1 <?xml version="1.0" encoding="ISO-8859-1"?>
2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
4 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
5 This file is generated from xml source: DO NOT EDIT
6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
8 <title>mod_authnz_ldap - Apache HTTP Server</title>
9 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
10 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
11 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" />
12 <script src="../style/scripts/prettify.js" type="text/javascript">
15 <link href="../images/favicon.ico" rel="shortcut icon" /></head>
17 <div id="page-header">
18 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
19 <p class="apache">Apache HTTP Server Version 2.4</p>
20 <img alt="" src="../images/feather.gif" /></div>
21 <div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div>
23 <a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.4</a> > <a href="./">Modules</a></div>
24 <div id="page-content">
25 <div id="preamble"><h1>Apache Module mod_authnz_ldap</h1>
27 <p><span>Available Languages: </span><a href="../en/mod/mod_authnz_ldap.html" title="English"> en </a> |
28 <a href="../fr/mod/mod_authnz_ldap.html" hreflang="fr" rel="alternate" title="Français"> fr </a></p>
30 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Allows an LDAP directory to be used to store the database
31 for HTTP Basic authentication.</td></tr>
32 <tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr>
33 <tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>authnz_ldap_module</td></tr>
34 <tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_authnz_ldap.c</td></tr>
35 <tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.1 and later</td></tr></table>
38 <p>This module provides authentication front-ends such as
39 <code class="module"><a href="../mod/mod_auth_basic.html">mod_auth_basic</a></code> to authenticate users through
40 an ldap directory.</p>
42 <p><code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> supports the following features:</p>
45 <li>Known to support the <a href="http://www.openldap.org/">OpenLDAP SDK</a> (both 1.x
46 and 2.x), <a href="http://developer.novell.com/ndk/cldap.htm">
47 Novell LDAP SDK</a> and the <a href="http://www.iplanet.com/downloads/developer/">iPlanet
48 (Netscape)</a> SDK.</li>
50 <li>Complex authorization policies can be implemented by
51 representing the policy with LDAP filters.</li>
53 <li>Uses extensive caching of LDAP operations via <a href="mod_ldap.html">mod_ldap</a>.</li>
55 <li>Support for LDAP over SSL (requires the Netscape SDK) or
56 TLS (requires the OpenLDAP 2.x SDK or Novell LDAP SDK).</li>
59 <p>When using <code class="module"><a href="../mod/mod_auth_basic.html">mod_auth_basic</a></code>, this module is invoked
60 via the <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code>
61 directive with the <code>ldap</code> value.</p>
63 <div id="quickview"><h3 class="directives">Directives</h3>
65 <li><img alt="" src="../images/down.gif" /> <a href="#authldapauthorizeprefix">AuthLDAPAuthorizePrefix</a></li>
66 <li><img alt="" src="../images/down.gif" /> <a href="#authldapbindauthoritative">AuthLDAPBindAuthoritative</a></li>
67 <li><img alt="" src="../images/down.gif" /> <a href="#authldapbinddn">AuthLDAPBindDN</a></li>
68 <li><img alt="" src="../images/down.gif" /> <a href="#authldapbindpassword">AuthLDAPBindPassword</a></li>
69 <li><img alt="" src="../images/down.gif" /> <a href="#authldapcharsetconfig">AuthLDAPCharsetConfig</a></li>
70 <li><img alt="" src="../images/down.gif" /> <a href="#authldapcompareasuser">AuthLDAPCompareAsUser</a></li>
71 <li><img alt="" src="../images/down.gif" /> <a href="#authldapcomparednonserver">AuthLDAPCompareDNOnServer</a></li>
72 <li><img alt="" src="../images/down.gif" /> <a href="#authldapdereferencealiases">AuthLDAPDereferenceAliases</a></li>
73 <li><img alt="" src="../images/down.gif" /> <a href="#authldapgroupattribute">AuthLDAPGroupAttribute</a></li>
74 <li><img alt="" src="../images/down.gif" /> <a href="#authldapgroupattributeisdn">AuthLDAPGroupAttributeIsDN</a></li>
75 <li><img alt="" src="../images/down.gif" /> <a href="#authldapinitialbindasuser">AuthLDAPInitialBindAsUser</a></li>
76 <li><img alt="" src="../images/down.gif" /> <a href="#authldapinitialbindpattern">AuthLDAPInitialBindPattern</a></li>
77 <li><img alt="" src="../images/down.gif" /> <a href="#authldapmaxsubgroupdepth">AuthLDAPMaxSubGroupDepth</a></li>
78 <li><img alt="" src="../images/down.gif" /> <a href="#authldapremoteuserattribute">AuthLDAPRemoteUserAttribute</a></li>
79 <li><img alt="" src="../images/down.gif" /> <a href="#authldapremoteuserisdn">AuthLDAPRemoteUserIsDN</a></li>
80 <li><img alt="" src="../images/down.gif" /> <a href="#authldapsearchasuser">AuthLDAPSearchAsUser</a></li>
81 <li><img alt="" src="../images/down.gif" /> <a href="#authldapsubgroupattribute">AuthLDAPSubGroupAttribute</a></li>
82 <li><img alt="" src="../images/down.gif" /> <a href="#authldapsubgroupclass">AuthLDAPSubGroupClass</a></li>
83 <li><img alt="" src="../images/down.gif" /> <a href="#authldapurl">AuthLDAPUrl</a></li>
87 <li><img alt="" src="../images/down.gif" /> <a href="#contents">Contents</a></li>
88 <li><img alt="" src="../images/down.gif" /> <a href="#operation">Operation</a></li>
89 <li><img alt="" src="../images/down.gif" /> <a href="#requiredirectives">The Require Directives</a></li>
90 <li><img alt="" src="../images/down.gif" /> <a href="#examples">Examples</a></li>
91 <li><img alt="" src="../images/down.gif" /> <a href="#usingtls">Using TLS</a></li>
92 <li><img alt="" src="../images/down.gif" /> <a href="#usingssl">Using SSL</a></li>
93 <li><img alt="" src="../images/down.gif" /> <a href="#exposed">Exposing Login Information</a></li>
94 <li><img alt="" src="../images/down.gif" /> <a href="#activedirectory">Using Active Directory</a></li>
95 <li><img alt="" src="../images/down.gif" /> <a href="#frontpage">Using Microsoft
96 FrontPage with mod_authnz_ldap</a></li>
97 </ul><h3>See also</h3>
99 <li><code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code></li>
100 <li><code class="module"><a href="../mod/mod_auth_basic.html">mod_auth_basic</a></code></li>
101 <li><code class="module"><a href="../mod/mod_authz_user.html">mod_authz_user</a></code></li>
102 <li><code class="module"><a href="../mod/mod_authz_groupfile.html">mod_authz_groupfile</a></code></li>
103 </ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
104 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
105 <div class="section">
106 <h2><a name="contents" id="contents">Contents</a></h2>
110 <a href="#operation">Operation</a>
113 <li><a href="#authenphase">The Authentication
116 <li><a href="#authorphase">The Authorization
122 <a href="#requiredirectives">The Require Directives</a>
125 <li><a href="#requser">Require ldap-user</a></li>
126 <li><a href="#reqgroup">Require ldap-group</a></li>
127 <li><a href="#reqdn">Require ldap-dn</a></li>
128 <li><a href="#reqattribute">Require ldap-attribute</a></li>
129 <li><a href="#reqfilter">Require ldap-filter</a></li>
133 <li><a href="#examples">Examples</a></li>
134 <li><a href="#usingtls">Using TLS</a></li>
135 <li><a href="#usingssl">Using SSL</a></li>
136 <li><a href="#exposed">Exposing Login Information</a></li>
137 <li><a href="#activedirectory">Using Active Directory</a></li>
139 <a href="#frontpage">Using Microsoft FrontPage with
140 <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code></a>
143 <li><a href="#howitworks">How It Works</a></li>
144 <li><a href="#fpcaveats">Caveats</a></li>
148 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
149 <div class="section">
150 <h2><a name="operation" id="operation">Operation</a></h2>
152 <p>There are two phases in granting access to a user. The first
153 phase is authentication, in which the <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code>
154 authentication provider verifies that the user's credentials are valid.
155 This is also called the <em>search/bind</em> phase. The second phase is
156 authorization, in which <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> determines
157 if the authenticated user is allowed access to the resource in
158 question. This is also known as the <em>compare</em>
161 <p><code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> registers both an authn_ldap authentication
162 provider and an authz_ldap authorization handler. The authn_ldap
163 authentication provider can be enabled through the
164 <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code> directive
165 using the <code>ldap</code> value. The authz_ldap handler extends the
166 <code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code> directive's authorization types
167 by adding <code>ldap-user</code>, <code>ldap-dn</code> and <code>ldap-group</code>
170 <h3><a name="authenphase" id="authenphase">The Authentication
173 <p>During the authentication phase, <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code>
174 searches for an entry in the directory that matches the username
175 that the HTTP client passes. If a single unique match is found,
176 then <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> attempts to bind to the
177 directory server using the DN of the entry plus the password
178 provided by the HTTP client. Because it does a search, then a
179 bind, it is often referred to as the search/bind phase. Here are
180 the steps taken during the search/bind phase.</p>
183 <li>Generate a search filter by combining the attribute and
184 filter provided in the <code class="directive"><a href="#authldapurl">AuthLDAPURL</a></code> directive with
185 the username passed by the HTTP client.</li>
187 <li>Search the directory using the generated filter. If the
188 search does not return exactly one entry, deny or decline
191 <li>Fetch the distinguished name of the entry retrieved from
192 the search and attempt to bind to the LDAP server using that
193 DN and the password passed by the HTTP client. If the bind is
194 unsuccessful, deny or decline access.</li>
197 <p>The following directives are used during the search/bind
203 <td><code class="directive"><a href="#authldapurl">AuthLDAPURL</a></code></td>
205 <td>Specifies the LDAP server, the
206 base DN, the attribute to use in the search, as well as the
207 extra search filter to use.</td>
211 <td><code class="directive"><a href="#authldapbinddn">AuthLDAPBindDN</a></code></td>
213 <td>An optional DN to bind with
214 during the search phase.</td>
218 <td><code class="directive"><a href="#authldapbindpassword">AuthLDAPBindPassword</a></code></td>
220 <td>An optional password to bind
221 with during the search phase.</td>
226 <h3><a name="authorphase" id="authorphase">The Authorization Phase</a></h3>
228 <p>During the authorization phase, <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code>
229 attempts to determine if the user is authorized to access the
230 resource. Many of these checks require
231 <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> to do a compare operation on the
232 LDAP server. This is why this phase is often referred to as the
233 compare phase. <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> accepts the
234 following <code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code>
235 directives to determine if the credentials are acceptable:</p>
238 <li>Grant access if there is a <a href="#reqgroup"><code>Require ldap-user</code></a> directive, and the
239 username in the directive matches the username passed by the
242 <li>Grant access if there is a <a href="#reqdn"><code>Require
243 ldap-dn</code></a> directive, and the DN in the directive matches
244 the DN fetched from the LDAP directory.</li>
246 <li>Grant access if there is a <a href="#reqgroup"><code>Require ldap-group</code></a> directive, and
247 the DN fetched from the LDAP directory (or the username
248 passed by the client) occurs in the LDAP group or, potentially, in
249 one of its sub-groups.</li>
251 <li>Grant access if there is a <a href="#reqattribute">
252 <code>Require ldap-attribute</code></a>
253 directive, and the attribute fetched from the LDAP directory
254 matches the given value.</li>
256 <li>Grant access if there is a <a href="#reqfilter">
257 <code>Require ldap-filter</code></a>
258 directive, and the search filter successfully finds a single user
259 object that matches the dn of the authenticated user.</li>
261 <li>otherwise, deny or decline access</li>
264 <p>Other <code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code> values may also
265 be used which may require loading additional authorization modules.</p>
268 <li>Grant access to all successfully authenticated users if
269 there is a <a href="#requser"><code>Require valid-user</code></a>
270 directive. (requires <code class="module"><a href="../mod/mod_authz_user.html">mod_authz_user</a></code>)</li>
272 <li>Grant access if there is a <a href="#reqgroup"><code>Require group</code></a> directive, and
273 <code class="module"><a href="../mod/mod_authz_groupfile.html">mod_authz_groupfile</a></code> has been loaded with the
274 <code class="directive"><a href="../mod/mod_authz_groupfile.html#authgroupfile">AuthGroupFile</a></code>
281 <p><code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> uses the following directives during the
287 <td><code class="directive"><a href="#authldapurl">AuthLDAPURL</a></code> </td>
289 <td>The attribute specified in the
290 URL is used in compare operations for the <code>Require
291 ldap-user</code> operation.</td>
295 <td><code class="directive"><a href="#authldapcomparednonserver">AuthLDAPCompareDNOnServer</a></code></td>
297 <td>Determines the behavior of the
298 <code>Require ldap-dn</code> directive.</td>
302 <td><code class="directive"><a href="#authldapgroupattribute">AuthLDAPGroupAttribute</a></code></td>
304 <td>Determines the attribute to
305 use for comparisons in the <code>Require ldap-group</code>
310 <td><code class="directive"><a href="#authldapgroupattributeisdn">AuthLDAPGroupAttributeIsDN</a></code></td>
312 <td>Specifies whether to use the
313 user DN or the username when doing comparisons for the
314 <code>Require ldap-group</code> directive.</td>
318 <td><code class="directive"><a href="#authldapmaxsubgroupdepth">AuthLDAPMaxSubGroupDepth</a></code></td>
320 <td>Determines the maximum depth of sub-groups that will be evaluated
321 during comparisons in the <code>Require ldap-group</code> directive.</td>
325 <td><code class="directive"><a href="#authldapsubgroupattribute">AuthLDAPSubGroupAttribute</a></code></td>
327 <td>Determines the attribute to use when obtaining sub-group members
328 of the current group during comparisons in the <code>Require ldap-group</code>
333 <td><code class="directive"><a href="#authldapsubgroupclass">AuthLDAPSubGroupClass</a></code></td>
335 <td>Specifies the LDAP objectClass values used to identify if queried directory
336 objects really are group objects (as opposed to user objects) during the
337 <code>Require ldap-group</code> directive's sub-group processing.</td>
341 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
342 <div class="section">
343 <h2><a name="requiredirectives" id="requiredirectives">The Require Directives</a></h2>
345 <p>Apache's <code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code>
346 directives are used during the authorization phase to ensure that
347 a user is allowed to access a resource. mod_authnz_ldap extends the
348 authorization types with <code>ldap-user</code>, <code>ldap-dn</code>,
349 <code>ldap-group</code>, <code>ldap-attribute</code> and
350 <code>ldap-filter</code>. Other authorization types may also be
351 used but may require that additional authorization modules be loaded.</p>
353 <p>Since v2.5.0, <a href="../expr.html">expressions</a> are supported
354 within the LDAP require directives.</p>
356 <h3><a name="requser" id="requser">Require ldap-user</a></h3>
358 <p>The <code>Require ldap-user</code> directive specifies what
359 usernames can access the resource. Once
360 <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> has retrieved a unique DN from the
361 directory, it does an LDAP compare operation using the username
362 specified in the <code>Require ldap-user</code> to see if that username
363 is part of the just-fetched LDAP entry. Multiple users can be
364 granted access by putting multiple usernames on the line,
365 separated with spaces. If a username has a space in it, then it
366 must be surrounded with double quotes. Multiple users can also be
367 granted access by using multiple <code>Require ldap-user</code>
368 directives, with one user per line. For example, with a <code class="directive"><a href="#authldapurl">AuthLDAPURL</a></code> of
369 <code>ldap://ldap/o=Example?cn</code> (i.e., <code>cn</code> is
370 used for searches), the following Require directives could be used
371 to restrict access:</p>
372 <pre class="prettyprint lang-config">
373 Require ldap-user "Barbara Jenson"
374 Require ldap-user "Fred User"
375 Require ldap-user "Joe Manager"
379 <p>Because of the way that <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> handles this
380 directive, Barbara Jenson could sign on as <em>Barbara
381 Jenson</em>, <em>Babs Jenson</em> or any other <code>cn</code> that
382 she has in her LDAP entry. Only the single <code>Require
383 ldap-user</code> line is needed to support all values of the attribute
384 in the user's entry.</p>
386 <p>If the <code>uid</code> attribute was used instead of the
387 <code>cn</code> attribute in the URL above, the above three lines
388 could be condensed to</p>
389 <pre class="prettyprint lang-config">Require ldap-user bjenson fuser jmanager</pre>
393 <h3><a name="reqgroup" id="reqgroup">Require ldap-group</a></h3>
395 <p>This directive specifies an LDAP group whose members are
396 allowed access. It takes the distinguished name of the LDAP
397 group. Note: Do not surround the group name with quotes.
398 For example, assume that the following entry existed in
399 the LDAP directory:</p>
400 <div class="example"><pre>
401 dn: cn=Administrators, o=Example
402 objectClass: groupOfUniqueNames
403 uniqueMember: cn=Barbara Jenson, o=Example
404 uniqueMember: cn=Fred User, o=Example
407 <p>The following directive would grant access to both Fred and
409 <pre class="prettyprint lang-config">Require ldap-group cn=Administrators, o=Example</pre>
412 <p>Members can also be found within sub-groups of a specified LDAP group
413 if <code class="directive"><a href="#authldapmaxsubgroupdepth">AuthLDAPMaxSubGroupDepth</a></code>
414 is set to a value greater than 0. For example, assume the following entries
415 exist in the LDAP directory:</p>
416 <div class="example"><pre>
417 dn: cn=Employees, o=Example
418 objectClass: groupOfUniqueNames
419 uniqueMember: cn=Managers, o=Example
420 uniqueMember: cn=Administrators, o=Example
421 uniqueMember: cn=Users, o=Example
423 dn: cn=Managers, o=Example
424 objectClass: groupOfUniqueNames
425 uniqueMember: cn=Bob Ellis, o=Example
426 uniqueMember: cn=Tom Jackson, o=Example
428 dn: cn=Administrators, o=Example
429 objectClass: groupOfUniqueNames
430 uniqueMember: cn=Barbara Jenson, o=Example
431 uniqueMember: cn=Fred User, o=Example
433 dn: cn=Users, o=Example
434 objectClass: groupOfUniqueNames
435 uniqueMember: cn=Allan Jefferson, o=Example
436 uniqueMember: cn=Paul Tilley, o=Example
437 uniqueMember: cn=Temporary Employees, o=Example
439 dn: cn=Temporary Employees, o=Example
440 objectClass: groupOfUniqueNames
441 uniqueMember: cn=Jim Swenson, o=Example
442 uniqueMember: cn=Elliot Rhodes, o=Example
445 <p>The following directives would allow access for Bob Ellis, Tom Jackson,
446 Barbara Jensen, Fred User, Allan Jefferson, and Paul Tilley but would not
447 allow access for Jim Swenson, or Elliot Rhodes (since they are at a
448 sub-group depth of 2):</p>
449 <pre class="prettyprint lang-config">
450 Require ldap-group cn=Employees, o-Example
451 AuthLDAPMaxSubGroupDepth 1
455 <p>Behavior of this directive is modified by the <code class="directive"><a href="#authldapgroupattribute">AuthLDAPGroupAttribute</a></code>, <code class="directive"><a href="#authldapgroupattributeisdn">AuthLDAPGroupAttributeIsDN</a></code>, <code class="directive"><a href="#authldapmaxsubgroupdepth">AuthLDAPMaxSubGroupDepth</a></code>, <code class="directive"><a href="#authldapsubgroupattribute">AuthLDAPSubGroupAttribute</a></code>, and <code class="directive"><a href="#authldapsubgroupclass">AuthLDAPSubGroupClass</a></code>
459 <h3><a name="reqdn" id="reqdn">Require ldap-dn</a></h3>
461 <p>The <code>Require ldap-dn</code> directive allows the administrator
462 to grant access based on distinguished names. It specifies a DN
463 that must match for access to be granted. If the distinguished
464 name that was retrieved from the directory server matches the
465 distinguished name in the <code>Require ldap-dn</code>, then
466 authorization is granted. Note: do not surround the distinguished
467 name with quotes.</p>
469 <p>The following directive would grant access to a specific
471 <pre class="prettyprint lang-config">Require ldap-dn cn=Barbara Jenson, o=Example</pre>
474 <p>Behavior of this directive is modified by the <code class="directive"><a href="#authldapcomparednonserver">AuthLDAPCompareDNOnServer</a></code>
478 <h3><a name="reqattribute" id="reqattribute">Require ldap-attribute</a></h3>
480 <p>The <code>Require ldap-attribute</code> directive allows the
481 administrator to grant access based on attributes of the authenticated
482 user in the LDAP directory. If the attribute in the directory
483 matches the value given in the configuration, access is granted.</p>
485 <p>The following directive would grant access to anyone with
486 the attribute employeeType = active</p>
488 <pre class="prettyprint lang-config">Require ldap-attribute employeeType=active</pre>
491 <p>Multiple attribute/value pairs can be specified on the same line
492 separated by spaces or they can be specified in multiple
493 <code>Require ldap-attribute</code> directives. The effect of listing
494 multiple attribute/values pairs is an OR operation. Access will be
495 granted if any of the listed attribute values match the value of the
496 corresponding attribute in the user object. If the value of the
497 attribute contains a space, only the value must be within double quotes.</p>
499 <p>The following directive would grant access to anyone with
500 the city attribute equal to "San Jose" or status equal to "Active"</p>
502 <pre class="prettyprint lang-config">Require ldap-attribute city="San Jose" status=active</pre>
507 <h3><a name="reqfilter" id="reqfilter">Require ldap-filter</a></h3>
509 <p>The <code>Require ldap-filter</code> directive allows the
510 administrator to grant access based on a complex LDAP search filter.
511 If the dn returned by the filter search matches the authenticated user
512 dn, access is granted.</p>
514 <p>The following directive would grant access to anyone having a cell phone
515 and is in the marketing department</p>
517 <pre class="prettyprint lang-config">Require ldap-filter &(cell=*)(department=marketing)</pre>
520 <p>The difference between the <code>Require ldap-filter</code> directive and the
521 <code>Require ldap-attribute</code> directive is that <code>ldap-filter</code>
522 performs a search operation on the LDAP directory using the specified search
523 filter rather than a simple attribute comparison. If a simple attribute
524 comparison is all that is required, the comparison operation performed by
525 <code>ldap-attribute</code> will be faster than the search operation
526 used by <code>ldap-filter</code> especially within a large directory.</p>
530 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
531 <div class="section">
532 <h2><a name="examples" id="examples">Examples</a></h2>
536 Grant access to anyone who exists in the LDAP directory,
537 using their UID for searches.
538 <pre class="prettyprint lang-config">
539 AuthLDAPURL "ldap://ldap1.example.com:389/ou=People, o=Example?uid?sub?(objectClass=*)"
546 The next example is the same as above; but with the fields
547 that have useful defaults omitted. Also, note the use of a
548 redundant LDAP server.
549 <pre class="prettyprint lang-config">AuthLDAPURL "ldap://ldap1.example.com ldap2.example.com/ou=People, o=Example"
556 The next example is similar to the previous one, but it
557 uses the common name instead of the UID. Note that this
558 could be problematical if multiple people in the directory
559 share the same <code>cn</code>, because a search on <code>cn</code>
560 <strong>must</strong> return exactly one entry. That's why
561 this approach is not recommended: it's a better idea to
562 choose an attribute that is guaranteed unique in your
563 directory, such as <code>uid</code>.
564 <pre class="prettyprint lang-config">
565 AuthLDAPURL "ldap://ldap.example.com/ou=People, o=Example?cn"
572 Grant access to anybody in the Administrators group. The
573 users must authenticate using their UID.
574 <pre class="prettyprint lang-config">
575 AuthLDAPURL ldap://ldap.example.com/o=Example?uid
576 Require ldap-group cn=Administrators, o=Example
582 Grant access to anybody in the group whose name matches the
583 hostname of the virtual host. In this example an
584 <a href="../expr.html">expression</a> is used to build the filter.
585 <pre class="prettyprint lang-config">
586 AuthLDAPURL ldap://ldap.example.com/o=Example?uid
587 Require ldap-group cn=%{SERVER_NAME}, o=Example
593 The next example assumes that everyone at Example who
594 carries an alphanumeric pager will have an LDAP attribute
595 of <code>qpagePagerID</code>. The example will grant access
596 only to people (authenticated via their UID) who have
598 <pre class="prettyprint lang-config">
599 AuthLDAPURL ldap://ldap.example.com/o=Example?uid??(qpagePagerID=*)
606 <p>The next example demonstrates the power of using filters
607 to accomplish complicated administrative requirements.
608 Without filters, it would have been necessary to create a
609 new LDAP group and ensure that the group's members remain
610 synchronized with the pager users. This becomes trivial
611 with filters. The goal is to grant access to anyone who has
612 a pager, plus grant access to Joe Manager, who doesn't
613 have a pager, but does need to access the same
615 <pre class="prettyprint lang-config">
616 AuthLDAPURL ldap://ldap.example.com/o=Example?uid??(|(qpagePagerID=*)(uid=jmanager))
621 <p>This last may look confusing at first, so it helps to
622 evaluate what the search filter will look like based on who
623 connects, as shown below. If
624 Fred User connects as <code>fuser</code>, the filter would look
627 <div class="example"><p><code>(&(|(qpagePagerID=*)(uid=jmanager))(uid=fuser))</code></p></div>
629 <p>The above search will only succeed if <em>fuser</em> has a
630 pager. When Joe Manager connects as <em>jmanager</em>, the
631 filter looks like</p>
633 <div class="example"><p><code>(&(|(qpagePagerID=*)(uid=jmanager))(uid=jmanager))</code></p></div>
635 <p>The above search will succeed whether <em>jmanager</em>
636 has a pager or not.</p>
639 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
640 <div class="section">
641 <h2><a name="usingtls" id="usingtls">Using TLS</a></h2>
643 <p>To use TLS, see the <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> directives <code class="directive"><a href="../mod/mod_ldap.html#ldaptrustedclientcert">LDAPTrustedClientCert</a></code>, <code class="directive"><a href="../mod/mod_ldap.html#ldaptrustedglobalcert">LDAPTrustedGlobalCert</a></code> and <code class="directive"><a href="../mod/mod_ldap.html#ldaptrustedmode">LDAPTrustedMode</a></code>.</p>
645 <p>An optional second parameter can be added to the
646 <code class="directive"><a href="#authldapurl">AuthLDAPURL</a></code> to override
647 the default connection type set by <code class="directive"><a href="../mod/mod_ldap.html#ldaptrustedmode">LDAPTrustedMode</a></code>.
648 This will allow the connection established by an <em>ldap://</em> Url
649 to be upgraded to a secure connection on the same port.</p>
650 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
651 <div class="section">
652 <h2><a name="usingssl" id="usingssl">Using SSL</a></h2>
654 <p>To use SSL, see the <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> directives <code class="directive"><a href="../mod/mod_ldap.html#ldaptrustedclientcert">LDAPTrustedClientCert</a></code>, <code class="directive"><a href="../mod/mod_ldap.html#ldaptrustedglobalcert">LDAPTrustedGlobalCert</a></code> and <code class="directive"><a href="../mod/mod_ldap.html#ldaptrustedmode">LDAPTrustedMode</a></code>.</p>
656 <p>To specify a secure LDAP server, use <em>ldaps://</em> in the
657 <code class="directive"><a href="#authldapurl">AuthLDAPURL</a></code>
658 directive, instead of <em>ldap://</em>.</p>
659 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
660 <div class="section">
661 <h2><a name="exposed" id="exposed">Exposing Login Information</a></h2>
663 <p>when this module performs <em>authentication</em>, ldap attributes specified
664 in the <code class="directive"><a href="#authldapurl">authldapurl</a></code>
665 directive are placed in environment variables with the prefix "AUTHENTICATE_".</p>
667 <p>when this module performs <em>authorization</em>, ldap attributes specified
668 in the <code class="directive"><a href="#authldapurl">authldapurl</a></code>
669 directive are placed in environment variables with the prefix "AUTHORIZE_".</p>
671 <p>If the attribute field contains the username, common name
672 and telephone number of a user, a CGI program will have access to
673 this information without the need to make a second independent LDAP
674 query to gather this additional information.</p>
676 <p>This has the potential to dramatically simplify the coding and
677 configuration required in some web applications.</p>
679 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
680 <div class="section">
681 <h2><a name="activedirectory" id="activedirectory">Using Active Directory</a></h2>
683 <p>An Active Directory installation may support multiple domains at the
684 same time. To distinguish users between domains, an identifier called
685 a User Principle Name (UPN) can be added to a user's entry in the
686 directory. This UPN usually takes the form of the user's account
687 name, followed by the domain components of the particular domain,
688 for example <em>somebody@nz.example.com</em>.</p>
690 <p>You may wish to configure the <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code>
691 module to authenticate users present in any of the domains making up
692 the Active Directory forest. In this way both
693 <em>somebody@nz.example.com</em> and <em>someone@au.example.com</em>
694 can be authenticated using the same query at the same time.</p>
696 <p>To make this practical, Active Directory supports the concept of
697 a Global Catalog. This Global Catalog is a read only copy of selected
698 attributes of all the Active Directory servers within the Active
699 Directory forest. Querying the Global Catalog allows all the domains
700 to be queried in a single query, without the query spanning servers
701 over potentially slow links.</p>
703 <p>If enabled, the Global Catalog is an independent directory server
704 that runs on port 3268 (3269 for SSL). To search for a user, do a
705 subtree search for the attribute <em>userPrincipalName</em>, with
706 an empty search root, like so:</p>
708 <pre class="prettyprint lang-config">
709 AuthLDAPBindDN apache@example.com
710 AuthLDAPBindPassword password
711 AuthLDAPURL ldap://10.0.0.1:3268/?userPrincipalName?sub
715 <p>Users will need to enter their User Principal Name as a login, in
716 the form <em>somebody@nz.example.com</em>.</p>
718 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
719 <div class="section">
720 <h2><a name="frontpage" id="frontpage">Using Microsoft
721 FrontPage with mod_authnz_ldap</a></h2>
723 <p>Normally, FrontPage uses FrontPage-web-specific user/group
724 files (i.e., the <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code> and
725 <code class="module"><a href="../mod/mod_authz_groupfile.html">mod_authz_groupfile</a></code> modules) to handle all
726 authentication. Unfortunately, it is not possible to just
727 change to LDAP authentication by adding the proper directives,
728 because it will break the <em>Permissions</em> forms in
729 the FrontPage client, which attempt to modify the standard
730 text-based authorization files.</p>
732 <p>Once a FrontPage web has been created, adding LDAP
733 authentication to it is a matter of adding the following
734 directives to <em>every</em> <code>.htaccess</code> file
735 that gets created in the web</p>
736 <pre class="prettyprint lang-config">
737 AuthLDAPURL "the url"
738 AuthGroupFile mygroupfile
739 Require group mygroupfile
743 <h3><a name="howitworks" id="howitworks">How It Works</a></h3>
745 <p>FrontPage restricts access to a web by adding the <code>Require
746 valid-user</code> directive to the <code>.htaccess</code>
747 files. The <code>Require valid-user</code> directive will succeed for
748 any user who is valid <em>as far as LDAP is
749 concerned</em>. This means that anybody who has an entry in
750 the LDAP directory is considered a valid user, whereas FrontPage
751 considers only those people in the local user file to be
752 valid. By substituting the ldap-group with group file authorization,
753 Apache is allowed to consult the local user file (which is managed by
754 FrontPage) - instead of LDAP - when handling authorizing the user.</p>
756 <p>Once directives have been added as specified above,
757 FrontPage users will be able to perform all management
758 operations from the FrontPage client.</p>
761 <h3><a name="fpcaveats" id="fpcaveats">Caveats</a></h3>
764 <li>When choosing the LDAP URL, the attribute to use for
765 authentication should be something that will also be valid
766 for putting into a <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code> user file.
767 The user ID is ideal for this.</li>
769 <li>When adding users via FrontPage, FrontPage administrators
770 should choose usernames that already exist in the LDAP
771 directory (for obvious reasons). Also, the password that the
772 administrator enters into the form is ignored, since Apache
773 will actually be authenticating against the password in the
774 LDAP database, and not against the password in the local user
775 file. This could cause confusion for web administrators.</li>
778 <li>Apache must be compiled with <code class="module"><a href="../mod/mod_auth_basic.html">mod_auth_basic</a></code>,
779 <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code> and
780 <code class="module"><a href="../mod/mod_authz_groupfile.html">mod_authz_groupfile</a></code> in order to
781 use FrontPage support. This is because Apache will still use
782 the <code class="module"><a href="../mod/mod_authz_groupfile.html">mod_authz_groupfile</a></code> group file for determine
783 the extent of a user's access to the FrontPage web.</li>
785 <li>The directives must be put in the <code>.htaccess</code>
786 files. Attempting to put them inside <code class="directive"><a href="../mod/core.html#location"><Location></a></code> or <code class="directive"><a href="../mod/core.html#directory"><Directory></a></code> directives won't work. This
787 is because <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> has to be able to grab
788 the <code class="directive"><a href="../mod/mod_authz_groupfile.html#authgroupfile">AuthGroupFile</a></code>
789 directive that is found in FrontPage <code>.htaccess</code>
790 files so that it knows where to look for the valid user list. If
791 the <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> directives aren't in the same
792 <code>.htaccess</code> file as the FrontPage directives, then
793 the hack won't work, because <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> will
794 never get a chance to process the <code>.htaccess</code> file,
795 and won't be able to find the FrontPage-managed user file.</li>
799 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
800 <div class="directive-section"><h2><a name="AuthLDAPAuthorizePrefix" id="AuthLDAPAuthorizePrefix">AuthLDAPAuthorizePrefix</a> <a name="authldapauthorizeprefix" id="authldapauthorizeprefix">Directive</a></h2>
801 <table class="directive">
802 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the prefix for environment variables set during
803 authorization</td></tr>
804 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPAuthorizePrefix <em>prefix</em></code></td></tr>
805 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPAuthorizePrefix AUTHORIZE_</code></td></tr>
806 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
807 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
808 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
809 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
810 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.3.6 and later</td></tr>
812 <p>This directive allows you to override the prefix used for environment
813 variables set during LDAP authorization. If <em>AUTHENTICATE_</em> is
814 specified, consumers of these environment variables see the same information
815 whether LDAP has performed authentication, authorization, or both.</p>
817 <div class="note"><h3>Note</h3>
818 No authorization variables are set when a user is authorized on the basis of
819 <code>Require valid-user</code>.
823 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
824 <div class="directive-section"><h2><a name="AuthLDAPBindAuthoritative" id="AuthLDAPBindAuthoritative">AuthLDAPBindAuthoritative</a> <a name="authldapbindauthoritative" id="authldapbindauthoritative">Directive</a></h2>
825 <table class="directive">
826 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Determines if other authentication providers are used when a user can be mapped to a DN but the server cannot successfully bind with the user's credentials.</td></tr>
827 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPBindAuthoritative<em>off|on</em></code></td></tr>
828 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPBindAuthoritative on</code></td></tr>
829 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
830 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
831 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
832 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
834 <p>By default, subsequent authentication providers are only queried if a
835 user cannot be mapped to a DN, but not if the user can be mapped to a DN and their
836 password cannot be verified with an LDAP bind.
837 If <code class="directive"><a href="#authldapbindauthoritative">AuthLDAPBindAuthoritative</a></code>
838 is set to <em>off</em>, other configured authentication modules will have
839 a chance to validate the user if the LDAP bind (with the current user's credentials)
840 fails for any reason.</p>
841 <p> This allows users present in both LDAP and
842 <code class="directive"><a href="../mod/mod_authn_file.html#authuserfile">AuthUserFile</a></code> to authenticate
843 when the LDAP server is available but the user's account is locked or password
844 is otherwise unusable.</p>
848 <li><code class="directive"><a href="../mod/mod_authn_file.html#authuserfile">AuthUserFile</a></code></li>
849 <li><code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code></li>
852 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
853 <div class="directive-section"><h2><a name="AuthLDAPBindDN" id="AuthLDAPBindDN">AuthLDAPBindDN</a> <a name="authldapbinddn" id="authldapbinddn">Directive</a></h2>
854 <table class="directive">
855 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Optional DN to use in binding to the LDAP server</td></tr>
856 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPBindDN <em>distinguished-name</em></code></td></tr>
857 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
858 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
859 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
860 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
862 <p>An optional DN used to bind to the server when searching for
863 entries. If not provided, <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> will use
864 an anonymous bind.</p>
867 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
868 <div class="directive-section"><h2><a name="AuthLDAPBindPassword" id="AuthLDAPBindPassword">AuthLDAPBindPassword</a> <a name="authldapbindpassword" id="authldapbindpassword">Directive</a></h2>
869 <table class="directive">
870 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Password used in conjuction with the bind DN</td></tr>
871 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPBindPassword <em>password</em></code></td></tr>
872 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
873 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
874 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
875 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
876 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td><em>exec:</em> was added in 2.4.6.</td></tr>
878 <p>A bind password to use in conjunction with the bind DN. Note
879 that the bind password is probably sensitive data, and should be
880 properly protected. You should only use the <code class="directive"><a href="#authldapbinddn">AuthLDAPBindDN</a></code> and <code class="directive"><a href="#authldapbindpassword">AuthLDAPBindPassword</a></code> if you
881 absolutely need them to search the directory.</p>
883 <p>If the value begins with exec: the resulting command will be
884 executed and the first line returned to standard output by the
885 program will be used as the password.</p>
886 <div class="example"><pre>
888 AuthLDAPBindPassword secret
890 #Run /path/to/program to get my password
891 AuthLDAPBindPassword exec:/path/to/program
893 #Run /path/to/otherProgram and provide arguments
894 AuthLDAPBindPassword "exec:/path/to/otherProgram argument1"
899 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
900 <div class="directive-section"><h2><a name="AuthLDAPCharsetConfig" id="AuthLDAPCharsetConfig">AuthLDAPCharsetConfig</a> <a name="authldapcharsetconfig" id="authldapcharsetconfig">Directive</a></h2>
901 <table class="directive">
902 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Language to charset conversion configuration file</td></tr>
903 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPCharsetConfig <em>file-path</em></code></td></tr>
904 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
905 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
906 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
908 <p>The <code class="directive">AuthLDAPCharsetConfig</code> directive sets the location
909 of the language to charset conversion configuration file. <var>File-path</var> is relative
910 to the <code class="directive"><a href="../mod/core.html#serverroot">ServerRoot</a></code>. This file specifies
911 the list of language extensions to character sets.
912 Most administrators use the provided <code>charset.conv</code>
913 file, which associates common language extensions to character sets.</p>
915 <p>The file contains lines in the following format:</p>
917 <div class="example"><p><code>
918 <var>Language-Extension</var> <var>charset</var> [<var>Language-String</var>] ...
921 <p>The case of the extension does not matter. Blank lines, and lines
922 beginning with a hash character (<code>#</code>) are ignored.</p>
925 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
926 <div class="directive-section"><h2><a name="AuthLDAPCompareAsUser" id="AuthLDAPCompareAsUser">AuthLDAPCompareAsUser</a> <a name="authldapcompareasuser" id="authldapcompareasuser">Directive</a></h2>
927 <table class="directive">
928 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Use the authenticated user's credentials to perform authorization comparisons</td></tr>
929 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPCompareAsUser on|off</code></td></tr>
930 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPCompareAsUser off</code></td></tr>
931 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
932 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
933 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
934 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
935 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.3.6 and later</td></tr>
937 <p>When set, and <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> has authenticated the
938 user, LDAP comparisons for authorization use the queried distinguished name (DN)
939 and HTTP basic authentication password of the authenticated user instead of
940 the servers configured credentials.</p>
942 <p> The <em>ldap-attribute</em>, <em>ldap-user</em>, and <em>ldap-group</em> (single-level only)
943 authorization checks use comparisons.</p>
945 <p>This directive only has effect on the comparisons performed during
946 nested group processing when <code class="directive"><a href="#authldapsearchasuser">
947 AuthLDAPSearchAsUser</a></code> is also enabled.</p>
949 <p> This directive should only be used when your LDAP server doesn't
950 accept anonymous comparisons and you cannot use a dedicated
951 <code class="directive"><a href="#authldapbinddn">AuthLDAPBindDN</a></code>.
956 <li><code class="directive"><a href="#authldapinitialbindasuser">AuthLDAPInitialBindAsUser</a></code></li>
957 <li><code class="directive"><a href="#authldapsearchasuser">AuthLDAPSearchAsUser</a></code></li>
960 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
961 <div class="directive-section"><h2><a name="AuthLDAPCompareDNOnServer" id="AuthLDAPCompareDNOnServer">AuthLDAPCompareDNOnServer</a> <a name="authldapcomparednonserver" id="authldapcomparednonserver">Directive</a></h2>
962 <table class="directive">
963 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Use the LDAP server to compare the DNs</td></tr>
964 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPCompareDNOnServer on|off</code></td></tr>
965 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPCompareDNOnServer on</code></td></tr>
966 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
967 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
968 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
969 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
971 <p>When set, <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> will use the LDAP
972 server to compare the DNs. This is the only foolproof way to
973 compare DNs. <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> will search the
974 directory for the DN specified with the <a href="#reqdn"><code>Require dn</code></a> directive, then,
975 retrieve the DN and compare it with the DN retrieved from the user
976 entry. If this directive is not set,
977 <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> simply does a string comparison. It
978 is possible to get false negatives with this approach, but it is
979 much faster. Note the <code class="module"><a href="../mod/mod_ldap.html">mod_ldap</a></code> cache can speed up
980 DN comparison in most situations.</p>
983 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
984 <div class="directive-section"><h2><a name="AuthLDAPDereferenceAliases" id="AuthLDAPDereferenceAliases">AuthLDAPDereferenceAliases</a> <a name="authldapdereferencealiases" id="authldapdereferencealiases">Directive</a></h2>
985 <table class="directive">
986 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>When will the module de-reference aliases</td></tr>
987 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPDereferenceAliases never|searching|finding|always</code></td></tr>
988 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPDereferenceAliases always</code></td></tr>
989 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
990 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
991 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
992 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
994 <p>This directive specifies when <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> will
995 de-reference aliases during LDAP operations. The default is
996 <code>always</code>.</p>
999 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
1000 <div class="directive-section"><h2><a name="AuthLDAPGroupAttribute" id="AuthLDAPGroupAttribute">AuthLDAPGroupAttribute</a> <a name="authldapgroupattribute" id="authldapgroupattribute">Directive</a></h2>
1001 <table class="directive">
1002 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>LDAP attributes used to identify the user members of
1004 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPGroupAttribute <em>attribute</em></code></td></tr>
1005 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPGroupAttribute member uniquemember</code></td></tr>
1006 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
1007 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
1008 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
1009 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
1011 <p>This directive specifies which LDAP attributes are used to
1012 check for user members within groups. Multiple attributes can be used
1013 by specifying this directive multiple times. If not specified,
1014 then <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> uses the <code>member</code> and
1015 <code>uniquemember</code> attributes.</p>
1018 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
1019 <div class="directive-section"><h2><a name="AuthLDAPGroupAttributeIsDN" id="AuthLDAPGroupAttributeIsDN">AuthLDAPGroupAttributeIsDN</a> <a name="authldapgroupattributeisdn" id="authldapgroupattributeisdn">Directive</a></h2>
1020 <table class="directive">
1021 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Use the DN of the client username when checking for
1022 group membership</td></tr>
1023 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPGroupAttributeIsDN on|off</code></td></tr>
1024 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPGroupAttributeIsDN on</code></td></tr>
1025 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
1026 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
1027 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
1028 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
1030 <p>When set <code>on</code>, this directive says to use the
1031 distinguished name of the client username when checking for group
1032 membership. Otherwise, the username will be used. For example,
1033 assume that the client sent the username <code>bjenson</code>,
1034 which corresponds to the LDAP DN <code>cn=Babs Jenson,
1035 o=Example</code>. If this directive is set,
1036 <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> will check if the group has
1037 <code>cn=Babs Jenson, o=Example</code> as a member. If this
1038 directive is not set, then <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> will
1039 check if the group has <code>bjenson</code> as a member.</p>
1042 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
1043 <div class="directive-section"><h2><a name="AuthLDAPInitialBindAsUser" id="AuthLDAPInitialBindAsUser">AuthLDAPInitialBindAsUser</a> <a name="authldapinitialbindasuser" id="authldapinitialbindasuser">Directive</a></h2>
1044 <table class="directive">
1045 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Determines if the server does the initial DN lookup using the basic authentication users'
1046 own username, instead of anonymously or with hard-coded credentials for the server</td></tr>
1047 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPInitialBindAsUser <em>off|on</em></code></td></tr>
1048 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPInitialBindAsUser off</code></td></tr>
1049 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
1050 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
1051 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
1052 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
1053 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.3.6 and later</td></tr>
1055 <p>By default, the server either anonymously, or with a dedicated user and
1056 password, converts the basic authentication username into an LDAP
1057 distinguished name (DN). This directive forces the server to use the verbatim username
1058 and password provided by the incoming user to perform the initial DN
1061 <p> If the verbatim username can't directly bind, but needs some
1062 cosmetic transformation, see <code class="directive"><a href="#authldapinitialbindpattern">
1063 AuthLDAPInitialBindPattern</a></code>.</p>
1065 <p> This directive should only be used when your LDAP server doesn't
1066 accept anonymous searches and you cannot use a dedicated
1067 <code class="directive"><a href="#authldapbinddn">AuthLDAPBindDN</a></code>.
1070 <div class="note"><h3>Not available with authorization-only</h3>
1071 This directive can only be used if this module authenticates the user, and
1072 has no effect when this module is used exclusively for authorization.
1077 <li><code class="directive"><a href="#authldapinitialbindpattern">AuthLDAPInitialBindPattern</a></code></li>
1078 <li><code class="directive"><a href="#authldapbinddn">AuthLDAPBindDN</a></code></li>
1079 <li><code class="directive"><a href="#authldapcompareasuser">AuthLDAPCompareAsUser</a></code></li>
1080 <li><code class="directive"><a href="#authldapsearchasuser">AuthLDAPSearchAsUser</a></code></li>
1083 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
1084 <div class="directive-section"><h2><a name="AuthLDAPInitialBindPattern" id="AuthLDAPInitialBindPattern">AuthLDAPInitialBindPattern</a> <a name="authldapinitialbindpattern" id="authldapinitialbindpattern">Directive</a></h2>
1085 <table class="directive">
1086 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the transformation of the basic authentication username to be used when binding to the LDAP server
1087 to perform a DN lookup</td></tr>
1088 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPInitialBindPattern<em><var>regex</var> <var>substitution</var></em></code></td></tr>
1089 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPInitialBindPattern (.*) $1 (remote username used verbatim)</code></td></tr>
1090 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
1091 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
1092 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
1093 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
1094 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.3.6 and later</td></tr>
1096 <p>If <code class="directive"><a href="#authldapinitialbindasuser">AuthLDAPInitialBindAsUser</a></code> is set to
1097 <em>ON</em>, the basic authentication username will be transformed according to the
1098 regular expression and substituion arguments.</p>
1100 <p> The regular expression argument is compared against the current basic authentication username.
1101 The substitution argument may contain backreferences, but has no other variable interpolation.</p>
1103 <p> This directive should only be used when your LDAP server doesn't
1104 accept anonymous searches and you cannot use a dedicated
1105 <code class="directive"><a href="#authldapbinddn">AuthLDAPBindDN</a></code>.
1108 <pre class="prettyprint lang-config"> AuthLDAPInitialBindPattern (.+) $1@example.com </pre>
1110 <pre class="prettyprint lang-config"> AuthLDAPInitialBindPattern (.+) cn=$1,dc=example,dc=com</pre>
1113 <div class="note"><h3>Not available with authorization-only</h3>
1114 This directive can only be used if this module authenticates the user, and
1115 has no effect when this module is used exclusively for authorization.
1117 <div class="note"><h3>debugging</h3>
1118 The substituted DN is recorded in the environment variable
1119 <em>LDAP_BINDASUSER</em>. If the regular expression does not match the input,
1120 the verbatim username is used.
1125 <li><code class="directive"><a href="#authldapinitialbindasuser">AuthLDAPInitialBindAsUser</a></code></li>
1126 <li><code class="directive"><a href="#authldapbinddn">AuthLDAPBindDN</a></code></li>
1129 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
1130 <div class="directive-section"><h2><a name="AuthLDAPMaxSubGroupDepth" id="AuthLDAPMaxSubGroupDepth">AuthLDAPMaxSubGroupDepth</a> <a name="authldapmaxsubgroupdepth" id="authldapmaxsubgroupdepth">Directive</a></h2>
1131 <table class="directive">
1132 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the maximum sub-group nesting depth that will be
1133 evaluated before the user search is discontinued.</td></tr>
1134 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPMaxSubGroupDepth <var>Number</var></code></td></tr>
1135 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPMaxSubGroupDepth 10</code></td></tr>
1136 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
1137 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
1138 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
1139 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
1140 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.3.0 and later</td></tr>
1142 <p>When this directive is set to a non-zero value <code>X</code>
1143 combined with use of the <code>Require ldap-group someGroupDN</code>
1144 directive, the provided user credentials will be searched for
1145 as a member of the <code>someGroupDN</code> directory object or of
1146 any group member of the current group up to the maximum nesting
1147 level <code>X</code> specified by this directive.</p>
1148 <p>See the <a href="#reqgroup"><code>Require ldap-group</code></a>
1149 section for a more detailed example.</p>
1151 <div class="note"><h3>Nested groups performance</h3>
1152 <p> When <code class="directive">AuthLDAPSubGroupAttribute</code> overlaps with
1153 <code class="directive">AuthLDAPGroupAttribute</code> (as it does by default and
1154 as required by common LDAP schemas), uncached searching for subgroups in
1155 large groups can be very slow. If you use large, non-nested groups, set
1156 <code class="directive">AuthLDAPMaxSubGroupDepth</code> to zero.</p>
1161 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
1162 <div class="directive-section"><h2><a name="AuthLDAPRemoteUserAttribute" id="AuthLDAPRemoteUserAttribute">AuthLDAPRemoteUserAttribute</a> <a name="authldapremoteuserattribute" id="authldapremoteuserattribute">Directive</a></h2>
1163 <table class="directive">
1164 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Use the value of the attribute returned during the user
1165 query to set the REMOTE_USER environment variable</td></tr>
1166 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPRemoteUserAttribute uid</code></td></tr>
1167 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
1168 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
1169 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
1170 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
1171 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
1173 <p>If this directive is set, the value of the
1174 <code>REMOTE_USER</code> environment variable will be set to the
1175 value of the attribute specified. Make sure that this attribute is
1176 included in the list of attributes in the AuthLDAPUrl definition,
1177 otherwise this directive will have no effect. This directive, if
1178 present, takes precedence over AuthLDAPRemoteUserIsDN. This
1179 directive is useful should you want people to log into a website
1180 using an email address, but a backend application expects the
1181 username as a userid.</p>
1184 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
1185 <div class="directive-section"><h2><a name="AuthLDAPRemoteUserIsDN" id="AuthLDAPRemoteUserIsDN">AuthLDAPRemoteUserIsDN</a> <a name="authldapremoteuserisdn" id="authldapremoteuserisdn">Directive</a></h2>
1186 <table class="directive">
1187 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Use the DN of the client username to set the REMOTE_USER
1188 environment variable</td></tr>
1189 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPRemoteUserIsDN on|off</code></td></tr>
1190 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPRemoteUserIsDN off</code></td></tr>
1191 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
1192 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
1193 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
1194 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
1196 <p>If this directive is set to on, the value of the
1197 <code>REMOTE_USER</code> environment variable will be set to the full
1198 distinguished name of the authenticated user, rather than just
1199 the username that was passed by the client. It is turned off by
1203 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
1204 <div class="directive-section"><h2><a name="AuthLDAPSearchAsUser" id="AuthLDAPSearchAsUser">AuthLDAPSearchAsUser</a> <a name="authldapsearchasuser" id="authldapsearchasuser">Directive</a></h2>
1205 <table class="directive">
1206 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Use the authenticated user's credentials to perform authorization searches</td></tr>
1207 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPSearchAsUser on|off</code></td></tr>
1208 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPSearchAsUser off</code></td></tr>
1209 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
1210 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
1211 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
1212 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
1213 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.3.6 and later</td></tr>
1215 <p>When set, and <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> has authenticated the
1216 user, LDAP searches for authorization use the queried distinguished name (DN)
1217 and HTTP basic authentication password of the authenticated user instead of
1218 the servers configured credentials.</p>
1220 <p> The <em>ldap-filter</em> and <em>ldap-dn</em> authorization
1221 checks use searches.</p>
1223 <p>This directive only has effect on the comparisons performed during
1224 nested group processing when <code class="directive"><a href="#authldapcompareasuser">
1225 AuthLDAPCompareAsUser</a></code> is also enabled.</p>
1227 <p> This directive should only be used when your LDAP server doesn't
1228 accept anonymous searches and you cannot use a dedicated
1229 <code class="directive"><a href="#authldapbinddn">AuthLDAPBindDN</a></code>.
1234 <li><code class="directive"><a href="#authldapinitialbindasuser">AuthLDAPInitialBindAsUser</a></code></li>
1235 <li><code class="directive"><a href="#authldapcompareasuser">AuthLDAPCompareAsUser</a></code></li>
1238 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
1239 <div class="directive-section"><h2><a name="AuthLDAPSubGroupAttribute" id="AuthLDAPSubGroupAttribute">AuthLDAPSubGroupAttribute</a> <a name="authldapsubgroupattribute" id="authldapsubgroupattribute">Directive</a></h2>
1240 <table class="directive">
1241 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies the attribute labels, one value per
1242 directive line, used to distinguish the members of the current group that
1243 are groups.</td></tr>
1244 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPSubGroupAttribute <em>attribute</em></code></td></tr>
1245 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPSubgroupAttribute member uniquemember</code></td></tr>
1246 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
1247 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
1248 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
1249 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
1250 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.3.0 and later</td></tr>
1252 <p>An LDAP group object may contain members that are users and
1253 members that are groups (called nested or sub groups). The
1254 <code>AuthLDAPSubGroupAttribute</code> directive identifies the
1255 labels of group members and the <code>AuthLDAPGroupAttribute</code>
1256 directive identifies the labels of the user members. Multiple
1257 attributes can be used by specifying this directive multiple times.
1258 If not specified, then <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> uses the
1259 <code>member</code> and <code>uniqueMember</code> attributes.</p>
1262 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
1263 <div class="directive-section"><h2><a name="AuthLDAPSubGroupClass" id="AuthLDAPSubGroupClass">AuthLDAPSubGroupClass</a> <a name="authldapsubgroupclass" id="authldapsubgroupclass">Directive</a></h2>
1264 <table class="directive">
1265 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Specifies which LDAP objectClass values identify directory
1266 objects that are groups during sub-group processing.</td></tr>
1267 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPSubGroupClass <em>LdapObjectClass</em></code></td></tr>
1268 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthLDAPSubGroupClass groupOfNames groupOfUniqueNames</code></td></tr>
1269 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
1270 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
1271 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
1272 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
1273 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.3.0 and later</td></tr>
1275 <p>An LDAP group object may contain members that are users and
1276 members that are groups (called nested or sub groups). The
1277 <code>AuthLDAPSubGroupAttribute</code> directive identifies the
1278 labels of members that may be sub-groups of the current group
1279 (as opposed to user members). The <code>AuthLDAPSubGroupClass</code>
1280 directive specifies the LDAP objectClass values used in verifying that
1281 these potential sub-groups are in fact group objects. Verified sub-groups
1282 can then be searched for more user or sub-group members. Multiple
1283 attributes can be used by specifying this directive multiple times.
1284 If not specified, then <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> uses the
1285 <code>groupOfNames</code> and <code>groupOfUniqueNames</code> values.</p>
1288 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
1289 <div class="directive-section"><h2><a name="AuthLDAPUrl" id="AuthLDAPUrl">AuthLDAPUrl</a> <a name="authldapurl" id="authldapurl">Directive</a></h2>
1290 <table class="directive">
1291 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>URL specifying the LDAP search parameters</td></tr>
1292 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthLDAPUrl <em>url [NONE|SSL|TLS|STARTTLS]</em></code></td></tr>
1293 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
1294 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
1295 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
1296 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_ldap</td></tr>
1298 <p>An RFC 2255 URL which specifies the LDAP search parameters
1299 to use. The syntax of the URL is</p>
1300 <div class="example"><p><code>ldap://host:port/basedn?attribute?scope?filter</code></p></div>
1301 <p>If you want to specify more than one LDAP URL that Apache should try in turn, the syntax is:</p>
1302 <pre class="prettyprint lang-config">AuthLDAPUrl "ldap://ldap1.example.com ldap2.example.com/dc=..."</pre>
1304 <p><em><strong>Caveat: </strong>If you specify multiple servers, you need to enclose the entire URL string in quotes;
1305 otherwise you will get an error: "AuthLDAPURL takes one argument, URL to define LDAP connection.." </em>
1306 You can of course use search parameters on each of these.</p>
1311 <dd>For regular ldap, use the
1312 string <code>ldap</code>. For secure LDAP, use <code>ldaps</code>
1313 instead. Secure LDAP is only available if Apache was linked
1314 to an LDAP library with SSL support.</dd>
1319 <p>The name/port of the ldap server (defaults to
1320 <code>localhost:389</code> for <code>ldap</code>, and
1321 <code>localhost:636</code> for <code>ldaps</code>). To
1322 specify multiple, redundant LDAP servers, just list all
1323 servers, separated by spaces. <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code>
1324 will try connecting to each server in turn, until it makes a
1325 successful connection. If multiple ldap servers are specified,
1326 then entire LDAP URL must be encapsulated in double quotes.</p>
1328 <p>Once a connection has been made to a server, that
1329 connection remains active for the life of the
1330 <code class="program"><a href="../programs/httpd.html">httpd</a></code> process, or until the LDAP server goes
1333 <p>If the LDAP server goes down and breaks an existing
1334 connection, <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> will attempt to
1335 re-connect, starting with the primary server, and trying
1336 each redundant server in turn. Note that this is different
1337 than a true round-robin search.</p>
1342 <dd>The DN of the branch of the
1343 directory where all searches should start from. At the very
1344 least, this must be the top of your directory tree, but
1345 could also specify a subtree in the directory.</dd>
1349 <dd>The attribute to search for.
1350 Although RFC 2255 allows a comma-separated list of
1351 attributes, only the first attribute will be used, no
1352 matter how many are provided. If no attributes are
1353 provided, the default is to use <code>uid</code>. It's a good
1354 idea to choose an attribute that will be unique across all
1355 entries in the subtree you will be using. All attributes
1356 listed will be put into the environment with an AUTHENTICATE_ prefix
1357 for use by other modules.</dd>
1361 <dd>The scope of the search. Can be either <code>one</code> or
1362 <code>sub</code>. Note that a scope of <code>base</code> is
1363 also supported by RFC 2255, but is not supported by this
1364 module. If the scope is not provided, or if <code>base</code> scope
1365 is specified, the default is to use a scope of
1366 <code>sub</code>.</dd>
1370 <dd>A valid LDAP search filter. If
1371 not provided, defaults to <code>(objectClass=*)</code>, which
1372 will search for all objects in the tree. Filters are
1373 limited to approximately 8000 characters (the definition of
1374 <code>MAX_STRING_LEN</code> in the Apache source code). This
1375 should be more than sufficient for any application.</dd>
1378 <p>When doing searches, the attribute, filter and username passed
1379 by the HTTP client are combined to create a search filter that
1381 <code>(&(<em>filter</em>)(<em>attribute</em>=<em>username</em>))</code>.</p>
1383 <p>For example, consider an URL of
1384 <code>ldap://ldap.example.com/o=Example?cn?sub?(posixid=*)</code>. When
1385 a client attempts to connect using a username of <code>Babs
1386 Jenson</code>, the resulting search filter will be
1387 <code>(&(posixid=*)(cn=Babs Jenson))</code>.</p>
1389 <p>An optional parameter can be added to allow the LDAP Url to override
1390 the connection type. This parameter can be one of the following:</p>
1394 <dd>Establish an unsecure connection on the default LDAP port. This
1395 is the same as <code>ldap://</code> on port 389.</dd>
1397 <dd>Establish a secure connection on the default secure LDAP port.
1398 This is the same as <code>ldaps://</code></dd>
1399 <dt>TLS | STARTTLS</dt>
1400 <dd>Establish an upgraded secure connection on the default LDAP port.
1401 This connection will be initiated on port 389 by default and then
1402 upgraded to a secure connection on the same port.</dd>
1405 <p>See above for examples of <code class="directive"><a href="#authldapurl">AuthLDAPURL</a></code> URLs.</p>
1409 <div class="bottomlang">
1410 <p><span>Available Languages: </span><a href="../en/mod/mod_authnz_ldap.html" title="English"> en </a> |
1411 <a href="../fr/mod/mod_authnz_ldap.html" hreflang="fr" rel="alternate" title="Français"> fr </a></p>
1412 </div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
1413 <script type="text/javascript"><!--//--><![CDATA[//><!--
1414 var comments_shortname = 'httpd';
1415 var comments_identifier = 'http://httpd.apache.org/docs/2.4/mod/mod_authnz_ldap.html';
1417 if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
1418 d.write('<div id="comments_thread"><\/div>');
1419 var s = d.createElement('script');
1420 s.type = 'text/javascript';
1422 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
1423 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
1426 d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
1428 })(window, document);
1429 //--><!]]></script></div><div id="footer">
1430 <p class="apache">Copyright 2014 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
1431 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><
projects / apache / blob