You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Mauricio Cavalcanti <ma...@hotmail.com> on 2007/06/06 20:51:07 UTC
[users@httpd] Apache using AD autentication
Hi,
i put a apache web server into windows network working with Active Directory
(AD). After that, I put many sites on it, but here is the problem:
My workstations is running w2k (authenticated in AD). Some sites has to be
restricted only to some (AD) users or groups and I want to use the
workstation autentication to check if the user is able or not to see the web
page without any prompt.
What´s the best way to do this?
Thanks in advance,
Mauricio
_________________________________________________________________
MSN Hotmail, o maior webmail do Brasil. http://www.hotmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Apache using AD autentication
Posted by Mauricio Cavalcanti <ma...@hotmail.com>.
Hi,
I´ve downloaded apr and apr-util-1.2.8 from the same site (apr.apache.org)
and...
APR:
./configure --prefix=/usr/local
make
make install
I had to install APR to install APR-UTIL...
APR_UTIL:
./configure --prefix=/usr/local/apr-util --with-apr=/usr/local/apr
--with-ldap
make
make install
I used --with-ldap and not --enable-ldap as you wrote... using
--enable-ldap, I could not install Apache ("make[3]: **
[mod_authnz_ldap.lo]")
No errors with ./configure, make or make install in apr, apr-util or apache.
Please, can you explain the text above?
"According to the above you're using the bundled apr and an external
apr-util. That just seems like it'll all end in tears."
Thanks in advance,
Mauricio.
On Jun 29, 2007, at 11:33 AM, Mauricio Cavalcanti wrote:
>installed apr and apr-util (tgz)
Was apr-util compiled with LDAP support? That's not on by default.
APR-util has to be compiled with --enable-ldap and if you use the
bundled apr-util, it'll be passed that flag from httpd ./configure.
>httpd-2.2.4:
>./configure \
> --prefix=/usr/local/httpd-2.2.4 \
> --enable-so \
> --enable-cgi \
> --enable-info \
> --enable-rewrite \
> --enable-speling \
> --enable-usertrack \
> --enable-deflate \
> --enable-ssl \
> --enable-mime-magic \
> --enable-authnz-ldap \
> --enable-ldap \
> --with-apr-util=/usr/local/apr-util
<..>
>I tryied to find where can i get or how can i create the modules
>mod_auth_ldap.so and util_ldap.so, but i didn?t find any info about.
Looking through your ./configure output for httpd, what does it say
when it tries to enable the LDAP stuff?
According to the above you're using the bundled apr and an external
apr-util. That just seems like it'll all end in tears.
S.
--
Sander Temme
sctemme@apache.org
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
_________________________________________________________________
MSN Hotmail, o maior webmail do Brasil. http://www.hotmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Apache using AD autentication
Posted by Eric DuToit <er...@fedex.com>.
I don't know if you can add multiple LDAP (AD) entries to the <Directory> container.
I've (intentionally) moved well away from Windows support and don't have any way to test it or I'd give it a go.
Eric
-----Original Message-----
From: Dan_Mitton@Notes.YMP.GOV [mailto:Dan_Mitton@Notes.YMP.GOV]
Sent: Wednesday, June 06, 2007 6:02 PM
To: users@httpd.apache.org
Subject: RE: [users@httpd] Apache using AD autentication
Does this LDAP authentication mentioned in the URL link work across
multiple AD domains?
Dan
(sorry about the crappy top reply courtesy "notes")
Please respond to users@httpd.apache.org
To: <us...@httpd.apache.org>
cc: (bcc: Dan Mitton/YD/RWDOE)
Subject: RE: [users@httpd] Apache using AD autentication
LSN: Not Relevant
User Filed as: Not a Record
What have you done already to attempt to accomplish this??
I don't know if this doc will work, but a quick Google search for "apache
active directory authentication" turned up a slew of links with this one
being at the top:
http://www.trustix.org/wiki/index.php/Active_Directory_Authentication_with_Apache
One of the best ways to get answers on this and other mailing lists is to
do a little leg work (a.k.a. RTFM & STFW) before you ask questions, and
then, detail what you have already done to attempt to resolve your
question in the e-mail so that a.) We know what common things have already
been tried, and b.) we know that you're really interested in getting this
resolved and are not just trying to waste others time.
I think it was Sashi that linked to Eric Steven Raymond's "How To ask
Questions the Smart Way"
http://www.catb.org/~esr/faqs/smart-questions.html which was a nice way
of saying "Search the Fabulous Web" (STFW)
--
Eric DuToit
(sorry about the crappy top reply courtesy "outlook")
-----Original Message-----
From: Mauricio Cavalcanti [mailto:mauriciopcavalcanti@hotmail.com]
Sent: Wednesday, June 06, 2007 1:51 PM
To: users@httpd.apache.org
Subject: [users@httpd] Apache using AD autentication
Hi,
i put a apache web server into windows network working with Active
Directory
(AD). After that, I put many sites on it, but here is the problem:
My workstations is running w2k (authenticated in AD). Some sites has to be
restricted only to some (AD) users or groups and I want to use the
workstation autentication to check if the user is able or not to see the
web
page without any prompt.
What´s the best way to do this?
Thanks in advance,
Mauricio
_________________________________________________________________
MSN Hotmail, o maior webmail do Brasil. http://www.hotmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache using AD autentication
Posted by Sander Temme <sc...@apache.org>.
On Jun 29, 2007, at 11:33 AM, Mauricio Cavalcanti wrote:
> installed apr and apr-util (tgz)
Was apr-util compiled with LDAP support? That's not on by default.
APR-util has to be compiled with --enable-ldap and if you use the
bundled apr-util, it'll be passed that flag from httpd ./configure.
> httpd-2.2.4:
> ./configure \
> --prefix=/usr/local/httpd-2.2.4 \
> --enable-so \
> --enable-cgi \
> --enable-info \
> --enable-rewrite \
> --enable-speling \
> --enable-usertrack \
> --enable-deflate \
> --enable-ssl \
> --enable-mime-magic \
> --enable-authnz-ldap \
> --enable-ldap \
> --with-apr-util=/usr/local/apr-util
<..>
> I tryied to find where can i get or how can i create the modules
> mod_auth_ldap.so and util_ldap.so, but i didn´t find any info about.
Looking through your ./configure output for httpd, what does it say
when it tries to enable the LDAP stuff?
According to the above you're using the bundled apr and an external
apr-util. That just seems like it'll all end in tears.
S.
--
Sander Temme
sctemme@apache.org
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Apache using AD autentication
Posted by Mauricio Cavalcanti <ma...@hotmail.com>.
Sorry, but i traveled for a while and stop testing.
I saw this article before writing to this maillist, but i don´t have
mod_auth_ldap.so and util_ldap.so in my system.
Here is the history:
installed libmcrypt and libmcrypt-devel (rpm)
installed apr and apr-util (tgz)
httpd-2.2.4:
./configure \
--prefix=/usr/local/httpd-2.2.4 \
--enable-so \
--enable-cgi \
--enable-info \
--enable-rewrite \
--enable-speling \
--enable-usertrack \
--enable-deflate \
--enable-ssl \
--enable-mime-magic \
--enable-authnz-ldap \
--enable-ldap \
--with-apr-util=/usr/local/apr-util
php-5.2.2:
./configure \
--with-apxs2=/usr/local/apache/bin/apxs \
--prefix=/usr/local/apache/php \
--with-config-file-path=/usr/local/apache/php \
--enable-force-cgi-redirect \
--disable-cgi \
--with-zlib \
--with-gettext \
--with-gdbm \
--libdir=/usr/lib \
--with-oracle=/u01/oracle/product/10.2.0 \
--without-mysql \
--with-oci8-instant-client \
--with-oracle \
--with-oci8=/u01/oracle/product/10.2.0 \
--enable-mbstring \
--with-openssl \
--with-mcrypt
I tryied to find where can i get or how can i create the modules
mod_auth_ldap.so and util_ldap.so, but i didn´t find any info about.
Thanks any help,
Mauricio.
>From: "Eric DuToit" <er...@fedex.com>
>Reply-To: users@httpd.apache.org
>To: <us...@httpd.apache.org>
>Subject: RE: [users@httpd] Apache using AD autentication
>Date: Wed, 6 Jun 2007 14:12:37 -0500
>
>
>What have you done already to attempt to accomplish this??
>
>I don't know if this doc will work, but a quick Google search for "apache
>active directory authentication" turned up a slew of links with this one
>being at the top:
>http://www.trustix.org/wiki/index.php/Active_Directory_Authentication_with_Apache
>
>One of the best ways to get answers on this and other mailing lists is to
>do a little leg work (a.k.a. RTFM & STFW) before you ask questions, and
>then, detail what you have already done to attempt to resolve your question
>in the e-mail so that a.) We know what common things have already been
>tried, and b.) we know that you're really interested in getting this
>resolved and are not just trying to waste others time.
>
>I think it was Sashi that linked to Eric Steven Raymond's "How To ask
>Questions the Smart Way" http://www.catb.org/~esr/faqs/smart-questions.html
> which was a nice way of saying "Search the Fabulous Web" (STFW)
>
>
>--
>Eric DuToit
>
>(sorry about the crappy top reply courtesy "outlook")
>
>
>
>-----Original Message-----
>From: Mauricio Cavalcanti [mailto:mauriciopcavalcanti@hotmail.com]
>Sent: Wednesday, June 06, 2007 1:51 PM
>To: users@httpd.apache.org
>Subject: [users@httpd] Apache using AD autentication
>
>Hi,
>i put a apache web server into windows network working with Active
>Directory
>(AD). After that, I put many sites on it, but here is the problem:
>
>My workstations is running w2k (authenticated in AD). Some sites has to be
>restricted only to some (AD) users or groups and I want to use the
>workstation autentication to check if the user is able or not to see the
>web
>page without any prompt.
>
>What´s the best way to do this?
>
>Thanks in advance,
>Mauricio
>
>_________________________________________________________________
>MSN Hotmail, o maior webmail do Brasil. http://www.hotmail.com
>
>
>---------------------------------------------------------------------
>The official User-To-User support forum of the Apache HTTP Server Project.
>See <URL:http://httpd.apache.org/userslist.html> for more info.
>To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
>For additional commands, e-mail: users-help@httpd.apache.org
>
>
>---------------------------------------------------------------------
>The official User-To-User support forum of the Apache HTTP Server Project.
>See <URL:http://httpd.apache.org/userslist.html> for more info.
>To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
>For additional commands, e-mail: users-help@httpd.apache.org
>
_________________________________________________________________
MSN Busca: fácil, rápido, direto ao ponto. http://search.msn.com.br
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Apache using AD autentication
Posted by Da...@Notes.YMP.GOV.
Does this LDAP authentication mentioned in the URL link work across
multiple AD domains?
Dan
(sorry about the crappy top reply courtesy "notes")
Please respond to users@httpd.apache.org
To: <us...@httpd.apache.org>
cc: (bcc: Dan Mitton/YD/RWDOE)
Subject: RE: [users@httpd] Apache using AD autentication
LSN: Not Relevant
User Filed as: Not a Record
What have you done already to attempt to accomplish this??
I don't know if this doc will work, but a quick Google search for "apache
active directory authentication" turned up a slew of links with this one
being at the top:
http://www.trustix.org/wiki/index.php/Active_Directory_Authentication_with_Apache
One of the best ways to get answers on this and other mailing lists is to
do a little leg work (a.k.a. RTFM & STFW) before you ask questions, and
then, detail what you have already done to attempt to resolve your
question in the e-mail so that a.) We know what common things have already
been tried, and b.) we know that you're really interested in getting this
resolved and are not just trying to waste others time.
I think it was Sashi that linked to Eric Steven Raymond's "How To ask
Questions the Smart Way"
http://www.catb.org/~esr/faqs/smart-questions.html which was a nice way
of saying "Search the Fabulous Web" (STFW)
--
Eric DuToit
(sorry about the crappy top reply courtesy "outlook")
-----Original Message-----
From: Mauricio Cavalcanti [mailto:mauriciopcavalcanti@hotmail.com]
Sent: Wednesday, June 06, 2007 1:51 PM
To: users@httpd.apache.org
Subject: [users@httpd] Apache using AD autentication
Hi,
i put a apache web server into windows network working with Active
Directory
(AD). After that, I put many sites on it, but here is the problem:
My workstations is running w2k (authenticated in AD). Some sites has to be
restricted only to some (AD) users or groups and I want to use the
workstation autentication to check if the user is able or not to see the
web
page without any prompt.
What´s the best way to do this?
Thanks in advance,
Mauricio
_________________________________________________________________
MSN Hotmail, o maior webmail do Brasil. http://www.hotmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Apache using AD autentication
Posted by Eric DuToit <er...@fedex.com>.
What have you done already to attempt to accomplish this??
I don't know if this doc will work, but a quick Google search for "apache active directory authentication" turned up a slew of links with this one being at the top:
http://www.trustix.org/wiki/index.php/Active_Directory_Authentication_with_Apache
One of the best ways to get answers on this and other mailing lists is to do a little leg work (a.k.a. RTFM & STFW) before you ask questions, and then, detail what you have already done to attempt to resolve your question in the e-mail so that a.) We know what common things have already been tried, and b.) we know that you're really interested in getting this resolved and are not just trying to waste others time.
I think it was Sashi that linked to Eric Steven Raymond's "How To ask Questions the Smart Way" http://www.catb.org/~esr/faqs/smart-questions.html which was a nice way of saying "Search the Fabulous Web" (STFW)
--
Eric DuToit
(sorry about the crappy top reply courtesy "outlook")
-----Original Message-----
From: Mauricio Cavalcanti [mailto:mauriciopcavalcanti@hotmail.com]
Sent: Wednesday, June 06, 2007 1:51 PM
To: users@httpd.apache.org
Subject: [users@httpd] Apache using AD autentication
Hi,
i put a apache web server into windows network working with Active Directory
(AD). After that, I put many sites on it, but here is the problem:
My workstations is running w2k (authenticated in AD). Some sites has to be
restricted only to some (AD) users or groups and I want to use the
workstation autentication to check if the user is able or not to see the web
page without any prompt.
What´s the best way to do this?
Thanks in advance,
Mauricio
_________________________________________________________________
MSN Hotmail, o maior webmail do Brasil. http://www.hotmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache using AD autentication
Posted by Da...@Notes.YMP.GOV.
If you have a single AD domain, it seems like mod_auth_kerb works well. I
have not been able to get it working across multiple AD domains.
Please respond to users@httpd.apache.org
To: users@httpd.apache.org
cc: (bcc: Dan Mitton/YD/RWDOE)
Subject: [users@httpd] Apache using AD autentication
LSN: Not Relevant
User Filed as: Not a Record
Hi,
i put a apache web server into windows network working with Active
Directory
(AD). After that, I put many sites on it, but here is the problem:
My workstations is running w2k (authenticated in AD). Some sites has to be
restricted only to some (AD) users or groups and I want to use the
workstation autentication to check if the user is able or not to see the
web
page without any prompt.
What´s the best way to do this?
Thanks in advance,
Mauricio
_________________________________________________________________
MSN Hotmail, o maior webmail do Brasil. http://www.hotmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org