Apache httpd LDAP integration

Posted by David W. on Server Fault See other posts from Server Fault or by David W.
Published on 2012-10-11T18:37:02Z Indexed on 2012/10/11 21:39 UTC
Read the original article Hit count: 436

Filed under:

apache2

|

svn

|

ldap

|

httpd

|

httpd.conf

I am configuring a CollabNet Subversion integration. I have the following collabnet_subversion.conf file:

<Location /svn>
  DAV svn
  SVNParentPath /mnt/svn/new_repos
  SVNListParentPath on
  AuthName "VegiBanc Source Repository"
  AuthType basic
  AuthzLDAPAuthoritative off
  AuthBasicProvider ldap
  AuthLDAPURL ldap://ldap.vegibanc.com/dc=vegibanc,dc=com?sAMAccountName" NONE
  AuthLDAPBindDN "CN=SVN-Admin,OU=Service Accounts,OU=VegiBanc Users,OU=vegibanc,DC=vegibanc,DC=com"
  AuthLDAPBindPassword "swordfish"
</Location>

This works great. Any user in our Active Directory can access our Subversion repository.

Now, I want to limit this to only people in the Active Directory group Development:

<Location /svn>
  DAV svn
  SVNParentPath /mnt/svn/new_repos
  SVNListParentPath on
  AuthName "VegiBanc Source Repository"
  AuthType basic
  AuthzLDAPAuthoritative off
  AuthBasicProvider ldap
  AuthLDAPURL ldap://ldap.vegibanc.com/dc=vegibanc,dc=com?sAMAccountName" NONE
  AuthLDAPBindDN "CN=SVN-Admin,OU=Service Accounts,OU=VegiBanc Users,OU=VegiBanc,DC=vegibanc,DC=com"
  AuthLDAPBindPassword "swordfish"
  Require ldap-group CN=Development OU=Security Groups OU=VegiBanc, dc=vegibanc, dc=com
</Location>

I added Require ldap-group, but now no one can log in. I have LogLevel set to debug, but all I get is this in my error_log (Single line broken up for easier reading):

[Thu Oct 11 13:09:28 2012] [info] [client 10.55.9.45] [6752] 
    vauth_ldap authenticate: user dweintraub authentication failed;
    URI /svn/ [ldap_search_ext_s() for user failed][Bad search filter]

And, I get this in my access_log:

10.55.9.45 - - [11/Oct/2012:13:09:27 -0500] "GET /svn/ HTTP/1.1" 401 401
10.55.9.45 - dweintraub [11/Oct/2012:13:09:28 -0500] "GET /svn/ HTTP/1.1" 500 535

Yes, I am in that group. (Or, at least how can I confirm that just to make sure that's not the issue. I have the SysinternalsSuite ADExplorer. It's where I'm getting all of my info.)

Developer IT