Solved

Configuration of Apache with LDAP on Widows 2003

Posted on 2008-06-18
6
633 Views
Last Modified: 2008-06-22
Hi,

   I want to configure the Apache 2.2.8 with MS LDAP and then will configure Subvesion 1.4.6 on Windows 2003 Platform.
I read the documention over the web but most of it is for Unix/Linux platform.  

Can you please provide the detailed configuration of Apache with LDAP. I have installed the Apache 2.2.8 on Windows 2003 and following actions are done.

Following are the entries in httpd.conf file for Apache.
1.LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
2. LoadModule ldap_module modules/mod_ldap.so
3. Add the following

<Directory "C:\Program Files\Apache Software Foundation\Apache2.2\htdocs">
AuthType Basic
AuthName Internal
AuthBasicAuthoritative off
AuthBasicProvider ldap
AuthzLDAPAuthoritative off
AuthLDAPURL "ldap://ldap.domain.com:389/ou=LDAP Users & Groups,dc=domain,dc=com"
Require valid-user
AuthLDAPBindDN "ou=LDAP Users & Groups,dc=domain,dc=com"            
</Directory>

When I try to login to the Apache Server I am not getting authenticated by the LDAP Server and I found the following errors in the Apache Server's log file.

[Wed Jun 18 00:13:19 2008] [warn] [client localhost] [3588] auth_ldap authenticate: user myname authentication failed; URI / [ldap_search_ext_s() for user failed][Operations Error]

Where as the user 'myname' exists in the LDAP.
0
Comment
Question by:Naveed27c
  • 3
  • 3
6 Comments
 
LVL 57

Expert Comment

by:giltjr
ID: 21816660
Typically you must use a authorized ID to connect to the LDAP server to even validate a user.  I don't think that AD allows for anonymous LDAP queries to validate user.

Which means you will need to specify a valid user-id and password on the "AuthLDAPBindDN" statement.
0
 

Author Comment

by:Naveed27c
ID: 21819505
Hi giltjr,  

   Thanks for your comments. I hope you can help me on this issue. There is some entry which I am not entering correctly.  I need you help to put the entried for all the required parameters for LDAP configurations.

     The user in LDAP is 'tester' and his password is 'a1234'. This user is created under a orgnizationalunit OU called 'Users'.    DC=domain,DC=com .  In LDAP the objectClass entries for usre 'tester' are 'top' and 'person'.  I have already defined all the configuration in my post. Now in Apache httpd.conf file I have enter the following entries, Please correct me on this and also if you need any more info let me know. I really need this to work and stuck on this for whole one week. Also let me know if any permission issues are there.

This is on Windows.

<Directory "C:\Program Files\Apache Software Foundation\Apache2.2\htdocs">
AuthType Basic
AuthName Internal
AuthBasicAuthoritative off
AuthBasicProvider ldap
AuthzLDAPAuthoritative off
AuthLDAPURL "ldap://192.168.1.101:389/ou=Users,dc=domain,dc=com"
Require valid-user
AuthLDAPBindDN "cn='tester',ou=Users,dc=domain,dc=com"            
</Directory>

But still getting same error. I dont know how to specify a valid user-id and password on the "AuthLDAPBindDN" statement.

Can you please send me a example configuration which is working and their corresponding entries in LDAP server so I can follow the same steps to setup this.

Thanks Guru
Naveed
0
 
LVL 57

Accepted Solution

by:
giltjr earned 500 total points
ID: 21820985
Here is a guide to help you.  Basically you need something like:


AuthLDAPURL "ldap://192.168.1.101:389/ou=Users,dc=domain,dc=com?sAMAccountName?sub?(objectClass=*)"
AuthLDAPBindDN "cn=tester,cn=Users,dc=domain,dc=com"  
AuthLDAPBindPassword a1234
0
Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 

Author Comment

by:Naveed27c
ID: 21828854
Thanks giltjr it worked for user tester after binding the password.

Now if there are 300 users in LDAP in OU 'Users' then how do I authenticate them. I mean to say that now how  a common user part of my domain 'domain' get authenticated.

Thanks
Naveed


0
 

Author Comment

by:Naveed27c
ID: 21833745
Thanks again giltjr, every thing is working now. Great help.

Best Regards
Naveed
0
 
LVL 57

Expert Comment

by:giltjr
ID: 21841752
Glad to see you have it working.  I was out of town and did not have access to the Internet.  To give a basic explanation of why it is working.

The way things normally use LDAP for authentication is they connect to the LDAP server either anonymously or with a "common" user-id.  Then they do a "look-up" for the user you are attempting to verify.  If that user-id exists, then they verify the password.

This is why once you got the correct user-id/password to connect to the LDAP server, everything worked.  If you had users in a OU other than Users, then it gets a bit more complicated.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Public IP Address Amazon Servers 2 41
Domino Website - Redirection 12 47
cannot create more new mailboxes EX2013 2 35
PowerShell:  Add Header to Out-File 2 0
One of the typical problems I have experienced is when you have to move a web server from one hosting site to another. You normally prepare all on the new host, transfer the site, change DNS and cross your fingers hoping all will be ok on new server…
Introduction This article explores the design of a cache system that can improve the performance of a web site or web application.  The assumption is that the web site has many more “read” operations than “write” operations (this is commonly the ca…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now