6

I'm attempting to move as close to single credential as possible. We have a web application that has a fairly limited set of available authentication mechanisms but will (luckily) allow admins to tell it to trust the REMOTE_USER environmental variable set by httpd.

Is there a way to configure mod_authnz_ldap to authenticate using the requesting user's credentials instead of just choosing between anonymous binds or shared credentials?

This is what I currently have:

    <Location />

       AuthzLDAPLogLevel debug
       AuthType Basic
       AuthBasicProvider ldap
       AuthName "Active Directory"
       AuthzLDAPAuthoritative off
       AuthLDAPBindDN CN=jad,DC=xxx,DC=com
       AuthLDAPBindPassword xxx
       AuthLDAPURL ldap://xxx.xxx.64.71/DC=xxx,DC=com?samaccountname?sub
       require valid-user

    </Location>

xxx's mark redaction. Basically the above works to authenticate users but it uses my account to bind to AD. If I try to comment out the AuthLDAPBindDN and AuthLDAPBindPassword it seems to attempt to perform an anonymous bind, which the AD administrators have configured to be denied.

My question is whether apache can be configured to use the authenticating user's credentials instead of making me choose between anonymous bind or using a shared account (which isn't possible either, given the policy the AD guys have set). Using a person's account is also obviously not ideal for situations where they're terminated or leave.

6
+100

Maybe AuthLDAPInitialBindAsUser (Apache 2.3.6) can help:

Determines if the server does the initial DN lookup using the basic
authentication users' own username, instead of anonymously or with
hard-coded credentials for the server

In combination with AuthLDAPInitialBindPattern, something like this might do the trick (untested):

       AuthType Basic
       AuthBasicProvider ldap
       AuthName "Active Directory"
       AuthzLDAPAuthoritative off
       AuthLDAPInitialBindAsUser on
       AuthLDAPInitialBindPattern (.+) cn=$1,dc=com
       AuthLDAPURL ldap://xxx.xxx.64.71/DC=xxx,DC=com?samaccountname?sub
       require valid-user
  • Once the site lets me in 22 hours I'll award bounty. This is pretty much EXACTLY what I was looking for. Unfortunately RHEL6 comes with version 2.2 (which struck me as odd that it would be that old). It looks like RHEL7 will come with 2.4 so I may have to wait for that unless Red Hat even decides to release a httpd24 package on RHEL6. – Bratchley Mar 23 '14 at 21:52
  • 3
    There's a Fedorapeople repo, providing httpd24 for RHEL6 – ckujau Mar 23 '14 at 22:23
  • just tested this against a freeipa ldap server (both running centos 7, so apache is 2.4.6.5 now) and it works great. – natxo asenjo Jul 17 '17 at 21:13
  • I needed two more options: AuthLDAPSearchAsUser and AuthLDAPCompareAsUser. I am not 100 % sure why it worked for Bratchley without these options but not for me. It might be the fact that I am in an OpenLDAP rather than AD environment. Or it may be a policy difference. – Markus Mar 13 '18 at 12:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.