Re: OpenLDAP configuration for ldap-group authentication on Apache2.x

Buchan,

That worked for me. Thanks. I have another question for the mailing list.

Can I place the AuthLDAPURL, AuthzLDAPAuthoritative, AuthLDAPGroupAttributeIsDN and AuthLDAPGroupAttribute outside of <Location> and <Directory> and inside of <VirtualHost> and place just Require and Satisfy within the <Location> and <Directory> tags? I am asking, because all of the <Location> an <Directory> entries are going to be using the same LDAP server and will be accessed through membership in LDAP groups.

 AuthLDAPURL "ldaps://ldap-slaves......./ou=People,...?uid?sub?

(objectclass=posixAccount)" Satisfy All AuthzLDAPAuthoritative on AuthLDAPGroupAttributeIsDN off AuthLDAPGroupAttribute memberUid Require ldap-group cn=developers,ou=Group,.....

Thank you, Loren

On Jun 3, 2010, at 02:20 AM, Buchan Milne wrote:

On Wednesday, 2 June 2010 15:56:15 Loren Cahlander wrote:

...

What does Apache2.x use to authenticate a user that belongs to a group? My initial requirement for groupOfUniqueNames was that of http://exist-db.org/ldap-security.html#N10149 , but since I am a contributor to the eXist database project, then I can change the code to meet a common specification. My priority is the get Subversion to get the authenticated user of a group.

The following works with SVN to authenticate agains a single user:

   <Location /svn>
      DAV svn
      SVNParentPath /var/local/svn/foo.exist-db.org
      SVNAutoversioning on
      SVNListParentPath on
      AuthBasicProvider ldap
      AuthUserFile /dev/null
      AuthType Basic
      AuthName "Subversion Authentication"
      AuthLDAPBindDN "cn=admin,dc=exist-db,dc=org"
      AuthLDAPBindPassword "1234"
      AuthLDAPUrl "ldap://127.0.0.1:389/ou=Users,dc=exist-db,dc=org"
      AuthLDAPCompareDNOnServer off
      Require ldap-user lcahlander
      AuthzLDAPAuthoritative on
   </Location>

When I would like for it to be:

   <Location /svn>
      DAV svn
      SVNParentPath /var/local/svn/foo.exist-db.org
      SVNAutoversioning on
      SVNListParentPath on
      AuthBasicProvider ldap
      AuthUserFile /dev/null
      AuthType Basic
      AuthName "Subversion Authentication"
      # The distinguished name to bind to the directory server
      AuthLDAPBindDN "cn=admin,dc=exist-db,dc=org"

      # The password for the user above
      AuthLDAPBindPassword "1234"
      AuthLDAPUrl "ldap://127.0.0.1:389/ou=Users,dc=exist-db,dc=org"
      AuthLDAPGroupAttribute memberUid
      AuthLDAPGroupAttributeIsDN off
      AuthLDAPCompareDNOnServer off

      AuthzLDAPAuthoritative on
      AuthBasicAuthoritative on
      <Limit GET HEAD OPTIONS CONNECT POST PROPFIND PUT DELETE

PROPPATCH MKCOL COPY MOVE LOCK UNLOCK> Require ldap-group cn=dba,ou=Groups,dc=exist-db,dc=org Require ldap-group cn=svn-update,ou=Groups,dc=exist-db,dc=org Satisfy any </Limit> <Limit GET HEAD OPTIONS CONNECT POST PROPFIND> Require ldap-group cn=svn-readonly,ou=Groups,dc=exist-db,dc=org Satisfy any </Limit> </Location>

Something like this should work, I have something like this:

 AuthLDAPURL "ldaps://ldap-slaves......./ou=People,...?uid?sub?

(objectclass=posixAccount)" Satisfy All AuthzLDAPAuthoritative on AuthLDAPGroupAttributeIsDN off AuthLDAPGroupAttribute memberUid Require ldap-group cn=developers,ou=Group,.....

Although the requirement to limiting operations via svn was not that great, and I ran out of time to test that, so I haven't got these inside Limit statements at present ...

I suggest starting out with a memberUid-based non-Limit config first, and if that works, add the Limits parts in.

Regards, Buchan