Apache mod_auth_kerb – Integrating with LDAP User Groups

Here's how I manage the repository access:

1. Every repository has an "admin" directory, which contains the authz file
2. I set up the authz file to limit access to the "admin" directory to the "owners" of the repository.
3. I have a cron job check for changes in the "admin" directory, and copy out the authz file into the repository.

I don't do anything in the Apache config other that "require valid-user" (that way Apache only needs to be restarted when new repositories get added).

This way I offload all the maintenance of repository permissions to the owners of the repository. This may not directly address your problem, as it doesn't incorporate any LDAP groups, but this solution has worked for me for several years with hundreds of repositories.

In general, group membership should be managed centrally, just like users.

However, when you talk about users needing to be superuser permissions, it makes me think that you're managing wheel for su on each machine separately. This is acceptable, but a bit tedious, especially if you have multiple servers that should all behave the same way.

You could change the group used by pam_wheel or have multiple pam_wheel entries (with different options each time in /etc/pam.d/su, but a better alternative is to use sudo and integrate that with your LDAP. Sudo will give you finer-grain control per server, and LDAP will distribute it appropriately.

Some distributions separate sudo and sudo-ldap.