Apache httpd LDAP integration
- by David W.
I am configuring a CollabNet Subversion integration. I have the following collabnet_subversion.conf file:
<Location /svn>
DAV svn
SVNParentPath /mnt/svn/new_repos
SVNListParentPath on
AuthName "VegiBanc Source Repository"
AuthType basic
AuthzLDAPAuthoritative off
AuthBasicProvider ldap
AuthLDAPURL ldap://ldap.vegibanc.com/dc=vegibanc,dc=com?sAMAccountName" NONE
AuthLDAPBindDN "CN=SVN-Admin,OU=Service Accounts,OU=VegiBanc Users,OU=vegibanc,DC=vegibanc,DC=com"
AuthLDAPBindPassword "swordfish"
</Location>
This works great. Any user in our Active Directory can access our Subversion repository.
Now, I want to limit this to only people in the Active Directory group Development:
<Location /svn>
DAV svn
SVNParentPath /mnt/svn/new_repos
SVNListParentPath on
AuthName "VegiBanc Source Repository"
AuthType basic
AuthzLDAPAuthoritative off
AuthBasicProvider ldap
AuthLDAPURL ldap://ldap.vegibanc.com/dc=vegibanc,dc=com?sAMAccountName" NONE
AuthLDAPBindDN "CN=SVN-Admin,OU=Service Accounts,OU=VegiBanc Users,OU=VegiBanc,DC=vegibanc,DC=com"
AuthLDAPBindPassword "swordfish"
Require ldap-group CN=Development OU=Security Groups OU=VegiBanc, dc=vegibanc, dc=com
</Location>
I added Require ldap-group, but now no one can log in. I have LogLevel set to debug, but all I get is this in my error_log (Single line broken up for easier reading):
[Thu Oct 11 13:09:28 2012] [info] [client 10.55.9.45] [6752]
vauth_ldap authenticate: user dweintraub authentication failed;
URI /svn/ [ldap_search_ext_s() for user failed][Bad search filter]
And, I get this in my access_log:
10.55.9.45 - - [11/Oct/2012:13:09:27 -0500] "GET /svn/ HTTP/1.1" 401 401
10.55.9.45 - dweintraub [11/Oct/2012:13:09:28 -0500] "GET /svn/ HTTP/1.1" 500 535
Yes, I am in that group. (Or, at least how can I confirm that just to make sure that's not the issue. I have the SysinternalsSuite ADExplorer. It's where I'm getting all of my info.)
