Home / user-416748

Florian Straub's questions

Martin Hope
Florian Straub
Asked: 2019-07-25 02:27:42 +0800 CST
  • 1

this is my first post here, so please be kind with me ...

We have apache managing access for our subversion server. Currently users can only log in with their sAMAccountName, but since userPrincipalName (email address) is gradually becoming the main ID for most logins, we would like to support that as well as keeping support for sAMAccountName.

The current approach which looks as follows has the disadvantage that both user names - sAMAccountName and userPrincipalName - have to be speficied in the svnaccessfile:

<AuthnProviderAlias ldap ldap-sAMAccountName>
    AuthLDAPBindDN "CN=d-svn-ldap,OU=IT-050,OU=Service Accounts,OU=Accounts,OU=Domain Administration,DC=cds,DC=company"
    AuthLDAPBindPassword ***
    AuthLDAPUrl "ldap://server.company:3268/DC=cds,DC=company?sAMAccountName?sub?(objectclass=user)"
</AuthnProviderAlias>
<AuthnProviderAlias ldap ldap-userprincipalname>
    AuthLDAPBindDN "CN=d-svn-ldap,OU=IT-050,OU=Service Accounts,OU=Accounts,OU=Domain Administration,DC=cds,DC=company"
    AuthLDAPBindPassword ***
    AuthLDAPUrl "ldap://server.company:3268/DC=cds,DC=company?userPrincipalName?sub?(objectclass=user)"
</AuthnProviderAlias>

<Location "/our_repo">
DAV svn
SVNPath /svn/repos/our_repo
SVNListParentPath on

AuthzSVNAccessFile /etc/apache2/conf-available/authz_repository_our_repo
Options Indexes Followsymlinks

AuthBasicProvider ldap-sAMAccountName  ldap-userprincipalname

AuthType Basic
AuthName "LDAP authentication"
Require valid-user
# Note that Require ldap-* would not work here, since the
# AuthnProviderAlias does not provide the config to authorization providers
# that are implemented in the same module as the authentication provider.
</Location>

So I'm looking for a way to be able to only specify userPrincipalNames in the svnaccessfile. I was hoping that AuthLDAPRemoteUserAttribute might help here, so I added AuthLDAPRemoteUserAttribute userPrincipalName to ldap-sAMAccountName which lead to this message in error.log:

auth_ldap authenticate: REMOTE_USER was to be set with attribute 'userPrincipalName', but this attribute was not requested for in the LDAP query for the user. REMOTE_USER will fall back to username or DN as appropriate.

Is this the right approach? Is this even possible?

Thanks

Flo

svn