSAD might send you on a lengthy wild goose-chase of LDAP
> referrals.
>
Eric, can you elaborate a bit on that, or direct me/us to some
additional information ?
This is not directly related to the OP's issue, but I'm doing a lot of
AAA related stuff these days, and like to learn these things.
Thanks.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server
Posted by André Warnier <aw...@ice-sa.com>.
Eric Covener wrote:
> On Tue, Oct 21, 2008 at 1:58 PM, Rodney Ramos <ro...@gmail.com> wrote:
>> Hi, Eric. Thank you for your answers.
>>
>> I´ve tried to do what you said, setting the directive AuthBasicProvider as
>> below:
>>
>> AuthBasicProvider ldap file
>>
>> But the problem is the same. Apache doen´t check the flat file, as you can
>> see in the log below:
>
>> ldap://ldapserver:3268/dc=domain,dc=com?cn, referer: http://webserver
>> [Tue Oct 21 15:49:38 2008] [warn] [client 10.10.10.10] [5053] auth_ldap
>> authenticate: user admin authentication failed; URI /std/cgi-bin/login.cgi
>> [ldap_simple_bind_s() to check user credentials failed][Invalid
>> credentials], referer: http://webserver
>> [Tue Oct 21 15:49:38 2008] [error] [client 10.10.10.10] user admin:
>> authentication failure for "/std/cgi-bin/login.cgi": Password Mismatch,
>> referer: http://webserver
>> =================================================================
>
> Generally, the auth providers only let someone else take a shot when
> they can't lookup the username they're trying to authenticate.
>
> Contrast with this case, where LDAP thinks it's supposed to handle it
> because the user is found in LDAP but their password doesn't match.
>
> I don't think you can try another type of auth in this case.
>
A simple test would be : what if you try a userid that does not exist in
the LDAP server ? what happens then ?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server
Posted by Eric Covener <co...@gmail.com>.
On Tue, Oct 21, 2008 at 1:58 PM, Rodney Ramos <ro...@gmail.com> wrote:
> Hi, Eric. Thank you for your answers.
>
> I´ve tried to do what you said, setting the directive AuthBasicProvider as
> below:
>
> AuthBasicProvider ldap file
>
> But the problem is the same. Apache doen´t check the flat file, as you can
> see in the log below:
> ldap://ldapserver:3268/dc=domain,dc=com?cn, referer: http://webserver
> [Tue Oct 21 15:49:38 2008] [warn] [client 10.10.10.10] [5053] auth_ldap
> authenticate: user admin authentication failed; URI /std/cgi-bin/login.cgi
> [ldap_simple_bind_s() to check user credentials failed][Invalid
> credentials], referer: http://webserver
> [Tue Oct 21 15:49:38 2008] [error] [client 10.10.10.10] user admin:
> authentication failure for "/std/cgi-bin/login.cgi": Password Mismatch,
> referer: http://webserver
> =================================================================
Generally, the auth providers only let someone else take a shot when
they can't lookup the username they're trying to authenticate.
Contrast with this case, where LDAP thinks it's supposed to handle it
because the user is found in LDAP but their password doesn't match.
I don't think you can try another type of auth in this case.
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server
Posted by Rodney Ramos <ro...@gmail.com>.
Hi, Eric. Thank you for your answers.
I´ve tried to do what you said, setting the directive AuthBasicProvider as
below:
AuthBasicProvider ldap file
But the problem is the same. Apache doen´t check the flat file, as you can
see in the log below:
=================================================================
[Tue Oct 21 15:49:38 2008] [debug] mod_authnz_ldap.c(849): [5053] auth_ldap
url parse: `ldap://ldapserver:3268/dc=domain,dc=com?cn'
[Tue Oct 21 15:49:38 2008] [debug] mod_authnz_ldap.c(858): [5053] auth_ldap
url parse: Host: ldapserver:3268
[Tue Oct 21 15:49:38 2008] [debug] mod_authnz_ldap.c(860): [5053] auth_ldap
url parse: Port: 3268
[Tue Oct 21 15:49:38 2008] [debug] mod_authnz_ldap.c(862): [5053] auth_ldap
url parse: DN: dc=domain,dc=com
[Tue Oct 21 15:49:38 2008] [debug] mod_authnz_ldap.c(864): [5053] auth_ldap
url parse: attrib: cn
[Tue Oct 21 15:49:38 2008] [debug] mod_authnz_ldap.c(866): [5053] auth_ldap
url parse: scope: base
[Tue Oct 21 15:49:38 2008] [debug] mod_authnz_ldap.c(871): [5053] auth_ldap
url parse: filter: (null)
[Tue Oct 21 15:49:38 2008] [debug] mod_authnz_ldap.c(951): LDAP: auth_ldap
not using SSL connections
[Tue Oct 21 15:49:38 2008] [debug] mod_authnz_ldap.c(373): [client
10.10.10.10] [5053] auth_ldap authenticate: using URL
ldap://ldapserver:3268/dc=domain,dc=com?cn, referer: http://webserver
[Tue Oct 21 15:49:38 2008] [warn] [client 10.10.10.10] [5053] auth_ldap
authenticate: user admin authentication failed; URI /std/cgi-bin/login.cgi
[ldap_simple_bind_s() to check user credentials failed][Invalid
credentials], referer: http://webserver
[Tue Oct 21 15:49:38 2008] [error] [client 10.10.10.10] user admin:
authentication failure for "/std/cgi-bin/login.cgi": Password Mismatch,
referer: http://webserver
=================================================================
I´ve forgotten to send the Apache version:
Installed Packages
Name : httpd
Arch : i386
Version: 2.2.3
Release: 11.el5_1.3
Size : 2.8 M
Repo : installed
Summary: Apache HTTP Server
It is installed in a Red Hat Linux Server release 5.2.
Thank you again.
Rodney.
On Tue, Oct 21, 2008 at 3:27 PM, Eric Covener <co...@gmail.com> wrote:
> On Tue, Oct 21, 2008 at 12:59 PM, Rodney Ramos <ro...@gmail.com> wrote:
> > I´m trying to use the mod_authnz_ldap module to authenticate the users in
> a
> > Microsoft AD LDAP Server, but I´m having a lot of problems.
> >
> > The only configuration that worked was:
> >
> > AuthName "XXXX"
> > AuthType Basic
> > AuthBasicProvider ldap
> > AuthLDAPUrl "ldap://ldapserver:3268/dc=domain,dc=com?cn"
> > AuthLDAPBindDN "ldap_bind_user"
> > AuthLDAPBindPassword "ldap_bind_psw"
> > AuthzLDAPAuthoritative off
> > Require valid-user
> >
> > Questions:
> >
> > 1) Why should we use the port 3268 instead of the default one, 389?
>
> On port 389, MSAD might send you on a lengthy wild goose-chase of LDAP
> referrals.
>
> >
> > 2) Why must we set the AuthzLDAPAuthoritative directive to off?
>
> you don't need it for 2.2.6 and later
>
> >
> > The second problem occurred when I tried to make Apache authenticate the
> > users first in a LDAP server and after, if it doens´t find the user
> there,
> > in a flat file. So I add the follow line, before the "Require valid-user"
> > line:
> >
> > AuthUserFile /tmp/htpasswd.txt
> >
> > The problem is that Apache doesn´t try to use the flat file to
> authenticante
> > the users. It only uses the LDAP authenticate module, even though the
> > directive AuthzLDAPAuthoritative is set to off.
>
> You need to tell basic auth to look there:
>
> AuthBasicProvider ldap file
>
>
>
>
> --
> Eric Covener
> covener@gmail.com
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Re: [users@httpd] mod_authnz_ldap module and Microsoft AD LDAP Server
Posted by Eric Covener <co...@gmail.com>.
On Tue, Oct 21, 2008 at 12:59 PM, Rodney Ramos <ro...@gmail.com> wrote:
> I´m trying to use the mod_authnz_ldap module to authenticate the users in a
> Microsoft AD LDAP Server, but I´m having a lot of problems.
>
> The only configuration that worked was:
>
> AuthName "XXXX"
> AuthType Basic
> AuthBasicProvider ldap
> AuthLDAPUrl "ldap://ldapserver:3268/dc=domain,dc=com?cn"
> AuthLDAPBindDN "ldap_bind_user"
> AuthLDAPBindPassword "ldap_bind_psw"
> AuthzLDAPAuthoritative off
> Require valid-user
>
> Questions:
>
> 1) Why should we use the port 3268 instead of the default one, 389?
On port 389, MSAD might send you on a lengthy wild goose-chase of LDAP
referrals.
>
> 2) Why must we set the AuthzLDAPAuthoritative directive to off?
you don't need it for 2.2.6 and later
>
> The second problem occurred when I tried to make Apache authenticate the
> users first in a LDAP server and after, if it doens´t find the user there,
> in a flat file. So I add the follow line, before the "Require valid-user"
> line:
>
> AuthUserFile /tmp/htpasswd.txt
>
> The problem is that Apache doesn´t try to use the flat file to authenticante
> the users. It only uses the LDAP authenticate module, even though the
> directive AuthzLDAPAuthoritative is set to off.
You need to tell basic auth to look there:
AuthBasicProvider ldap file
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org