You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by west alto <we...@gmail.com> on 2010/07/07 14:56:52 UTC
[users@httpd] mod_ldap not caching
Hi Gurus,
I have a subversion server that authenticates with windows ad and i
want to cache my authentication for better performance.
here's my setting:
LoadModule authnz_ldap_module
/usr/lib/apache2-prefork/mod_authnz_ldap.so
LoadModule ldap_module /usr/lib/apache2-prefork/mod_ldap.so
LDAPTrustedMode SSL
LDAPVerifyServerCert off
LDAPSharedCacheSize 500000
LDAPCacheEntries 1024
LDAPCacheTTL 43200
LDAPOpCacheEntries 1024
LDAPOpCacheTTL 43200
LDAPSharedCacheFile /srv/home/svn/ldap_cache
LDAPConnectionTimeout 10
<Location /ldap-status>
SetHandler ldap-status
Order allow,deny
Allow from all
</Location>
LDAPTrustedClientCert CERT_BASE64 /etc/apache2/ssl.crt/ad1.cer
LDAPTrustedClientCert CERT_BASE64 /etc/apache2/ssl.crt/ad2.cer
<Location /unix-repo>
DAV svn
SVNPath /srv/svn/unix-repo
AuthName "Please use your ACTIVE DIRECTORY for Authentication"
AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative off
Include /etc/apache2/.ldapbinddn
AuthLDAPURL "ldaps://172.23.12.137
172.23.12.136:636/DC=domain,DC=local?sAMAccountName?sub?(objectClass=user)"
SSLRequireSSL
AuthzSVNAccessFile /srv/config/svn_acl/unix-repo
Require valid-user
SVNPathAuthz off
</Location>
Browsing https://localhost/ldap-status show an empty LDAP Cache Information
Can anyone help me, what's missing?
Thanks,
West
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_ldap not caching
Posted by Eric Covener <co...@gmail.com>.
On Wed, Jul 7, 2010 at 9:54 AM, west alto <we...@gmail.com> wrote:
> Thanks, it works but i cannot connect to my windows ad as i need those
> certificates, where is the best ting to place LDAPTrustedClientCert?
Is it inherited correctly if you place it in your base config outside
of any <vhost> ?
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_ldap not caching
Posted by west alto <we...@gmail.com>.
Thanks, it works but i cannot connect to my windows ad as i need those
certificates, where is the best ting to place LDAPTrustedClientCert?
On Wed, Jul 7, 2010 at 9:39 PM, Eric Covener <co...@gmail.com> wrote:
> On Wed, Jul 7, 2010 at 9:29 AM, west alto <we...@gmail.com> wrote:
>> This are the only mod_ldap directives inside my virtual host:
>>
>> <VirtualHost _default_:443>
>>
>> LDAPTrustedClientCert CERT_BASE64 /etc/apache2/ssl.crt/ad1.cer
>> LDAPTrustedClientCert CERT_BASE64 /etc/apache2/ssl.crt/ad2.cer
>
> I think that would do it
>
> --
> Eric Covener
> covener@gmail.com
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_ldap not caching
Posted by Eric Covener <co...@gmail.com>.
On Wed, Jul 7, 2010 at 9:29 AM, west alto <we...@gmail.com> wrote:
> This are the only mod_ldap directives inside my virtual host:
>
> <VirtualHost _default_:443>
>
> LDAPTrustedClientCert CERT_BASE64 /etc/apache2/ssl.crt/ad1.cer
> LDAPTrustedClientCert CERT_BASE64 /etc/apache2/ssl.crt/ad2.cer
I think that would do it
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_ldap not caching
Posted by west alto <we...@gmail.com>.
This are the only mod_ldap directives inside my virtual host:
<VirtualHost _default_:443>
ServerName 172.23.13.244
HostnameLookups Off
UseCanonicalName Off
ServerSignature Off
LogLevel debug
ErrorLog /var/log/apache2/svn-ssl-error_log
#CustomLog /var/log/apache2/svn-ssl-access_log "%t - %h - %u -
%{SVN-ACTION}e" env=SVN-ACTION
TransferLog /var/log/apache2/svn-ssl-access_log
SSLEngine on
SSLCertificateFile /etc/apache2/ssl.crt/172.23.13.244.crt
SSLCertificateKeyFile /etc/apache2/ssl.key/172.23.13.244.key
SSLProtocol all
SSLCipherSuite HIGH:MEDIUM
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
LDAPTrustedClientCert CERT_BASE64 /etc/apache2/ssl.crt/ad1.cer
LDAPTrustedClientCert CERT_BASE64 /etc/apache2/ssl.crt/ad2.cer
<Location /ldap-status>
SetHandler ldap-status
Order allow,deny
Allow from all
</Location>
This are outside my virtualhost:
LDAPTrustedMode SSL
LDAPVerifyServerCert off
LDAPSharedCacheSize 500000
LDAPCacheEntries 1024
LDAPCacheTTL 43200
LDAPOpCacheEntries 1024
LDAPOpCacheTTL 43200
LDAPSharedCacheFile /srv/home/svn/ldap_cache
LDAPConnectionTimeout 10
Thanks,
On Wed, Jul 7, 2010 at 9:20 PM, Eric Covener <co...@gmail.com> wrote:
> On Wed, Jul 7, 2010 at 9:18 AM, west alto <we...@gmail.com> wrote:
>> It's not a truncated page, its empty with only title in it.
>>
>
> Sounds like a match for the issue I described. Try to purge mod_ldap
> directives from your vhosts.
>
> --
> Eric Covener
> covener@gmail.com
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_ldap not caching
Posted by Eric Covener <co...@gmail.com>.
On Wed, Jul 7, 2010 at 9:18 AM, west alto <we...@gmail.com> wrote:
> It's not a truncated page, its empty with only title in it.
>
Sounds like a match for the issue I described. Try to purge mod_ldap
directives from your vhosts.
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_ldap not caching
Posted by west alto <we...@gmail.com>.
It's not a truncated page, its empty with only title in it.
This is the version of apache running in sles10 sp3.
apache2-2.2.3-16.29.2
apache2-prefork-2.2.3-16.29.2
and the LDAPSharedCacheFile is empty.
subversion:/etc/apache2 # cat /srv/home/svn/ldap_cache
¡subversion:/etc/apache2 #
On Wed, Jul 7, 2010 at 8:59 PM, Eric Covener <co...@gmail.com> wrote:
> On Wed, Jul 7, 2010 at 8:56 AM, west alto <we...@gmail.com> wrote:
>> Browsing https://localhost/ldap-status show an empty LDAP Cache Information
>>
>
> If it's a truncated page with just the title, it is a recently fixed
> defect. Using mod_ldap directives in your vhosts triggers it, which
> you may be able to avoid.
>
> --
> Eric Covener
> covener@gmail.com
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] mod_ldap not caching
Posted by Eric Covener <co...@gmail.com>.
On Wed, Jul 7, 2010 at 8:56 AM, west alto <we...@gmail.com> wrote:
> Browsing https://localhost/ldap-status show an empty LDAP Cache Information
>
If it's a truncated page with just the title, it is a recently fixed
defect. Using mod_ldap directives in your vhosts triggers it, which
you may be able to avoid.
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org