Ldap – How to keep members of a LDAP group from accessing a folder with Apache .htaccess

ldap

Using Apache 2.2.14 on Ubuntu 10.04, I am trying to protect a folder with LDAP authentication. Our LDAP server is running Novell eDirectory.

All our users are in subgroups of ou=Users,ou=Directory,o=IC. Like this:

  • ou=Managers,ou=Users,ou=Directory,o=IC
  • ou=Employees,ou=Users,ou=Directory,o=IC
  • ou=Misc,ou=Users,ou=Directory,o=IC
  • ou=Outsiders,ou=Users,ou=Directory,o=IC

I want all of ou=Users,ou=Directory,o=IC to be able to access my folder, except those in ou=Outsiders,ou=Users,ou=Directory,o=IC.

I can get into my folder with my LDAP log in information using the following settings, but it doesn't block users in the Outsiders group:

AuthName "Login Required: please enter your L-number and PIN"
AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthLDAPURL ldaps://ldap.example.com/ou=Users,ou=Directory,o=IC?cn?sub?(objectclass=Person)
Require ldap-filter (|(cn=*,ou=Managers,ou=Users,ou=Directory,o=IC)(cn=*,ou=Employees,ou=Users,ou=Directory,o=IC)(cn=*,ou=Misc,ou=Users,ou=Directory,o=IC))
AuthLDAPBindDN cn=binder,ou=Admin,ou=Directory,o=IC
AuthLDAPBindPassword password

I've tried:

  • Require valid-user
  • Various AuthLDAPURLs
  • Require ldap-group for only the groups I want.
  • Other searches for the Require ldap-filter, like not having "cn=*" in it.

Everything either doesn't let me in, throws a 500 error, or lets members of ou=Outsiders,ou=Users,ou=Directory,o=IC in.

So, how do I keep members of ou=Outsiders,ou=Users,ou=Directory,o=IC out of my folder?

Best Answer

Assuming that I have 2 groups with following structure:

dn: ou=IT,dc=domain,dc=com
ou: IT
objectClass: top
objectClass: organizationalUnit

dn: cn=bob,ou=IT,dc=domain,dc=com
cn: bob
sn: Bob
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
userPassword:: xx
...

dn: ou=HR,dc=domain,dc=com
ou: HR
objectClass: top
objectClass: organizationalUnit

dn: cn=alice,ou=HR,dc=domain,dc=com
cn: alice
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
userPassword:: xx
...

You can list all users either in IT or in HR department by executing:

$ ldapsearch -W -x -D "cn=binder,dc=domain,dc=com" \
    '(&(|(ou:dn:=IT)(ou:dn:=HR))(cn=*))'

So, you should try with ldapsearch from the command line first:

$ ldapsearch -W -x -D "cn=binder,ou=Users,ou=Directory,o=IC" \
    '(&(|(ou:dn:=Managers)(ou:dn:=Employees)(ou:dn:=Misc))(cn=*))'

If it work, edit the mod_authz_ldap configuration file as belows:

Require ldap-filter &(|(ou:dn:=Managers)(ou:dn:=Employees)(ou:dn:=Misc))(cn=*)
Related Topic