MyWackoSite: modauthnzldap

https://wiki.ebal.gr     Version: 1 (01/21/2015 14:10)
This is an old revision of apache/modauthnzldap from 01/21/2015 14:10 edited by EvaggelosBalaskas.

modauthnzldap

0

The default authentication method for a web app on apache is “AuthType basic”.
You can read the online documentation here: mod_auth_basic[link1].

Every sysadmin knows the basic of auth_basic (or they should) but on a large scale infrastructure is really hard and unsafe to maintain text files with crypt passwords. You then have to write or use another app for password management (eg. reset/renew) and it's really hard to apply a password policy for every users. For a small setup is more than perfect.

If you already have a central authentication method then it's probably a good idea to connect your web server to that infrastructure. The most common way on this is using the authnz_ldap[link2]. I am guessing that you have an LDAP in place (or even Active Directory) for central authentication.

A simply conf is this:

        # ebal, Tue Jan 13 13:13:13 EET 2015
        AuthName "Ldap Access"
        AuthType Basic
        AuthBasicProvider ldap
        AuthLDAPBindDN cn=pamldapuser,dc=domain,dc=org
        AuthLDAPBindPassword 1234567890
        AuthLDAPURL "ldap://ldap.domain.org/ou=web,dc=domain,dc=org?uid?one?(WebAccess=MyWebApp_Level_*)"
        Require ldap-attribute WebAccess=MyWebApp_Level_1 WebAccess=MyWebApp_Level_2



Let me explain what the above does:

Basic Authentication (obviously)! using an LDAP connection.
The pamldapuser is the user that connects to the ldap.domain.org LDAP server with 1234567890 as the password.

Now the tricky part:

Only accept User Logins from users that have the attribute: WebAccess & the value of this attributes matches with " MyWebApp_Level_* "
The asterisk is a wildcard character. So the value can match every character (or in this case every level).

That means that whoever LDAP user has the attribute WebAccess and matches the «MyWebApp_Level_*" value can login to this web site.

The “Require ldap-attribute " comes in handy to limit the access to specific values (or levels).

The LDAP syntax for logical OR is this: (|(attribute_1)(attribute_2)
but in the Require ldap-attribute case you have to write them all with a space character between them as delimiter.


Update: For AuthLDAPURL you should read the RFC 2255