mod_auth_ldap modules allows an LDAP directory to be used to store the database for HTTP Basic authentication. This document describes an example implementation in Red Hat Enterprise Linux 4. This document also applies to any Linux distribution in general, provided the mod_auth_ldap module is loaded.
I have used Microsoft Active Directory as my LDAP server as that’s what I had at the time of writing this. But any LDAP Server will do for this.
Setting up webserver
On Red Hat Enterprise Linux 4, when the httpd package is installed, mod_auth_ldap gets installed with it. By default Red Hat Enterprise 4 httpd.conf file does not allow the overriding of any setting by the .htaccess file. Following are the default settings:
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride None
.......
.......
</Directory>
I changed the settings for /var/www/html to:
<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride AuthConfig
.......
.......
</Directory>
This enabled me to put the required authentication directives in the .htaccess files. You need to have administrative access to the web server or get this done from your administrator.
Next we need to find whether the mod_auth_ldap module is being loaded or not This can be done as follows on RHEL4
$ grep mod_auth_ldap /etc/httpd/conf/httpd.conf LoadModule auth_ldap_module modules/mod_auth_ldap.so
Test Setup
I have created a directory test_auth in the DocumentRoot which I want to have restrictive access using ldap authentication. Following commands will create the required directory and an index.html file in it.
$ sudo mkdir /var/www/html/test_auth $ sudo cat >>/var/www/html/test_auth/index.html <<__EOF__ <html> <head><title>Test page</title></head> <body><h1>Test page</h1><p>Hello World!</p></body> </html> __EOF__
Now we can create an .htaccess file containing the required authentication directives:
$ sudo vi /var/www/html/test_auth/.htaccess AuthType Basic AuthName "Restricted Access" AuthLDAPEnabled on AuthLDAPURL 'ldap://msadc01.unixclinic.net:389/ou=Users and Machines,ou=IN,dc=unixclinic,dc=net?sAMAccountName?sub?(memberOf=cn=Infrastructure Team,ou=Groups,ou=Users and Machines,ou=IN,dc=unixclinic,dc=net)' AuthLDAPBindDN "apache_ldap_query@unixclinic.net" AuthLDAPBindPassword pA554Auth require valid-user
The AuthLDAPURL specifies the LDAP server, the base DN, the attribute to use in the search, as well as the extra search filter to use and is a single line without any line breaks. The URL specifies that the access is restricted to the members of the “Infrastructure Team”. AuthLDAPBindDN is an optional DN (Distinguished Name) to use in binding to the LDAP server. If this is not specified then mod_auth_ldap will use anonymous bind. Most professionally setup LDAP Servers (and Active Directory Servers) does not allow anonymous binds against the directory.