- 浏览: 117627 次
- 性别:
- 来自: 武汉
最新评论
This method authenticates using Apache 2.0/2.2 and the LDAP authentication modules on Linux (supplied by default with most Linux distros) and an LDAP server. LDAP can be used to authenticate user accounts on Linux and other computer systems as well as web site logins.
Try this out with your Apache server authenticating to our open LDAP server using our Three Stooges example.
Apache LDAP modules: |
Note that the following configurations work if the LDAP modules are enabled:
- Apache 2.0 (Red Hat Enterprise 4/CentOS4): mod_ldap , mod_auth_ldap
- Apache 2.2 (Red Hat Enterprise 5/CentOS 5): mod_ldap , mod_authnz_ldap
These are turned on by default. See /etc/httpd/conf/httpd.conf
- Apache 2.0:
LoadModule ldap_module modules/mod_ldap.so LoadModule auth_ldap_module modules/mod_auth_ldap.so
- Apache 2.2:
LoadModule ldap_module modules/mod_ldap.so LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
Apache Authentication Configuration: |
Apache 2.0:
Authenticate to an Open LDAP server. (No bind name/password required to access LDAP server)
.. ... <Directory /var/www/html > AuthType Basic AuthName "Stooges Web Site: Login with email address" AuthLDAPURL ldap://ldap.yo-linux.com:389/o=stooges?mail require valid-user </Directory> ... .. |
AuthName "Stooges Web Site: Login with email address" AuthType Basic AuthLDAPURL ldap://ldap.your-domain .com:389/o=stooges?mail require valid-user |
Point your browser to http://localhost/
Login with the user id "LFine@isp.com" and password "larrysecret".
You will be asked to use a user id (email address) and password to enter the site.
Bind with a bind DN: (password protected LDAP repository)
.. ... <Directory /var/www/html > AuthType Basic AuthName "Stooges Web Site: Login with email address" AuthLDAPEnabled on AuthLDAPURL ldap://ldap.your-domain .com:389/o=stooges?mail AuthLDAPBindDN "cn=StoogeAdmin,o=stooges" AuthLDAPBindPassword secret1 require valid-user </Directory> ... .. |
- require valid-user : Allow all users if authentication (password) is correct.
- require user greg phil bob : Allow only greg phil bob to login.
- require group accounting : Allow only users in group "accounting" to authenticate.
This example specified the use of the email address as a login id. If using user id's specify:
Apache 2.2:
Authenticate using Apache httpd 2.2 AuthzLDAP:
User Authentication:
.. ... <Directory /var/www/html > AuthType Basic AuthName "Stooges Web Site: Login with user id" AuthBasicProvider ldap AuthzLDAPAuthoritative on AuthLDAPURL ldap://ldap.your-domain .com:389/o=stooges?uid?sub AuthLDAPBindDN "cn=StoogeAdmin,o=stooges" AuthLDAPBindPassword secret1 require ldap-user lary curley moe joe bob mary </Directory> ... .. |
There are two configurations for the directive AuthzLDAPAuthoritative :
AuthzLDAPAuthoritative on ... require ldap-user lary curley moe joe bob mary |
AuthzLDAPAuthoritative off
AuthzLDAPAuthoritative off ... require valid-user |
Group Authentication:
dn: cn=users,ou=group,o=stooges cn: users objectClass: top objectClass: posixGroup gidNumber: 100 memberUid: larry memberUid: moe |
Apache Configuration:
... <Directory /var/www/html > Order deny,allow Deny from All AuthType Basic AuthName "Stooges Web Site: Login with user id" AuthBasicProvider ldap AuthzLDAPAuthoritative on AuthLDAPURL ldap://ldap.your-domain .com:389/o=stooges?uid?sub AuthLDAPBindDN "cn=StoogeAdmin,o=stooges" AuthLDAPBindPassword secret1 AuthLDAPGroupAttribute memberUid AuthLDAPGroupAttributeIsDN off Require ldap-group cn=users,ou=group,o=stooges Require ldap-attribute gidNumber=100 Satisfy any </Directory> ... |
- Allow users (LDAP attribute: memberUid
) in group gidNumber: 100
of objectClass: posixGroup
which match to the login uid
, authentication approval.
The directive AuthLDAPGroupAttribute identifies the attribute to match with the login uid . - AuthLDAPGroupAttributeIsDN:
- on (default): Use DN (Distinguished name) cn=Moe Howard,ou=MemberGroupA,o=stooges
- off: Use username moe
- Multiple Require ldap-group ... statements may be included to allow multiple groups.
- Multiple Require ldap-attribute ... statements may be included to allow multiple groups.
- The directive Satisfy any
is required if testing multiple conditions. Only one positive in any of the conditions is required to authenticate.
Thus you can combine the following authorization schemes as well:
- Require ldap-user
- Require ldap-dn
- Require ldap-attribute
- Require ldap-filter
Concurrent File and LDAP authentication: |
Apache can use both File and LDAP authentication concurently. This is sometimes required to run cron jobs with a login where you do not want to use a system login or login managed by a directory server in another department.
<Directory /ABC> Order deny,allow Deny from All AuthType Basic AuthBasicProvider file ldap AuthName "Directory services login" AuthBasicAuthoritative off AuthUserFile /srv/htpasswd AuthGroupFile /dev/null AuthzLDAPAuthoritative off AuthLDAPURL "ldap://ldap.megacorp.com:389/ou=person,o=megacorp.com,c=us?uid?sub" # This user created for local cron jobs. It is not a system user and allows # the cron job to perform its task. # This user is not in the LDAP directory but in the password file /srv/htpasswd Require user cronuserjobx Require ldap-user usera userb </Directory> |
- AuthBasicProvider file ldap - Check password "file" authentication then LDAP
- AuthBasicAuthoritative off - Allows fall back to another auth scheme, in this case LDAP
- AuthzLDAPAuthoritative off - Allows fall back to other auth scheme besides LDAP, in this case file
Debugging Apache Authentication: |
Set LogLevel debug when debugging authentication. This will log all the LDAP connection events and the LDAP attributes requested.
Authenticating with Microsoft Active directory using Microsoft's "Unix services for Windows":
Also note that encrypted connections will use the URL prefix "ldaps:// " and the added directives:
- LDAPTrustedCA directory-path/filename
- LDAPTrustedCAType type
Where the "type" is one of:- DER_FILE: file in binary DER format
- BASE64_FILE: file in Base64 format
- CERT7_DB_PATH: Netscape certificate database file
Restart Apache after editing the configuration file: service httpd restart
for configuration changes to take effect.
See /var/log/httpd/error_log
for configuration errors.
发表评论
-
解决SecureCRT中文显示乱码问题
2012-03-19 10:51 736设置Options > Session Options. ... -
解决PuTTY中文显示乱码问题
2012-03-19 10:38 694Window > Translation > Ch ... -
U盘安装Windows 7
2011-11-12 20:30 770下载Windows 7 ISO压缩包; 下载Windows ... -
MSN Error Code 80048439
2011-08-29 13:31 737* Start Internet Explorer. ... -
国外程序员是如何准备面试的
2011-06-21 11:32 715一、开门见山 一 ... -
一些鲜为人知的编程真相
2011-06-21 11:11 5511. 一个程序员用在写 ... -
Full-System Simulator for IBM PowerPC 970
2011-06-09 22:41 1811Platform requirements Operat ... -
Restoring Active Directory
2011-06-09 01:07 512There are two ways to restore A ... -
Backing Up Active Directory
2011-06-09 01:05 732This section describes how to b ...
相关推荐
LDAP-based Authentication for Samba. This document demonstrates how to install and configure Samba as a primary Domain Controller with a secure LDAP-based authentication mechanism.
描述apache怎么配置使用 openladp进行认证
含 org.apache.jmeter.protocol.ldap.config.* org.apache.jmeter.protocol.ldap.control.* org.apache.jmeter.protocol.ldap.sampler.*
标签:apacheds-protocol-ldap-1.0.1.jar.zip,apacheds,protocol,ldap,1.0.1,jar.zip包下载,依赖包
主要包括: 1、subsversion1.6.6安装 2、apache web 2.2.14服务安装配置 3、openDS安装整合 额外说明:文档中有一点小问题就是SVNPath指定到某一版本库,访问地址就是http://ip/project1同时权限控制中对应的只有“/...
Apache Directory Studio 是一个 LDAP 的工具平台,用来连接到任何 LDAP 服务器并进行管理和开发工作
adLDAP - LDAP Authentication with PHP for Active Directory adLDAP is a PHP class that provides LDAP authentication and integration with Active Directory. Intelligent Active Directory integration ...
测试LDAP 认证的一个jmeter testing plan sample, sample中采用basic authentication, 对某些网关产品弹出的页面输入用户名和密码,测试认证的performance
一个简单的节点库,可根据LDAP / AD服务器对用户进行身份验证目标使用LDAP服务器进行身份验证变得容易。描述该库使用ldapjs作为ldapjs库。 它有两种认证方式: 管理员身份验证模式。 如果提供了admin用户,则库将...
application security - LDAP Authentication. Index: ...Example: External SASL Authentication using SSL Comparison of Common Ldap Authentication Methods LDAP Authentication Troubleshooting
apache-LDAP轻量级目录管理协议
资源分类:Python库 所属语言:Python 资源全名:trytond_ldap_authentication-3.2.0.tar.gz 资源来源:官方 安装方法:https://lanzao.blog.csdn.net/article/details/101784059
资源来自pypi官网。 资源全名:trytond_ldap_authentication-4.2.0-py2-none-any.whl
描述怎么样使用 ldap+apacheDS in jxplorer
Researched LDAP module for Mooble system. Authentication, etc...
mediawiki的ldap认证扩展文件
在大数据集群的搭建过程中,LDAPS单点认证服务器的搭建几乎是最为困难的,网上搜索到的文档几乎都不可用,该文档提供了一种最简便的搭建方法,让你一次搭建成功。
NULL 博文链接:https://samjavaeye.iteye.com/blog/902229
使用 rest-auth-proxy 微服务rest-auth-proxy 是一个基于 Java 的 restful ldap-authentication 微服务,可用于根据 ldap 和活动目录对用户进行身份验证。 它充当调用应用程序和 ldap 服务器之间的身份验证代理。 ...