From: Paul J. Reder Require ldap-group
directive, and
the DN fetched from the LDAP directory (or the username
- passed by the client) occurs in the LDAP group.Require ldap-attribute
@@ -289,6 +290,32 @@ for HTTP Basic authentication.
user DN or the username when doing comparisons for the
Require ldap-group
directive.
+
+
+
+
+
+
+ Determines the maximum depth of sub-groups that will be evaluated
+ during comparisons in the
+ Require ldap-group
directive.
+
+
+
+
+ Determines the attribute to use when obtaining sub-group members
+ of the current group during comparisons in the
+ Require ldap-group
+ directive.
+
@@ -365,10 +392,54 @@ uniqueMember: cn=Fred User, o=Airius
+
+ Specifies the LDAP objectClass values used to identify if queried directory
+ objects really are group objects (as opposed to user objects) during the
+
+ Require ldap-group
directive's sub-group processing.
Barbara:
Members can also be found within sub-groups of a specified LDAP group
+ if
The following directives would allow access for Bob Ellis, Tom Jackson, + Barbara Jensen, Fred User, Allan Jefferson, and Paul Tilley but would not + allow access for Jim Swenson, or Elliot Rhodes (since they are at a + sub-group depth of 2):
+Behavior of this directive is modified by the
This directive specifies which LDAP attributes are used to
- check for group membership. Multiple attributes can be used by
- specifying this directive multiple times. If not specified,
+ check for user members within groups. Multiple attributes can be used
+ by specifying this directive multiple times. If not specified,
then member
and
uniquemember
attributes.
When this directive is set to a non-zero value X
+ combined with use of the Require ldap-group someGroupDN
+ directive, the provided user credentials will be searched for
+ as a member of the someGroupDN
directory object or of
+ any group member of the current group up to the maximum nesting
+ level X
specified by this directive.
See the Require ldap-group
+ section for a more detailed example.
An LDAP group object may contain members that are users and
+ members that are groups (called nested or sub groups). The
+ AuthLDAPSubGroupAttribute
directive identifies the
+ labels of group members and the AuthLDAPGroupAttribute
+ directive identifies the labels of the user members. Multiple
+ attributes can be used by specifying this directive multiple times.
+ If not specified, then member
and uniqueMember
attributes.
An LDAP group object may contain members that are users and
+ members that are groups (called nested or sub groups). The
+ AuthLDAPSubGroupAttribute
directive identifies the
+ labels of members that may be sub-groups of the current group
+ (as opposed to user members). The AuthLDAPSubGroupClass
+ directive specifies the LDAP objectClass values used in verifying that
+ these potential sub-groups are in fact group objects. Verified sub-groups
+ can then be searched for more user or sub-group members. Multiple
+ attributes can be used by specifying this directive multiple times.
+ If not specified, then groupOfNames
and groupOfUniqueNames
values.
Note that, when group membership is being checked, any sub-group + comparison results are cached to speed future sub-group comparisons.
+The behavior of both of these caches is controlled with
the