trying to allow domain admins access in apache

Posted by sharif on Server Fault See other posts from Server Fault or by sharif
Published on 2012-09-24T13:59:00Z Indexed on 2012/09/24 15:39 UTC
Read the original article Hit count: 455

Filed under:
|
|

I am trying to authenticate domain admins through apache and it is not working. Error i get is as follows

[Mon Sep 24 14:54:45 2012] [debug] src/mod_auth_kerb.c(1432): [client 172.16.0.85] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Mon Sep 24 14:54:45 2012] [debug] src/mod_auth_kerb.c(915): [client 172.16.0.85] Using HTTP/[email protected] as server principal for password verification
[Mon Sep 24 14:54:45 2012] [debug] src/mod_auth_kerb.c(655): [client 172.16.0.85] Trying to get TGT for user [email protected]
[Mon Sep 24 14:54:45 2012] [debug] src/mod_auth_kerb.c(569): [client 172.16.0.85] Trying to verify authenticity of KDC using principal HTTP/[email protected]
[Mon Sep 24 14:54:45 2012] [debug] src/mod_auth_kerb.c(994): [client 172.16.0.85] kerb_authenticate_user_krb5pwd ret=0 [email protected] authtype=Basic
[Mon Sep 24 14:54:45 2012] [debug] mod_authnz_ldap.c(561): [client 172.16.0.85] ldap authorize: Creating LDAP req structure
[Mon Sep 24 14:54:45 2012] [debug] mod_authnz_ldap.c(573): [client 172.16.0.85] auth_ldap authorise: User DN not found, LDAP: ldap_simple_bind_s() failed

Below is what I have in my httpd file

Alias /compass "/data/intranet/html/compass"

<Directory "/data/intranet/html/compass">
        AuthType Kerberos
        AuthName KerberosLogin
        KrbServiceName HTTP/intranet.xxx.com
        KrbMethodNegotiate On
        KrbMethodK5Passwd On
        KrbAuthRealms xxx.COM
        Krb5KeyTab /etc/httpd/conf/intranet.keytab
       # require valid-user
       # Options Indexes MultiViews FollowSymLinks
       # AllowOverride All
       # Order allow,deny
       # Allow from all
       #        SetOutputFilter DEFLATE


# taken from http://blogs.freebsdish.org/tmclaugh/2010/07/15/mod_auth_kerb-ad-and-ldap-authorization/
# download extra module and install

        # Strip the kerberos realm from the principle.
#   MapUsernameRule (.*)@(.*) "$1"

        AuthLDAPURL "ldap://echo.uk.xxx.com akhutan.usa.xxx.com/dc=xxx,dc=com?sAMAccountName"
        AuthLDAPBindDN cn=Administrator,ou=Users,dc=xxx,dc=com
        AuthLDAPBindPassword ***
        Require ldap-group cn=Domain Admins,ou=Users,dc=xxx,dc=com
</Directory>

I have followed this guide. I have download and install the tarball. when I try to uncomment MapUsernameRule i get failed error when restarting apache

Reloading httpd: not reloading due to configuration syntax error

I am using centos 5 64bit.

I have added the following line but i still get syntax error

LoadModule mod_map_user modules/mod_map_user.so

© Server Fault or respective owner

Related posts about apache2

Related posts about ldap