apache 2.2 mod_authnz_ldap to zimbra help?

[jdell]

Hi,

I have an apache 2.2 webserver with some private content that I want to use LDAP auth of my zimbra users to authenticate. No reason for another external ldap synced to zimbra ldap for basic authentication which is all I'm after here. However, apache 2.2 keeps giving authorise denied.

Server is zimbra.mydomain.com, default domain for user accounts in mydomain.com

.htaccess for directory is very basic :

AuthName "Staff Only"
AuthType Basic
AuthBasicProvider ldap
AuthLDAPURL ldap://zimbra.mydomain.com:389/ou=people,dc=mydomain,dc=com?uid?sub?(objectClass=organizationalPerson)
require valid-user

Trying to authenticate this way produces the following on zimbra server (slapd.conf:loglevel 256):
Note: IPs and domains sanitized.

Jan 22 22:26:32 zimbra slapd[7931]: conn=16378 fd=46 ACCEPT from IP=xxx.yyy.zzz.aaa:39788 (IP=aaa.bbb.ccc.ddd:389) 
Jan 22 22:26:32 zimbra slapd[7931]: conn=16378 op=0 BIND dn="" method=128 
Jan 22 22:26:32 zimbra slapd[7931]: conn=16378 op=0 RESULT tag=97 err=0 text= 
Jan 22 22:26:32 zimbra slapd[7931]: conn=16378 op=1 SRCH base="ou=people,dc=mydomain,dc=com" scope=2 deref=3 filter="(&(objectClass=organizationalPerson)(uid=jdell))" 
Jan 22 22:26:32 zimbra slapd[7931]: conn=16378 op=1 SRCH attr=uid 
Jan 22 22:26:32 zimbra slapd[7931]: conn=16378 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text= 
Jan 22 22:26:32 zimbra slapd[7931]: conn=16378 op=2 BIND dn="uid=jdell,ou=people,dc=mydomain,dc=com" method=128 
Jan 22 22:26:32 zimbra slapd[7931]: conn=16378 op=2 BIND dn="uid=jdell,ou=people,dc=mydomain,dc=com" mech=SIMPLE ssf=0 
Jan 22 22:26:32 zimbra slapd[7931]: conn=16378 op=2 RESULT tag=97 err=0 text=

From my reading of http://www.redhat.com/docs/manuals/d...i/6.01/log.htm, it seems that the tag=97 is a result from client bind, and err=0 means success, yet it isn't working.

Apache 2.2 logs show the following (LogLevel=debug):

[Mon Jan 22 22:51:00 2007] [debug] mod_authnz_ldap.c(849): [2525] auth_ldap url parse: `ldap://zimbra.mydomain.com:389/ou=people,dc=mydomain,dc=com?uid?sub?(objectClass=organizationalPerson)'
[Mon Jan 22 22:26:32 2007] [debug] mod_authnz_ldap.c(858): [2525] auth_ldap url parse: Host: zimbra.mydomain.com:389
[Mon Jan 22 22:26:32 2007] [debug] mod_authnz_ldap.c(860): [2525] auth_ldap url parse: Port: 389
[Mon Jan 22 22:26:32 2007] [debug] mod_authnz_ldap.c(862): [2525] auth_ldap url parse: DN: ou=people,dc=mydomain,dc=com
[Mon Jan 22 22:26:32 2007] [debug] mod_authnz_ldap.c(864): [2525] auth_ldap url parse: attrib: uid
[Mon Jan 22 22:26:32 2007] [debug] mod_authnz_ldap.c(866): [2525] auth_ldap url parse: scope: subtree
[Mon Jan 22 22:26:32 2007] [debug] mod_authnz_ldap.c(871): [2525] auth_ldap url parse: filter: (objectClass=organizationalPerson)
[Mon Jan 22 22:26:32 2007] [debug] mod_authnz_ldap.c(951): LDAP: auth_ldap not using SSL connections
[Mon Jan 22 22:26:32 2007] [debug] mod_authnz_ldap.c(373): [client 69.239.134.73] [2525] auth_ldap authenticate: using URL ldap://zimbra.mydomain.com:389/ou=people,dc=mydomain,dc=com?uid?sub?(objectClass=organizationalPerson)
[Mon Jan 22 22:26:32 2007] [debug] mod_authnz_ldap.c(454): [client 69.239.134.73] [2525] auth_ldap authenticate: accepting jdell
[Mon Jan 22 22:26:32 2007] [debug] mod_authnz_ldap.c(826): [client 69.239.134.73] [2525] auth_ldap authorise: authorisation denied

So, I can't see anything wrong except that apache 2.2 mod_authnz_ldap doesn't like it. Any ideas?

[jdell]

I banged my head on this for more hours than I care to admit, I finally post here describing my efforts, and then like a thunderbolt, it hits me that I'm missing the difference between authentication and authorization.

Re-reading the mod_authnz_ldap docs explains that for authentication only, I just need to specify 'AuthzLDAPAuthoritative off'.

Well, at least I have it working now...yay!....argh!....yay!....argh!....yay!

Hopefully this saves somebody some grief in the future...

For the sake of thoroughness, here is the whole .htaccess file:

AuthName "Staff Only"
AuthType Basic
AuthBasicProvider ldap
AuthLDAPURL ldap://zimbra.mydomain.com:389/ou=people,dc=mydomain,dc=com?uid?sub?(objectClass=organizationalPerson)
AuthzLDAPAuthoritative off
require valid-user

[chrisv]

I join you in banging my head against the wall and yelling "ARGH!" Such a simple command caused hours of headaches.

The lesson, as always: RTFM. :-)

Appreciate you posting your solution!
Chris