Home / server / Questions / 278276
Accepted
Josh Johnson
Asked: 2011-06-09 05:58:43 +0800 CST

Apache mod_auth_basic and Ordering

  • 772

I have Apache setup to authenticate with active directory through ldap for my users. There are a few "system" users (for automated build tests) that are manually setup and authenticate through file.

AuthBasicProvider ldap file

The issue I'm having is that the Active Directory box is wont to go down once in a while for maintenance or other reasons and I don't want my "system" users to be denied access during that time. I'd like Apache to attempt authentication with file and THEN ldap but this doesn't seem to be possible. According to http://httpd.apache.org/docs/2.2/mod/mod_auth_basic.html, "the order of processing is determined in the modules' source code and is not configurable."

This just doesn't seem right. I would think that one would (often) want to specify the order of the auth providers (if not for the reasons I want to then for other reasons). Is there no way to do this without hacking source code?

p.s. Changing the config to AuthBasicProvider file ldap makes no difference.

apache-2.2 mod-auth mod-auth-ldap

1 Answers

  1. Best Answer

    According to http://httpd.apache.org/docs/2.2/mod/mod_auth_basic.html, "the order of processing is determined in the modules' source code and is not configurable."

    The above quote is not talking about what you're asking:

    This should only be necessary when combining mod_auth_basic with third-party modules that are not configured with the AuthBasicProvider directive. When using such modules, the order of processing is determined in the modules' source code and is not configurable.

    From version 2.2, Apache allow to use multiple providers. I've tested on my system (Apache 2.2.20), it works fine:

    <Location />
    AuthType Basic
    AuthBasicProvider file ldap
    AuthUserFile /etc/httpd/passwords
    AuthzLDAPAuthoritative Off
    AuthLDAPURL ldap://ip:389/dc=x,dc=y?cn
    AuthLDAPBindDN cn=anonymous,ou=z,dc=x,dc=y
    AuthLDAPBindPassword pa$$w0rd
    AuthName "Restricted Area"

    AuthzLDAPGroupBase      ou=z,dc=x,dc=y
    AuthzLDAPGroupkey       cn
    AuthzLDAPMemberKey      member
    AuthzLDAPSetGroupAuth   user
    require valid-user
    AuthzLDAPLogLevel       error
</Location>

    Stop OpenLDAP, I still can login with users in /etc/httpd/passwords.

    • 2