Home / server / Questions / 25500
Accepted
Karolis T.
Asked: 2009-06-15 05:27:06 +0800 CST

Apache + LDAP Auth: access to / failed, reason: require directives present and no Authoritative handler

  • 772

Can't solve this one, here's my .htaccess:

AuthPAM_Enabled Off

AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthName "MESSAGE"
Require ldap-group cn=CHANGED, cn=CHANGED

AuthLDAPURL "ldap://localhost/dc=CHANGED,dc=CHANGED?uid?sub?(objectClass=posixAccount)"
AuthLDAPBindDN CHANGED
AuthLDAPBindPassword CHANGED
AuthLDAPGroupAttribute memberUid

AuthLDAPURL is correct, BindDN and BindPassword are correct also (verified with ldapvi -D ..).

Apache version: Apache/2.2.9 (Debian)

The error message seems cryptic to me, I have AuthzLDAPAuthoritative on so where's the problem.

EDIT:

LDAP modules are loaded, the problem is not with them being missing.

# ls /etc/apache2/mods-enabled/*ldap*
/etc/apache2/mods-enabled/authnz_ldap.load  /etc/apache2/mods-enabled/ldap.load

EDIT2:

Solved it by changing funky 

Require ldap-group cn=CHANGED, cn=CHANGED

line with

Require valid-user

Since AuthzLDAPAuthoritative is on, no other auth methods will be used and valid-user requirement will auth via LDAP. (right? :/)

debian apache-2.2 ldap

3 Answers

  1. Best Answer

    Your 'Require' line reads

    Require ldap-group cn=CHANGED, cn=CHANGED

    That doesn't look write - I don't believe you can have have two cn's in a DN like that.

    • 2

  2. For me and apache 2.2.14, this works like a champ for access control on a per-group basis

    AuthType Basic
AuthName "Secret Area for IT Only"
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthLDAPGroupAttributeIsDN off
AuthLDAPGroupAttribute memberUid
AuthLDAPURL "ldap://ldap1.example.int ldap2.company.int/cn=int"
Require ldap-group cn=it,ou=Groups,o=int

    "int" is our internal domain for non-public servers.

    • 1

  3. Have you enabled the ldap and authnz_ldap modules?

    You can do so with:

    a2enmod ldap authnz_ldap; /etc/init.d/apache2 restart
    • 0