Apache 2.2.0 authentication through DS 5.2p4

Question

Just wondering if anyone has a working config (just the LDAP stuff) they could post. We built with the following configure line:
./configure prefix=/opt/local/apache enable-rewrite enable-so enable-ssl enable-deflate enable-dav enable-authnz-ldap enable-ldap --with-ldap
We have the following directives set in httpd.conf:
LDAPSharedCacheSize 200000
LDAPCacheEntries 1024
LDAPCacheTTL 600
LDAPOpCacheEntries 1024
LDAPOpCacheTTL 600
<Location /ldap-status>
    SetHandler ldap-status
    AuthName "Our Web Login"
    AuthBasicProvider ldap
    AuthBasicAuthoritative On
    AuthzUserAuthoritative Off
    AuthType Basic
    AuthLDAPUrl ldap://ourldapserver.domain/ou=people,dc=domain?uid?sub?(objectClass=*)
    AuthLDAPBindDN  An_admin_DN
    AuthLDAPBindPassword xxxxxx
    Require valid-user
    </Location>There are numerous docs on the web, but they all conflict with each other. :-(
I haven't played with apache, I just kinda got pulled-in because I'm the LDAP guy. Just wondering, should the "/ldap-status" be a directory that exists somewhere?
The problem we're seeing is that the Web authentication window comes-up, type in username/password, the LDAP server gets a bind request and the password is valid, but the authentication window clears and returns (empty fields) as if the password were incorrect.
Thanks,
Roger S.

Answer 1

There are many 3rd party apache ldap auth modules, I never had any luck using the built-in experienmental authldap modules provided by Apache, I had tried this 3rd party module.
Apache 1.X: http://www.muquit.com/muquit/software/mod_auth_ldap/mod_auth_ldap.html
Apache 2.X: http://www.muquit.com/muquit/software/mod_auth_ldap/mod_auth_ldap_apache2.html
Apache must be built with .so (shared object) support and SSL support if StartTLS is used.
To configure Apache2 with shared object and SSL support:
./configure enable-so enable-ssl --with-ssl-dir=/usr/local/ssl
(Refer to the URL above for Apache 1.X syntax)
IMPORTANT NOTE: DO NOT add enable-ldap or enable-auth-ldap or --with-ldap, to the above, they are for the "experiemental" ldap module support built-into Apache 2.x, and they DID NOT work for me, no sure of experience of others.
To configure �mod_auth_ldap� from muquit.com:
# OpenLDAP
./configure with-apxs=/usr/local/apache2/bin/apxs with-ldap-dir=/usr/local
# iPlanet LDAP
./configure with-apxs=/usr/local/apache2/bin/apxs with-ldap-dir=/usr
After that, modify httpd.conf, add the following lines in GREEN for testing purposes.
LoadModule auth_ldap_module modules/mod_auth_ldap.so
Alias /syslog "/var/log/"
<Directory "/var/log/">
Options Indexes FollowSymLinks MultiViews IncludesNoExec ExecCGI
AddOutputFilter Includes html
AllowOverride All
Order allow,deny
Allow from all
</Directory>
<Location /syslog>
AuthType Basic
AuthName "syslog"
require valid-user
#LDAP_Debug On
#LDAP_StartTLS On
LDAP_Server ldap1.example.com
# Add SLAVE LDAP Server for failover
LDAP_Server ldap2.example.com
LDAP_Port 389
Base_DN dc=example,dc=com
UID_Attr uid
</Location>
Restart httpd, and test this URL:
http://apache.example.com/syslog/
Good luck to you.
Gary