Configuring Cert Based and LDAP Authorization in Apache Virtual Host

Phoenix

5/6/23, 3:39 PM

We have a scenario where we have an application that only accept client certs for authentication and that setup works well (configured in Apache VHost). However as part new requirement we would like to also check whether that user is part of a certain group in LDAP and if not then the request should get rejected.

Note in the below excerpt we were trying with a separate user being sent in the request header, extracting that and then checking against LDAP, however the logic remains the same.

The problem is that LDAP Search is NOT getting invoked at all.

<LocationMatch ^>
     allow from all
     SSLOptions +StdEnvVars
     SSLRequireSSL
     SSLRenegBufferSize 10485760
     SSLRequire %{SSL_CLIENT_S_DN_CN} in {"myusername"}
     SSLVerifyClient require
     SSLVerifyDepth  5
     SSLUserName SSL_CLIENT_S_DN_CN
     SetEnvIf x-user ".+" X_USER=$0

#AuthName "Apache2 LDAP Check"
#AuthType Basic
AuthBasicProvider ldap
LDAPReferrals Off
AuthLDAPUrl ldap://ldap.corp.orgn.com:389/dc=corp,dc=orgn,dc=com?sAMAccountName?sub?(objectClass=*)
AuthLDAPBindDN "[email protected]"
AuthLDAPBindPassword "asdfg"

Require valid-user
AuthLDAPGroupAttribute memberUid
AuthLDAPGroupAttributeIsDN off

#Require ldap-group CN=orgn-users,OU=Standard,OU=Security,OU=Groups,DC=corp,DC=orgn,DC=com 

#Require ldap-filter "&(objectClass=user)(sAMAccountName=%{X_USER})(memberof=CN=orgn-users,OU=Standard,OU=Security,OU=Groups,DC=corp,DC=orgn,DC=com)"

RequestHeader set userid "%{X_USER}e"

</LocationMatch>

0 + 0

mod-auth-ldap

apache-2.4

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Configuring Cert Based and LDAP Authorization in Apache Virtual Host

TH: การกำหนดค่าตามใบรับรองและการอนุญาต LDAP ในโฮสต์เสมือนของ Apache

RO: Configurarea autorizației bazate pe certificat și LDAP în Apache Virtual Host

RU: Configuring Cert Based and LDAP Authorization in Apache Virtual Host

VI: Định cấu hình Ủy quyền dựa trên chứng chỉ và LDAP trong Máy chủ ảo Apache

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.