Thursday, 16 April 2015

Config apache for ldap authentication

1. install mod_authz_ldap module for apache
#yum install mod_authz_ldap
2. add following one line to httpd.conf
    LoadModule authz_ldap_module modules/mod_authz_ldap.so
3. restart apache
#/etc/init.d/httpd restart or
#/etc/init.d/apache restart (ubuntu)
4. create .htaccess under the folder you want to restrict user login by ldap, such as /documentation,
    and add following contents to .htaccess

**********************************************************************
      Options +FollowSymLinks
      Options All -Indexes
      RewriteEngine on

      DirectoryIndex docs.html

      Order allow,deny
      Allow from all

      AuthzLDAPMethod ldap
      AuthzLDAPAuthoritative on
      AuthzLDAPServer ldap.example.com:389
      AuthzLDAPUserBase "ou=people,dc=example,dc=com"
      AuthzLDAPUserKey cn
      AuthzLDAPUserScope base
      AuthType Basic
      AuthName "Password Protected Area"
      require valid-user
      AuthzLDAPLogLevel info
*************************************************************************

If you still can login by ldap, please check error.log to see the reason for debug
Notice: For  AuthzLDAPUserKe, you should check your ldap config first, then config it according your ldap config

ldap command:
ldapsearch -x -h ldap.example.cso uid=$username

1 comment: