Questions[mod-authn-alias](server)

I've been trying to setup redundant LDAP servers with Apache 2.2.3.

/etc/httpd/conf.d/authn_alias.conf

<AuthnProviderAlias ldap master>
    AuthLDAPURL ldap://192.168.5.148:389/dc=domain,dc=vn?cn
    AuthLDAPBindDN cn=anonymous,ou=it,dc=domain,dc=vn
    AuthLDAPBindPassword pa$$w0rd
</AuthnProviderAlias>

<AuthnProviderAlias ldap slave>
    AuthLDAPURL ldap://192.168.5.199:389/dc=domain,dc=vn?cn
    AuthLDAPBindDN cn=anonymous,ou=it,dc=domain,dc=vn
    AuthLDAPBindPassword pa$$w0rd
</AuthnProviderAlias>

/etc/httpd/conf.d/authz_ldap.conf

#
# mod_authz_ldap can be used to implement access control and 
# authenticate users against an LDAP database.
# 

LoadModule authz_ldap_module modules/mod_authz_ldap.so

<IfModule mod_authz_ldap.c>
   <Location />
        AuthBasicProvider master slave
        AuthzLDAPAuthoritative Off
        AuthType Basic
        AuthName "Authorization required"

        AuthzLDAPMemberKey member
        AuthUserFile /home/setup/svn/auth-conf
        AuthzLDAPSetGroupAuth user
        require valid-user
        AuthzLDAPLogLevel error
   </Location>
</IfModule>

If I understand correctly, mod_authz_ldap will try to search users in the second LDAP if the first server is down or OpenLDAP on it is not running.

But in practice, it does not happen. Tested by stopping LDAP on the master, I get the "500 Internal Server Error" when accessing to the Subversion repository. The error_log shows:

[11061] auth_ldap authenticate: user quanta authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Can't contact LDAP server]

Did I misunderstand? AuthBasicProvider ldap1 ldap2 only means that if mod_authz_ldap can't find the user in ldap1, it will continue with ldap2. It doesn't include the failover feature (ldap1 must be running and working fine)?

I'm running Apache 2 and I need to authentificate users from multiple AD domains in one <Location/>. I tried using mod_authn_alias

ОС: Debian GNU/Linux Squueze with lastest updates
Apache/2.2.16

Modules

/etc/apache2/apache.conf:

<AuthnProviderAlias ldap first-ldap>
    AuthLDAPURL "ldap://win2003server:389/DC=first,DC=domain?sAMAccountName?sub?(objectClass=*)" NONE
    AuthLDAPBindDN "cn=user1,cn=Users,dc=first,dc=domain"
    AuthLDAPBindPassword "user1"
</AuthnProviderAlias>

<AuthnProviderAlias ldap second-ldap>
    AuthLDAPURL "ldap://win2008server:3268/DC=second,DC=domain?sAMAccountName?sub?(objectClass=*)" NONE
    AuthLDAPBindDN "cn=user2,cn=Users,dc=second,dc=domain"
    AuthLDAPBindPassword "user2"
</AuthnProviderAlias>

/etc/apache2/sites-enabled/000default:

<Location /test>

    Order allow,deny
    Allow from all

    Authtype Basic
    AuthBasicProvider first-ldap second-ldap
    AuthName "TEST"
    AuthzLDAPAuthoritative off
    require valid-user

</Location>

With this configuration it authentificates users from first domain, and for users from second domain it igves an error:

 [Fri Sep 16 20:54:39 2011] [info] [client 10.0.0.62] [25672] auth_ldap authenticate: user2 user2 authentication failed; URI /test/ [ldap_simple_bind_s() to check user2 credentials failed][Invalid credentials]

When I leave only AuthBasicProvider second-ldap users from second domain can authntificate successfully, so second domain LDAP is OK.

Does any one know solution to force mod_authn_alias to work?

We're using mod_authnz_ldap and mod_authn_alias in Apache 2.2.9 (as shipped in Debian 5.0, 2.2.9-10+lenny7) to authenticate against multiple Active Directory domains for hosting a Subversion repository. Our current configuration is:

# Turn up logging
LogLevel debug

# Define authentication providers
<AuthnProviderAlias ldap alpha>
  AuthLDAPBindDN "CN=Subversion,OU=Service Accounts,O=Alpha"
  AuthLDAPBindPassword [[REDACTED]]
  AuthLDAPURL ldap://dc01.alpha:3268/?sAMAccountName?sub?
</AuthnProviderAlias>

<AuthnProviderAlias ldap beta>
  AuthLDAPBindDN "CN=LDAPAuth,OU=Service Accounts,O=Beta"
  AuthLDAPBindPassword [[REDACTED]]
  AuthLDAPURL ldap://ldap.beta:3268/?sAMAccountName?sub?
</AuthnProviderAlias>

# Subversion Repository
<Location /svn>
  DAV svn
  SVNPath /opt/svn/repo
  AuthName "Subversion"
  AuthType Basic
  AuthBasicProvider alpha beta
  AuthzLDAPAuthoritative off
  AuthzSVNAccessFile /opt/svn/authz
  require valid-user
</Location>

We're encountering issues with users that have accounts in both Alpha and Beta, especially when their accounts in Alpha are expired (but still present; company policy is that the accounts live on for at a minimum of 1 year). For example, when the user x (which has en expired account in Alpha, and a valid account in Beta), the Apache error log reports the following:

[Tue May 11 13:42:07 2010] [debug] mod_authnz_ldap.c(377): [client 10.1.1.104] [14817] auth_ldap authenticate: using URL ldap://dc01.alpha:3268/?sAMAccountName?sub?
[Tue May 11 13:42:08 2010] [warn] [client 10.1.1.104] [14817] auth_ldap authenticate: user x authentication failed; URI /svn/ [ldap_simple_bind_s() to check user credentials failed][Invalid credentials]
[Tue May 11 13:42:08 2010] [error] [client 10.1.1.104] user x: authentication failure for "/svn/": Password Mismatch
[Tue May 11 13:42:08 2010] [debug] mod_deflate.c(615): [client 10.1.1.104] Zlib: Compressed 527 to 359 : URL /svn/

Attempting to authenticate as a non-existant user (nobodycool) results in the correct behavior of querying both LDAP servers:

[Tue May 11 13:42:40 2010] [debug] mod_authnz_ldap.c(377): [client 10.1.1.104] [14815] auth_ldap authenticate: using URL ldap://dc01.alpha:3268/?sAMAccountName?sub?
[Tue May 11 13:42:40 2010] [warn] [client 10.1.1.104] [14815] auth_ldap authenticate: user nobodycool authentication failed; URI /svn/ [User not found][No such object]
[Tue May 11 13:42:40 2010] [debug] mod_authnz_ldap.c(377): [client 10.1.1.104] [14815] auth_ldap authenticate: using URL ldap://ldap.beta:3268/?sAMAccountName?sub?
[Tue May 11 13:42:44 2010] [warn] [client 10.1.1.104] [14815] auth_ldap authenticate: user nobodycool authentication failed; URI /svn/ [User not found][No such object]
[Tue May 11 13:42:44 2010] [error] [client 10.1.1.104] user nobodycool not found: /svn/
[Tue May 11 13:42:44 2010] [debug] mod_deflate.c(615): [client 10.1.1.104] Zlib: Compressed 527 to 359 : URL /svn/

How do I configure Apache to correctly query Beta if it encounters an expired account in Alpha?