Windows – Apache httpd with LDAP error in CentOS

apache-2.2centosldapwindows

I'm trying to setup an Apache web server that only allows access to users that are in an LDAP store. I am able to setup exactly what I want on my local Windows 7 machine using Apache 2.2.21 against the LDAP server. After trying to login through the prompt, the Linux version displays a 500 error page.

To setup the Apache on CentOS I ran the below commands:

yum install httpd mod_ssl mod_authz_ldap

I made sure that

LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so

were both uncommented in /etc/httpd/conf/httpd.conf.

My <Directory/> is the same between my Windows and Linux httpd.conf (except for the DocumentRoot of course)

AuthName "Login with email address"
AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative off
AuthLDAPURL ldap://ldap.sample.org:1389/ou=Users,dc=sample,dc=org?uid?sub
AuthLDAPBindDN "cn=Directory Manager"
AuthLDAPBindPassword ldappassword
Require valid-user

Options Indexes FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all

(note: our LDAP server is serving on port 1389.)

The /var/log/httpd/error_log from Apache on the Linux machine shows:

[Fri Dec 23 08:17:20 2011] [warn] [client 192.168.1.113] [8181] auth_ldap authenticate: user foo authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Can't contact LDAP server]

I can telnet to the LDAP port from both the Windows and Linux machines. As I mentioned before, the Windows version is working exactly as expected.

One thing I did notice between the Windows version and the Linux version of Apache httpd.conf is the Linux version has almost all the modules enabled by default while the Windows version has most of them commented out which leads me to believe that there could possibly be a module conflict.

Does anyone have any ideas?

Thanks!

Best Answer

It turns out that SELinux was blocking Apache's connection to LDAP. Running the command:

grep -m 1 httpd /var/log/audit/audit.log | audit2why

I was able to find out that Apache was trying to connect to a port that SELinux didn't recognize. After following suggestions from this site and the CentOS/SELinux documentation I was able to reach a solution. My troubles were caused by the use of non-standard LDAP port (as recommended by OpenDS). By adding these ports to SELinux under "ldap_port_t" I was able to resolve the issue. As root (or "sudo") run the below commands replacing the port numbers with your own LDAP/LDAPS port numbers.

semanage port -a -t ldap_port_t -p tcp 1389
semanage port -a -t ldap_port_t -p tcp 8636
semanage port -a -t ldap_port_t -p udp 1389
semanage port -a -t ldap_port_t -p upd 8636

I hope this helps someone in the future from banging their head against the wall as much as I did.

Related Topic