mada.cz

Apache a LDAP, Windows autentifikace

Potřebujete zajistit aby byli uživatelé před vstupem na web ověřeni vůči AD?
V nastavení Apache (httpd.conf), povolit modul:

[sourcecode language="plain"]LoadModule authz_ldap_module modules/mod_authz_ldap.so[/sourcecode]

V adresáři webového serveru, který chcete zabezpečit vytvořte .htaccess soubor s následujícími parametry:

[sourcecode language="vb"]AuthType Basic
# What the users will see as a "title" of the login prompt:
AuthName "Domain Credentials Required"
# use plain LDAP authentication:
AuthzLDAPMethod ldap
# FQDN resolvable hostname (or IP) of the Windows
# AD domain controller:
AuthzLDAPServer <span style="color: #ff0000;"><strong>your_dc.your_domain.com</strong></span>
# Distinguished Name (DN) of the user that mod_authz_ldap should
# bind to the LDAP server as when searching for the domain user
# provided by the web client (Active Directory does not allow
# anonymous binds). Note, the cn attribute corresponds to the
# "Display Name" field of a user's account in the Active Directory
# Users and Computers tool, not their login username:
AuthzLDAPBindDN "<strong><span style="color: #ff0000;">cn=your_user,OU=your_OU,dc=your_domain,dc=com</span></strong>"
# the BindDN user's password:
AuthzLDAPBindPassword "<strong><span style="color: #ff0000;">password</span></strong>"
# LDAP Attribute where the user's domain login username is stored in:
AuthzLDAPUserKey sAMAccountName
# Base DN to begin searching for users from in the LDAP:
AuthzLDAPUserBase "<span style="color: #ff0000;">d<strong>c=your_domain,dc=com</strong></span>"
# Search in sub-containers below the UserBase DN if
# necessary (most likely):
AuthzLDAPUserScope subtree
# Require the username and password provided to be a valid
# user in the AD:
require valid-user[/sourcecode]

Červěně jsou označny oblasti, které je zapotřebí nahradit.

Upozornění:

Metoda zde popsaná pracuje s heslem ve formátu plain-text, takže pozor na rizika s tím spojená.