Forum Moderators: phranque

Message Too Old, No Replies

Apache 2.4 LDAP configuration

         

Mark3024

2:11 am on May 16, 2022 (gmt 0)



Hi Team, I’m having a hard time setting up my ldap syntax for Apache. I want to be able to restrict site access using AD and limit it to just a secure group.

Domain: mydomain.dom.org
Organisational unit: MM/Users/MM_Secure/
User Group: Sop_Admin
Server: Win 2019

<vhost :*80>

<location /localhost>

Authtype Basic
Authname “Please seek admin approval if you can’t get in:”
Ldap://myldapsrv.mydomain.don.org/OU=MM_Secure,OU=Users,OU=MM,DC=mydomain,DC=dom,DC=org

Require ldap-group CN=Sop_Admin,OU=MM_Secure,OU=Users,OU=MM,DC=mydomain,DC=dom,DC=org

</location>

</vhost>

I can get it to work if I’m using file for authentication. But when I’m using ldap, it prompts the message but once logged in, it pops “there’s an error connecting to server”

Access/Error logs show error 400 and 500. Most of the time it’s 500.

My colleague and I agreed that it might be an issue with how we are calling ldap

phranque

7:50 am on May 16, 2022 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



welcome to WebmasterWorld [webmasterworld.com]. Mark3024!

whenever there's a 500 the error log should show corresponding additional information.

Mark3024

10:27 pm on May 16, 2022 (gmt 0)



Hi Phranque,

Thanks for the update. Here's my logs:

error.log:
[Fri May 13 13:32:17.830279 2022] [authz_core:error] [pid 9560:tid 1256] [client ::1:62204] AH01630: client denied by server configuration: C:/temp/IMR_Site/Apache_2_4/Apache24_MarkTest/docs, referer: http://localhost/

Access.log:
::1 - - [13/May/2022:13:32:17 +0930] "GET / HTTP/1.1" 403 199
::1 - - [13/May/2022:13:32:17 +0930] "GET /favicon.ico HTTP/1.1" 403 199
::1 - - [13/May/2022:13:33:17 +0930] "-" 408 -

Here's my full ldap block in httpd.conf:
<Directory "${SRVROOT}/htdocs">
AuthType Basic
AuthName "Mark LDAP Restricted"
AuthBasicProvider ldap
AuthLDAPURL ldap://myldapsrv.mydomain.dom.org/OU=MM_Secure,OU=Users,OU=MM,DC=mydomain,DC=dom,DC=org
Require ldap-group CN=Sop_Admin,OU=MM_Secure,OU=Users,OU=MM,DC=mydomain,DC=dom,DC=org
</Directory>

[edited by: phranque at 11:14 pm (utc) on May 16, 2022]
[edit reason] unlinked url [/edit]