The ldap authentication plug-in provides the integration into an ldap directory for authentication purposes.
The following steps are required to activate and configure the ldap authentication provider:
In order to activate the ldap authentication plug-in the httpauth and ldapauth extension library must be loaded according to extension library configuration.
<EXTLIBS>
<LIB>httpauth</LIB>
<LIB>ldapauth</LIB>
</EXTLIBS>
The ldap authentication plug-in is activated by specifying LDAP as the provider name within the AUTHENTICATE configuration of the http authentication handler.
The ldap specific configuration is introduced by the LDAP tag and must be a child of the AUTHENTICATE tag.
<HANDLER TYPE="AUTH" NAME="HTTPAUTH">
<AUTHENTICATE TYPE="BASIC" REALM="MYREALM" PROVIDER="LDAP" >
<APPLYFORMETHOD>POST</APPLYFORMETHOD>
<LDAP URL="ldap://ldapserver/ou=people,dc=example,dc=net">
<REQUIRE TYPE="GROUP" GROUPATTRIBUTE="MEMBER" ISDN="OFF">cn=mygroup,ou=group,dc=example,dc=net</REQUIRE>
<REQUIRE TYPE="USER">myuser</REQUIRE>
<REQUIRE TYPE="DN">cn=myuser,ou=group,dc=example,dc=net</REQUIRE>
<REQUIRE TYPE="ATTRIBUTE">
<ATTRIBUTE NAME="city">NY</ATTRIBUTE>
<ATTRIBUTE NAME="status">active</ATTRIBUTE>
</REQUIRE>
</LDAP>
</AUTHENTICATE>
</HANDLER>
The LDAP tag comprises a
The URL with LDAP server, the base dn (distinguished name) to use for the authentication request.
It supports ldap and ldaps as scheme.
host:port The name/port of the ldap server (defaults to localhost:389 for ldap, and localhost:636 for ldaps)
basedn
The DN of the branch of the directory where the searches should start from.
attribute
The attribute to search for (if not attribute is specified uid is assumed).
When using ldaps you need to make sure that the certificate of the ldap server can be validated successfully on the client. Check with openssl s_client -connect ldap.example.com:636 -showcerts
The REQUIRE tag specifies a property that is required to successfully authenticate the user.
REQUIRE supports the following types (TYPE=):
The group type validates that the user is part of the the specified ldap group.
The ldap plug-in authenticates with the user to the specified ldap server e.g. ldap://ldapserver.
It then searches the configured group DN and compares the specified GROUPATTRIBUTE (default=member) with the base dn spcified within the ldap URL e.g. uid=[username].ou=people,dc=example,dc=net. If attribute ISDN is set to OFF, the user identifier only is checked.
The USER type validates that the ldap uid property matches the specified user.
The ldap plug-in authenticates with the user to the specified ldap server e.g. ldap://ldapserver.
It then checks whether the configured user is available with the configured attribute USERATTRIBUTE (default=uid) of the dn spcified within the ldap URL e.g. uid=[username].ou=people,dc=example,dc=net.
The ATTRIBUTE type validates that the users DN comprises the specified attributes value.
The ldap plug-in authenticates with the user to the specified ldap server e.g. ldap://ldapserver.
It then checks whether the configured attribute value is available with the configured attribute NAME of the dn spcified within the ldap URL e.g. uid=[username].ou=people,dc=example,dc=net.