You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by mw...@iu.edu on 2024/11/25 21:28:57 UTC
[users@httpd] LDAP connection failure: what does "not authoritative" mean?
I'm trying to do basic authentication via LDAP to Active Directory.
HTTPD logs this:
[Mon Nov 25 16:02:47.362939 2024] [authnz_ldap:debug] [pid 6205:tid 6205] mod_authnz_ldap.c(548): [client 2600:381:cb60:bf0:c6bb:b64d:24e:24da:46526] AH01691: auth_ldap authenticate: using URL ldap://ads.iu.edu/ou=Accounts,DC=ads,DC=iu,DC=edu?CN?one
[Mon Nov 25 16:02:47.381431 2024] [authnz_ldap:debug] [pid 6205:tid 6205] mod_authnz_ldap.c(569): [client 2600:381:cb60:bf0:c6bb:b64d:24e:24da:46526] AH01694: auth_ldap authenticate: user mwood authentication failed; URI /nagios/ [LDAP: ldap_start_tls_s() failed][Connect error] (not authoritative)
[Mon Nov 25 16:02:47.381449 2024] [auth_basic:error] [pid 6205:tid 6205] [client 2600:381:cb60:bf0:c6bb:b64d:24e:24da:46526] AH01618: user mwood not found: /nagios/
I don't know what it doesn't like about the connection. The server's
certificate checks out. I've got LDAPTrustedGlobalCert set:
More configuration:
LDAPTrustedGlobalCert CA_BASE64 /etc/ssl/certs/ca-certificates.crt
AuthType basic
AuthBasicProvider ldap
AuthName "ADS"
AuthLDAPURL "ldap://ads.iu.edu/ou=Accounts,DC=ads,DC=iu,DC=edu?CN?one" STARTTLS
AuthLDAPBindDN "CN={omitted},OU=Accounts,DC=ads,DC=iu,DC=edu"
AuthLDAPBindPassword "{omitted}"
AuthLDAPBindAuthoritative Off
AuthLDAPGroupAttribute member
AuthLDAPRemoteUserAttribute CN
<RequireAll>
Require ldap-group CN=IN-ULib-Admins,OU=IN-ADMINS,OU=IN,DC=ads,DC=iu,DC=edu
<RequireAny>
{a list of "Require ip"s}
</RequireAny>
</RequireAll>
What have I missed?
--
Mark H. Wood
Lead Technology Analyst
University Library
Indiana University Indianapolis
755 W. Michigan Street
Indianapolis, IN 46202
317-274-0749
library.indianapolis.iu.edu
RE: [users@httpd] LDAP connection failure: what does "not authoritative" mean?
Posted by Marc <Ma...@f1-outsourcing.eu>.
Is ldapsearch working from the same server? There can be lots of issues with ssl and auth sff.
> I'm trying to do basic authentication via LDAP to Active Directory.
> HTTPD logs this:
>
> [Mon Nov 25 16:02:47.362939 2024] [authnz_ldap:debug] [pid 6205:tid
> 6205] mod_authnz_ldap.c(548): [client
> 2600:381:cb60:bf0:c6bb:b64d:24e:24da:46526] AH01691: auth_ldap
> authenticate: using URL
> ldap://ads.iu.edu/ou=Accounts,DC=ads,DC=iu,DC=edu?CN?one
> [Mon Nov 25 16:02:47.381431 2024] [authnz_ldap:debug] [pid 6205:tid
> 6205] mod_authnz_ldap.c(569): [client
> 2600:381:cb60:bf0:c6bb:b64d:24e:24da:46526] AH01694: auth_ldap
> authenticate: user mwood authentication failed; URI /nagios/ [LDAP:
> ldap_start_tls_s() failed][Connect error] (not authoritative)
> [Mon Nov 25 16:02:47.381449 2024] [auth_basic:error] [pid 6205:tid 6205]
> [client 2600:381:cb60:bf0:c6bb:b64d:24e:24da:46526] AH01618: user mwood
> not found: /nagios/
>
> I don't know what it doesn't like about the connection. The server's
> certificate checks out. I've got LDAPTrustedGlobalCert set:
>
> More configuration:
>
> LDAPTrustedGlobalCert CA_BASE64 /etc/ssl/certs/ca-certificates.crt
>
> AuthType basic
> AuthBasicProvider ldap
> AuthName "ADS"
>
> AuthLDAPURL "ldap://ads.iu.edu/ou=Accounts,DC=ads,DC=iu,DC=edu?CN?one"
> STARTTLS
> AuthLDAPBindDN "CN={omitted},OU=Accounts,DC=ads,DC=iu,DC=edu"
> AuthLDAPBindPassword "{omitted}"
> AuthLDAPBindAuthoritative Off
> AuthLDAPGroupAttribute member
> AuthLDAPRemoteUserAttribute CN
>
> <RequireAll>
> Require ldap-group CN=IN-ULib-Admins,OU=IN-
> ADMINS,OU=IN,DC=ads,DC=iu,DC=edu
> <RequireAny>
> {a list of "Require ip"s}
> </RequireAny>
> </RequireAll>
>
> What have I missed?
>
Re: [users@httpd] LDAP connection failure: what does "not authoritative" mean?
Posted by Eric Covener <co...@gmail.com>.
On Mon, Nov 25, 2024 at 4:30 PM <mw...@iu.edu> wrote:
>
> I'm trying to do basic authentication via LDAP to Active Directory.
> HTTPD logs this:
>
> [Mon Nov 25 16:02:47.362939 2024] [authnz_ldap:debug] [pid 6205:tid 6205] mod_authnz_ldap.c(548): [client 2600:381:cb60:bf0:c6bb:b64d:24e:24da:46526] AH01691: auth_ldap authenticate: using URL ldap://ads.iu.edu/ou=Accounts,DC=ads,DC=iu,DC=edu?CN?one
> [Mon Nov 25 16:02:47.381431 2024] [authnz_ldap:debug] [pid 6205:tid 6205] mod_authnz_ldap.c(569): [client 2600:381:cb60:bf0:c6bb:b64d:24e:24da:46526] AH01694: auth_ldap authenticate: user mwood authentication failed; URI /nagios/ [LDAP: ldap_start_tls_s() failed][Connect error] (not authoritative)
This refers to AuthLDAPBindAuthoritative rather than something the
LDAP server returned. It means other authentication modules will get
a chance if configured (none are in your config, it would be a list of
AuthBasicProvider)
I think "connect error" is the only part coming from the LDAP SDK.
LDAPLibraryDebug might help get you some context during the failure.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org