HTTP authentication against Active Directory via LDAP with apache2

Used on the "free" (as in beer) side:
The LDAP server that is to be queried here will be Microsoft's Active Directory (AD). AD has a particularity: To make a query to AD one needs to authenticate with AD first (this is called bind). Therefore it is necessary to create a user within AD with restricted rights (in particular, this user must not be able to log in or do anything serious) that is used to bind to AD prior to check the name/pw combination that is supplied via the http authentication. Let this user be called
with the password
and the domain that is considered is called
while the users are stored in the organisational unit (OU)
then the apache2 configuration might look as follows:
AuthType Basic
order allow,deny
allow from all
AuthName "Example apache2 LDAP auth with Active Directory on"
AuthLDAPURL ldap://name_or_ip:389/OU=company,DC=domain,DC=com?sAMAccountName?sub?(objectClass=user)
AuthLDAPBindDN ""
AuthLDAPBindPassword specialpassword
require valid-user
Keep in mind that the special bind user can introduce a security risk if not properly restricted!

Comments: Post a Comment

<< Home

This page is powered by Blogger. Isn't yours?