You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Ed Avis <ed...@waniasset.com> on 2009/02/26 15:31:11 UTC
[users@httpd] Confused about LDAP authentication with Active Directory
Hi, I have been reading the list archives and searching the web for
how to configure Apache to authenticate users using Active Directory
but I think I may be missing some obvious points. Hopefully someone
can explain what I'm missing.
Apache is running on the only Linux machine in a Windows network.
(Fedora 10.) There is a domain controller which runs Active Directory
and is reachable by LDAP (port 389). What I want is that when someone
views the Apache-hosted web site, they are prompted to enter a
username and password. These credentials are then checked against
Active Directory, and if do not match an existing Windows user account
then access is denied. (If they do match then access can be
restricted based on a list of allowed usernames.)
I know it is possible to use Kerberos for this but I expected that
connecting to AD would be simpler. However, docs such as
<http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html> imply that
Apache connects to the LDAP server using a fixed username and
password, and then merely queries the existence of an object in the
directory that matches the username. If so how does it check the
password supplied by the user? Or is mod_authnz_ldap intended just
for authorization once the user has already been authenticated by some
other means?
The thing is, the authentication to Active Directory itself does
exactly what I want. If I could configure Apache to connect to AD
over LDAP using the username and password given by the user, and allow
or deny access based on that, there would be no need to issue a
directory query. But I guess that's not how it works?
(I am trying to set up mod_authnz_ldap following those instructions
but I don't know how to make the right LDAP search string. If I use
the Active Directory Browser (adb.sourceforge.net) giving
'DC=wcl,DC=local' as the base DN then I can see 'WCL Logins' and under
that 'WCL Users' which contains the user objects. I have been using
perl's Net::LDAP module to try to find the correct search filter
string before putting it into httpd.conf. However, specifying a DN
'CN=WCL Users,CN=WCL Logins,DC=wcl,DC=local' does not work. Any
suggestions?)
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: Confused about LDAP authentication with Active
Directory
Posted by Eric Covener <co...@gmail.com>.
> If so, it seems unnecessary in the case of Active Directory, since AD allows you
> to bind simply giving username and password (you don't have to give a full DN
> when binding).
It is unnecessary to perform the search if your users provide
something that can bind to the LDAP server directly.
Patches welcome (but it's unfortunately complicated by the
mod_ldap/mod_authnz_ldap separation)
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: Confused about LDAP authentication with Active Directory
Posted by Ed Avis <ed...@waniasset.com>.
Davide Bianchi <davide <at> walterisookeensufferukker.nl> writes:
>><http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html> imply that
>>Apache connects to the LDAP server using a fixed username and
>>password, and then merely queries the existence of an object in the
>>directory that matches the username. If so how does it check the
>>password supplied by the user?
>
>The problem is that in order to check the password, you need to 'bind'
>to the AD server using the correct DN, in order to find the DN you need
>to query the AD server with the username. But AD doesn't allow you to
>query it without first binding.
So what happens is this:
- Apache binds using a fixed username and password.
- It then tries to look up the username given using the query expression
specified in the config file.
- Then it binds again using this username and the password supplied by the user.
Is that correct?
If so, it seems unnecessary in the case of Active Directory, since AD allows you
to bind simply giving username and password (you don't have to give a full DN
when binding).
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Confused about LDAP authentication with Active
Directory
Posted by Eric Covener <co...@gmail.com>.
On Fri, Feb 27, 2009 at 9:30 AM, Mark H. Wood <mw...@iupui.edu> wrote:
> On Thu, Feb 26, 2009 at 01:59:13PM -0500, Eric Covener wrote:
>> In LDAPv3, the bind is optional.
>
> However, without a non-anonymous bind, ADS will cheerfully accept your
> connection and as cheerfully return no information, regardless the
> validity of your query. To actually get results out of ADS you have
> to identify yourself.
No disagreement here; OOTB ADS requires authentication for searches
and does provide a decent error msg.
A previous post dropped the context of my reply:
> Making a "query" without a "bind" in one sentence makes no sense to
> me. Be it an anonymous bind or a bind with a dn supplies, you bind,
> then you search.
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Confused about LDAP authentication with Active
Directory
Posted by "Mark H. Wood" <mw...@IUPUI.Edu>.
On Thu, Feb 26, 2009 at 01:59:13PM -0500, Eric Covener wrote:
> In LDAPv3, the bind is optional.
However, without a non-anonymous bind, ADS will cheerfully accept your
connection and as cheerfully return no information, regardless the
validity of your query. To actually get results out of ADS you have
to identify yourself.
--
Mark H. Wood, Lead System Programmer mwood@IUPUI.Edu
Friends don't let friends publish revisable-form documents.
Re: [users@httpd] Confused about LDAP authentication with Active
Directory
Posted by Peter Schober <pe...@univie.ac.at>.
* Eric Covener <co...@gmail.com> [2009-02-26 20:06]:
> In LDAPv3, the bind is optional.
OK, I see it in the RFC. But it seems it's not optional in httpd.
Also you can't produce searches without binds with e.g. ldapsearch.
And it won't make much of a difference to the OP, since an anonymous
bind (i.e. not specifiying AuthLDAPBindDN) and search will be
functionally equivalent to a connect + search.
cheers,
-peter
--
peter.schober@univie.ac.at - vienna university computer center
Universitaetsstrasse 7, A-1010 Wien, Austria/Europe
Tel. +43-1-4277-14155, Fax. +43-1-4277-9140
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Confused about LDAP authentication with Active
Directory
Posted by Eric Covener <co...@gmail.com>.
On Thu, Feb 26, 2009 at 1:42 PM, Peter Schober
<pe...@univie.ac.at> wrote:
> * Davide Bianchi <da...@walterisookeensufferukker.nl> [2009-02-26 19:33]:
>> Well, to be picky, an 100% compliant LDAP server doesn't require to
>> bind to do a first-level query, so you should be able to get your DN
>> without the need for a fixed username/password.
>
> Making a "query" without a "bind" in one sentence makes no sense to
> me. Be it an anonymous bind or a bind with a dn supplies, you bind,
> then you search.
In LDAPv3, the bind is optional.
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: Confused about LDAP authentication with Active Directory - use Apache2::AuthenMSAD
Posted by Ed Avis <ed...@waniasset.com>.
Krist van Besien <krist.vanbesien <at> gmail.com> writes:
>I've bene using the following module for apache AD authentication for
>quite some time.
>
>http://search.cpan.org/~reggers/Apache2-AuthenMSAD-0.02/AuthenMSAD.pm
Thanks - that's exactly what I needed. I now have this:
<Location "/test_auth">
AuthType Basic
AuthName "Secure Area"
PerlAuthenHandler Apache2::AuthenMSAD
PerlSetVar MSADDomain wcl.local
PerlSetVar MSADServer wcl-dc1
Require valid-user
</Location>
and it works beautifully.
>You might want to sue it together with this module:
>http://search.cpan.org/~reggers/Apache2-AuthenDBMCache-0.01/AuthenDBMCache.pm
>
>As having an AD bind for every http request slows down things quite
>substantially...
I'll set that up next.
Thanks to everyone who helped investigate the problem.
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: Confused about LDAP authentication with Active
Directory
Posted by Krist van Besien <kr...@gmail.com>.
On Fri, Feb 27, 2009 at 3:45 PM, André Warnier <aw...@ice-sa.com> wrote:
> Now, to the OP : since you can do that with Perl, won't you consider writing
> your own Apache/mod_perl LDAP authentication module, where you can do
> exactly the same as you did in your test program ?
> There are some stubs already available for that in CPAN.
I've bene using the following module for apache AD authentication for
quite some time.
http://search.cpan.org/~reggers/Apache2-AuthenMSAD-0.02/AuthenMSAD.pm
You might want to sue it together with this module:
http://search.cpan.org/~reggers/Apache2-AuthenDBMCache-0.01/AuthenDBMCache.pm
As having an AD bind for every http request slows down things quite
substantially...
Krist
--
krist.vanbesien@gmail.com
krist@vanbesien.org
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: Confused about LDAP authentication with Active Directory
Posted by Ed Avis <ed...@waniasset.com>.
Mark H. Wood <mwood <at> IUPUI.Edu> writes:
>I've forgotten whether there was some special complicating factor in
>the original request.
Probably not - just my inability to translate the directory structure as seen in
the browser into a query string. But in the end I found that Apache2::MSAD does
the job with a lot less fuss by just sending the username and password straight
to Active Directory (no searches needed).
Since I just want to authenticate, and not grant permissions based on Windows
user groups, this works perfectly. See
<http://article.gmane.org/gmane.comp.apache.user/82644>.
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: Confused about LDAP authentication with
Active Directory
Posted by "Mark H. Wood" <mw...@IUPUI.Edu>.
I've forgotten whether there was some special complicating factor in
the original request. This works here with 2.2.10:
AuthType Basic
AuthBasicProvider ldap
AuthName "ADS"
AuthBasicAuthoritative On
AuthLDAPURL "ldap://domain controller list/ou=Accounts,dc=ads,dc=iu,dc=edu?CN?one" STARTTLS
AuthLDAPBindDN "CN=initial bind user,OU=IN-ULib,OU=Accounts,DC=ads,DC=iu,DC=edu"
AuthLDAPBindPassword "secret password here"
AuthzLDAPAuthoritative Off
AuthLDAPGroupAttribute member
Require ldap-group cn=IN-ULib-Admins,ou=IN-ADMINS,ou=IN,dc=ADS,dc=IU,dc=Edu
I'm sure that some of that is debris from trying various things to
make it work, which I'm now scared to touch. :-/ Adjust the Require
directive, "domain controller list", "initial bind user", "secret
password here" and various DNs as needed.
--
Mark H. Wood, Lead System Programmer mwood@IUPUI.Edu
Friends don't let friends publish revisable-form documents.
[users@httpd] Re: Confused about LDAP authentication with Active Directory
Posted by Ed Avis <ed...@waniasset.com>.
André Warnier <aw <at> ice-sa.com> writes:
>Now, to the OP : since you can do that with Perl, won't you consider
>writing your own Apache/mod_perl LDAP authentication module, where you
>can do exactly the same as you did in your test program ?
Yes that thought crossed my mind. There are four ways I can think of to get it
working:
1. Use the standard Apache LDAP modules. Actually this might be more than one
way, because there are lots of different combinations of mod_auth_ldap,
mod_authz_ldap, mod_authnz_ldap and perhaps others... here I am using the last
of these.
2. Patch the Apache code to authenticate against Active Directory in a more
straightforward way, that is, just bind with the username and password given by
the user, and if it works then authentication succeeds.
3. Use Kerberos.
4. Write a custom handler in Perl.
I'm still on (1) at the moment because there are so many tantalizing
half-complete howto instructions on the web, I'm convinced that somebody
somewhere has been able to make it work.
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: Confused about LDAP authentication with Active
Directory
Posted by André Warnier <aw...@ice-sa.com>.
Marc Patermann wrote:
> Ed Avis schrieb:
>> Marc Patermann <hans.moser <at> ofd-sth.niedersachsen.de> writes:
[...]
>>
>> This spits out details of every user in the domain, with the
>> sAMAccountName
>> being the user's login.
> You were lucky. :)
>
No, he was just using Perl, and the magical CPAN library.
Great stuff for this kind of thing...
Now, to the OP : since you can do that with Perl, won't you consider
writing your own Apache/mod_perl LDAP authentication module, where you
can do exactly the same as you did in your test program ?
There are some stubs already available for that in CPAN.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: Confused about LDAP authentication with Active
Directory
Posted by Marc Patermann <ha...@ofd-sth.niedersachsen.de>.
Ed Avis schrieb:
> Marc Patermann <hans.moser <at> ofd-sth.niedersachsen.de> writes:
>
>> You mean the DN contains a component with a space in it!?
>> ou=WCL user,dc=foo,dc=bar
> Ah... 'ou'... I was using 'cn'.
This was only an example. Actually I know nothing about the DIT in AD. :)
> The corrected search query works, as
> demonstrated by the following perl script:
>
> #!/usr/bin/perl
> die "usage: $0 host domain username password\n" if @ARGV != 4;
> my ($host, $domain, $username, $password) = @ARGV;
> use Net::LDAP;
> my $ldap = new Net::LDAP($host) or die $@;
> my $mesg = $ldap->bind("$domain\\$username", password => $password);
> $mesg->code && die $mesg->error;
> $mesg = $ldap->search(base => 'ou=WCL Users,ou=WCL Logins,dc=wcl,dc=local',
> filter => '(objectClass=*)');
> $mesg->code && die $mesg->error;
> $_->dump foreach $mesg->entries;
>
> This spits out details of every user in the domain, with the sAMAccountName
> being the user's login.
You were lucky. :)
Marc
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: Confused about LDAP authentication with
Active Directory
Posted by "Mark H. Wood" <mw...@IUPUI.Edu>.
On Fri, Feb 27, 2009 at 12:18:14PM +0000, Ed Avis wrote:
> Davide Bianchi <davide <at> walterisookeensufferukker.nl> writes:
> >>I don't know what the extra '?cn?sub' at the end of the query string is for
> >
> >"cn" means that the attibute to use to login is the CN = common name,
>
> Surely that's not what I want? The username is in the sAMAccountName attribute.
'sAMAccountName' should always work in ADS and is probably what you
want to use with it. 'cn' works here, but I think I've seen ADS sites
where it didn't, or didn't have the same value.
--
Mark H. Wood, Lead System Programmer mwood@IUPUI.Edu
Friends don't let friends publish revisable-form documents.
Re: [users@httpd] Re: Confused about LDAP authentication with
Active ?Directory
Posted by "Mark H. Wood" <mw...@IUPUI.Edu>.
On Fri, Feb 27, 2009 at 05:19:18PM +0000, Ed Avis wrote:
> AuthLDAPBindDN "WCL\\tradingsystems"
That's not a DN. A DN would look something like:
sAMAccountName=tradingsystems,dc=WCL,dc=example,dc=com
--
Mark H. Wood, Lead System Programmer mwood@IUPUI.Edu
Friends don't let friends publish revisable-form documents.
[users@httpd] Re: Confused about LDAP authentication with Active Directory
Posted by Ed Avis <ed...@waniasset.com>.
Ed Avis <eda <at> waniasset.com> writes:
>Hmm, so what Apache does is first of all bind to the directory server, then do a
>search using the query string which returns the 'cn' (common name). Finally it
>constructs a distinguished name using this value of 'cn' and the password
>supplied by the user.
I meant to say, it constructs a DN using the common name (and the same ou=X,dc=Y
stuff that was used for searching) and then binds to the Directory server again
using this DN and the user's password.
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: Confused about LDAP authentication with Active Directory
Posted by Ed Avis <ed...@waniasset.com>.
Davide Bianchi <davide <at> walterisookeensufferukker.nl> writes:
>>>>I don't know what the extra '?cn?sub' at the end of the query string is for
>Heeemmmm... sorry (not enough coffee in my bloodstream), that is the
>attribute that is returned
Hmm, so what Apache does is first of all bind to the directory server, then do a
search using the query string which returns the 'cn' (common name). Finally it
constructs a distinguished name using this value of 'cn' and the password
supplied by the user.
Is that so? Is there a way I can test that the Active Directory server allows
you to bind giving a DN and password? I had really expected that Apache would
just pass through the username entered by the user. That seems much simpler.
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: Confused about LDAP authentication with Active
Directory
Posted by Davide Bianchi <da...@walterisookeensufferukker.nl>.
Ed Avis wrote:
> Davide Bianchi <davide <at> walterisookeensufferukker.nl> writes:
>
>>> I don't know what the extra '?cn?sub' at the end of the query string is for
>> "cn" means that the attibute to use to login is the CN = common name,
Heeemmmm... sorry (not enough coffee in my bloodstream), that is the
attribute that is returned
Definition taken from RFC1959
<ldapurl> ::= "ldap://" [ <hostport> ] "/" <dn> [ "?" <attributes>
[ "?" <scope> "?" <filter> ] ]
<hostport> ::= <hostname> [ ":" <portnumber> ]
<dn> ::= a string as defined in RFC 1485
<attributes> ::= NULL | <attributelist>
<attributelist> ::= <attributetype>
| <attributetype> [ "," <attributelist> ]
<attributetype> ::= a string as defined in RFC 1777
<scope> ::= "base" | "one" | "sub"
<filter> ::= a string as defined in RFC 1558
Explanations:
DN
Distinguished name
Attribute list
List of attributes you want returned
Scope
base = base object search
one = one level search
sub = subtree search
--
A fool and his money are soon using Windows.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: Confused about LDAP authentication with Active
Directory
Posted by Eric Covener <co...@gmail.com>.
On Fri, Feb 27, 2009 at 12:19 PM, Ed Avis <ed...@waniasset.com> wrote:
> Eric Covener <covener <at> gmail.com> writes:
>
>>>[Fri Feb 27 13:16:30 2009] [warn] [client 192.168.186.32] [2890] auth_ldap
>>>authenticate: user eda authentication failed; URI
>>>/cgi-bin/test_auth/index.html
>>>[ldap_search_ext_s() for user failed][Operations error]
>
>>If it made it out onto the wire, wireshark breaks down the protocol pretty
>>well.
>
> Thanks for the suggestion. I logged it with tethereal and got the following:
>
> 192.168.186.41 -> 192.168.186.8 DNS Standard query A wcl-dc1.wcl.local
> 192.168.186.8 -> 192.168.186.41 DNS Standard query response A 192.168.186.8
> 192.168.186.41 -> 192.168.186.8 TCP 35969 > ldap
> [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=604241179 TSER=0 WS=6
> 192.168.186.8 -> 192.168.186.41 TCP ldap > 35969
> [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460 WS=0 TSV=0 TSER=0
> 192.168.186.41 -> 192.168.186.8 TCP 35969 > ldap
> [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=604241179 TSER=0
> 192.168.186.41 -> 192.168.186.8 LDAP bindRequest(1) "<ROOT>" simple
> 192.168.186.8 -> 192.168.186.41 LDAP bindResponse(1) success
This looks anonymous, but it just might be brief output. Might want to
capture ldapsearch -D... for comparison
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: Confused about LDAP authentication with Active Directory
Posted by Ed Avis <ed...@waniasset.com>.
Eric Covener <covener <at> gmail.com> writes:
>>[Fri Feb 27 13:16:30 2009] [warn] [client 192.168.186.32] [2890] auth_ldap
>>authenticate: user eda authentication failed; URI
>>/cgi-bin/test_auth/index.html
>>[ldap_search_ext_s() for user failed][Operations error]
>If it made it out onto the wire, wireshark breaks down the protocol pretty
>well.
Thanks for the suggestion. I logged it with tethereal and got the following:
192.168.186.41 -> 192.168.186.8 DNS Standard query A wcl-dc1.wcl.local
192.168.186.8 -> 192.168.186.41 DNS Standard query response A 192.168.186.8
192.168.186.41 -> 192.168.186.8 TCP 35969 > ldap
[SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=604241179 TSER=0 WS=6
192.168.186.8 -> 192.168.186.41 TCP ldap > 35969
[SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460 WS=0 TSV=0 TSER=0
192.168.186.41 -> 192.168.186.8 TCP 35969 > ldap
[ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=604241179 TSER=0
192.168.186.41 -> 192.168.186.8 LDAP bindRequest(1) "<ROOT>" simple
192.168.186.8 -> 192.168.186.41 LDAP bindResponse(1) success
192.168.186.41 -> 192.168.186.8 TCP 35969 > ldap
[ACK] Seq=15 Ack=23 Win=5888 Len=0 TSV=604241179 TSER=30684923
192.168.186.41 -> 192.168.186.8 LDAP searchRequest(2)
"cn=users,dc=wcl,dc=local" wholeSubtree
192.168.186.8 -> 192.168.186.41 LDAP searchResDone(2) operationsError
(00000000: LdapErr: DSID-0C090627, comment: In order to perform this
operation a successful bind must be completed on the connection.,
data 0, vece)
192.168.186.41 -> 192.168.186.32 HTTP HTTP/1.1 500 Internal Server Error
(text/html)
My httpd.conf has
<Location "/test_auth">
AuthType Basic
AuthName "Secure Area"
AuthBasicProvider ldap
AuthLDAPBindDN "WCL\\tradingsystems"
AuthLDAPBindPassword xxx
AuthzLDAPAuthoritative Off
AuthLDAPURL \
"ldap://wcl-dc1:389/ou=WCL Users,ou=WCL Logins,dc=wcl,dc=local\
?sAMAccountName?sub"
Require valid-user
</Location>
So I can see that it's making an LDAP connection to host wcl-dc1 as specified.
One thing that mystifies me is the search it's running:
"cn=users,dc=wcl,dc=local". That doesn't match the AuthLDAPURL specified in my
configuration, although it has picked up the string 'wcl' from somewhere.
Also it seems that the initial bind to the Directory server failed (or never
happened), since the server responds 'a successful bind must be completed'. The
AuthLDAPBindDN and AuthLDAPBindPassword I put in the file do work if I use
Perl's Net::LDAP library to connect, but seemingly not here. If I deliberately
put a wrong password in the config file then the error message is no different.
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: Confused about LDAP authentication with Active
Directory
Posted by Eric Covener <co...@gmail.com>.
On Fri, Feb 27, 2009 at 8:21 AM, Ed Avis <ed...@waniasset.com> wrote:
> Upgrading to Apache 2.2.11 fixes the segfault. Instead now I get an error_log
> entry:
>
> [Fri Feb 27 13:16:30 2009] [warn] [client 192.168.186.32] [2890] auth_ldap
> authenticate: user eda authentication failed; URI /cgi-bin/test_auth/index.html
> [ldap_search_ext_s() for user failed][Operations error]
>
> Is there a way I can make it log what search it is running on the Directory and
> what results were returned?
>
Only at the LDAP client level, I'm not sure how to do it with openldap.
If it made it out onto the wire, wireshark breaks down the protocol pretty well.
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: Confused about LDAP authentication with Active Directory
Posted by Ed Avis <ed...@waniasset.com>.
Upgrading to Apache 2.2.11 fixes the segfault. Instead now I get an error_log
entry:
[Fri Feb 27 13:16:30 2009] [warn] [client 192.168.186.32] [2890] auth_ldap
authenticate: user eda authentication failed; URI /cgi-bin/test_auth/index.html
[ldap_search_ext_s() for user failed][Operations error]
Is there a way I can make it log what search it is running on the Directory and
what results were returned?
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: Confused about LDAP authentication with Active Directory
Posted by Ed Avis <ed...@waniasset.com>.
I installed debugging symbols and got a full backtrace. The top stack frame is
#0 uldap_connection_init (r=0xb715d830, ldc=0xb7f086e0)
at /usr/src/debug/httpd-2.2.10/modules/ldap/util_ldap.c:261
rc = <value optimized out>
ldap_option = 0
version = 3
result = (apr_ldap_err_t *) 0x0
timeOut = {tv_sec = 10, tv_usec = 0}
The source code for this location can be seen at
<https://svn.apache.org/repos/asf/httpd/httpd/tags/2.2.10/modules/
ldap/util_ldap.c>.
The bug is that it doesn't check whether 'result' is null. And I can also see
that happily, a null-pointer test was added in 2.2.11. So I'll upgrade and try
again.
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: Confused about LDAP authentication with Active Directory
Posted by Ed Avis <ed...@waniasset.com>.
Davide Bianchi <davide <at> walterisookeensufferukker.nl> writes:
>>I don't know what the extra '?cn?sub' at the end of the query string is for
>
>"cn" means that the attibute to use to login is the CN = common name,
Surely that's not what I want? The username is in the sAMAccountName attribute.
>>[Fri Feb 27 11:26:09 2009] [notice] child pid 18708 exit signal Segmentation
>>fault (11)
>
>It looks like the module is not compiled correctly or has other problems.
The module and Apache itself are packages shipped by Fedora. I turned on core
dumps (set 'CoreDumpDirectory /tmp' in httpd.conf) and got a backtrace with gdb:
#0 0x00158bbe in util_ald_cache_remove () from /etc/httpd/modules/mod_ldap.so
#1 0x00158daa in util_ald_cache_remove () from /etc/httpd/modules/mod_ldap.so
#2 0x00159549 in util_ald_cache_remove () from /etc/httpd/modules/mod_ldap.so
#3 0x00bfef78 in apr_xlate_open () from /etc/httpd/modules/mod_authnz_ldap.so
#4 0x00116cdf in __cxa_finalize () from /etc/httpd/modules/mod_auth_basic.so
#5 0x008978ad in ap_run_check_user_id () from /usr/sbin/httpd
#6 0x00899c40 in ap_process_request_internal () from /usr/sbin/httpd
#7 0x008ace8b in ap_process_request () from /usr/sbin/httpd
#8 0x008a9ab8 in ?? () from /usr/sbin/httpd
#9 0x008a4e9d in ap_run_process_connection () from /usr/sbin/httpd
#10 0x008b22d1 in ?? () from /usr/sbin/httpd
#11 0x008b25e3 in ?? () from /usr/sbin/httpd
#12 0x008b2f02 in ap_mpm_run () from /usr/sbin/httpd
#13 0x008877c9 in main () from /usr/sbin/httpd
Searching for this doesn't turn up anything obvious.
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: Confused about LDAP authentication with Active
Directory
Posted by Davide Bianchi <da...@walterisookeensufferukker.nl>.
Ed Avis wrote:
> I don't know what the extra '?cn?sub' at the end of the query string is for
"cn" means that the attibute to use to login is the CN = common name,
"sub" means that the query will return all the SUB-entries (as opposed
to 'one' that returns max 1 entry).
> [Fri Feb 27 11:26:09 2009] [notice] child pid 18708 exit signal Segmentation
> fault (11)
It looks like the module is not compiled correctly or has other problems.
Davide
--
Windows is the best $89 solitaire game you can buy.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: Confused about LDAP authentication with Active Directory
Posted by Ed Avis <ed...@waniasset.com>.
Marc Patermann <hans.moser <at> ofd-sth.niedersachsen.de> writes:
>You mean the DN contains a component with a space in it!?
>ou=WCL user,dc=foo,dc=bar
Ah... 'ou'... I was using 'cn'. The corrected search query works, as
demonstrated by the following perl script:
#!/usr/bin/perl
die "usage: $0 host domain username password\n" if @ARGV != 4;
my ($host, $domain, $username, $password) = @ARGV;
use Net::LDAP;
my $ldap = new Net::LDAP($host) or die $@;
my $mesg = $ldap->bind("$domain\\$username", password => $password);
$mesg->code && die $mesg->error;
$mesg = $ldap->search(base => 'ou=WCL Users,ou=WCL Logins,dc=wcl,dc=local',
filter => '(objectClass=*)');
$mesg->code && die $mesg->error;
$_->dump foreach $mesg->entries;
This spits out details of every user in the domain, with the sAMAccountName
being the user's login.
In httpd.conf I have
<Location "/test_auth">
AuthType Basic
AuthName "Secure Area"
AuthBasicProvider ldap
AuthzLDAPAuthoritative Off
AuthLDAPURL "ldap://wcl-dc1:389/ou=WCL Users,ou=WCL
Logins,dc=wcl,dc=local?cn?sub"
Require valid-user
</Location>
I don't know what the extra '?cn?sub' at the end of the query string is for but
various examples have it so I cargo-culted it in.
When I try to fetch /test_auth/index.html I am prompted for a username and
password but the page that appears is blank. The error log has
[Fri Feb 27 11:26:09 2009] [notice] child pid 18708 exit signal Segmentation
fault (11)
So I suppose I need to run Apache under the debugger, or make it generate a core
dump, to see where it's crashing. Unless you can spot anything obvious from the
above.
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: Confused about LDAP authentication with Active
Directory
Posted by Marc Patermann <ha...@ofd-sth.niedersachsen.de>.
Ed Avis schrieb:
> This means that to get the current code working, I must
> find the right LDAP search expression to locate users in the Directory.
Yes.
> This
> might be complicated by the fact that they are under 'WCL users' which contains
> a space character.
You mean the DN contains a component with a space in it!?
ou=WCL user,dc=foo,dc=bar
That's not a problem. I have such DNs in my DIT myself.
Marc
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: Confused about LDAP authentication with Active Directory
Posted by Ed Avis <ed...@waniasset.com>.
Peter Schober <peter.schober <at> univie.ac.at> writes:
>But it seems it's currently simply not possible to configure either
>a. to use the provided username "as is", or
>b. to fill in a DN-template (e.g. uid=%s,ou=users,dc=example,dc=org)
>so this is all rather pointless, until someone contributes code.
Thanks for clarifying. This means that to get the current code working, I must
find the right LDAP search expression to locate users in the Directory. This
might be complicated by the fact that they are under 'WCL users' which contains
a space character.
--
Ed Avis <ed...@waniasset.com>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Confused about LDAP authentication with Active
Directory
Posted by Peter Schober <pe...@univie.ac.at>.
* Davide Bianchi <da...@walterisookeensufferukker.nl> [2009-02-26 19:33]:
> Well, to be picky, an 100% compliant LDAP server doesn't require to
> bind to do a first-level query, so you should be able to get your DN
> without the need for a fixed username/password.
Making a "query" without a "bind" in one sentence makes no sense to
me. Be it an anonymous bind or a bind with a dn supplies, you bind,
then you search. But this is all besides the point.
There might be cases where you already know (or don't need) the user's
DN, so a bind-search before the bind might not always be needed.
But it seems it's currently simply not possible to configure either
a. to use the provided username "as is", or
b. to fill in a DN-template (e.g. uid=%s,ou=users,dc=example,dc=org)
so this is all rather pointless, until someone contributes code.
Also note that while the bind-search-bind might not be necessary in
some cases, it should also not pose any problems, neither security nor
performance wise. If your DSA can't handle an anonymous bind+search
before the bind you're in trouble anyway (e.g. need to index the
attribute which is used for searching).
cheers,
-pete
--
peter.schober@univie.ac.at - vienna university computer center
Universitaetsstrasse 7, A-1010 Wien, Austria/Europe
Tel. +43-1-4277-14155, Fax. +43-1-4277-9140
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Confused about LDAP authentication with Active
Directory
Posted by Davide Bianchi <da...@walterisookeensufferukker.nl>.
Bennett, Tony wrote:
> While this is true for 100% compliant LDAP servers, MS has "embraced and extended"
Well, to be picky, an 100% compliant LDAP server doesn't require to bind
to do a first-level query, so you should be able to get your DN without
the need for a fixed username/password.
Davide
--
Windows is the only solitaire game that requires 16 MB of RAM.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Confused about LDAP authentication with Active
Directory
Posted by "Bennett, Tony" <Be...@con-way.com>.
> -----Original Message-----
> From: Davide Bianchi [mailto:davide@walterisookeensufferukker.nl]
> Sent: Thursday, February 26, 2009 6:51 AM
> To: users@httpd.apache.org
> Subject: Re: [users@httpd] Confused about LDAP authentication with Active Directory
>
> Ed Avis wrote:
> > <http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html> imply that
> > Apache connects to the LDAP server using a fixed username and
> > password, and then merely queries the existence of an object in the
> > directory that matches the username. If so how does it check the
> > password supplied by the user?
>
> The problem is that in order to check the password, you need to 'bind'
> to the AD server using the correct DN, in order to find the DN you need
> to query the AD server with the username. But AD doesn't allow you to
> query it without first binding.
>
> So you need to bind in order to query, but you need to query to bind. Is
> a sort-of catch-22 situation. Hence the need for a fixed
> username/password to do the first query.
>
> Davide
While this is true for 100% compliant LDAP servers, MS has "embraced and extended"
what ActiveDirectory will accept for the user's DN... by "allowing" a Windows NT
style login in the place of the DN.
The Windows NT style login is in this format:
Domain\username
Where Domain is the ActiveDirectory Domain, and the username is the ActiveDirectory
samAccountName.
-tony
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Confused about LDAP authentication with Active
Directory
Posted by Davide Bianchi <da...@walterisookeensufferukker.nl>.
Ed Avis wrote:
> <http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html> imply that
> Apache connects to the LDAP server using a fixed username and
> password, and then merely queries the existence of an object in the
> directory that matches the username. If so how does it check the
> password supplied by the user?
The problem is that in order to check the password, you need to 'bind'
to the AD server using the correct DN, in order to find the DN you need
to query the AD server with the username. But AD doesn't allow you to
query it without first binding.
So you need to bind in order to query, but you need to query to bind. Is
a sort-of catch-22 situation. Hence the need for a fixed
username/password to do the first query.
Davide
--
Violence, rude language, excessive drinking,
paganism. It's hard to find children's books like that these
days.
--Stig Morten Valstad on alt.sysadmin.recovery
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org