Re: Group authentication to AD

[Patricia A Moss <pmoss4@xxxxxxx>]

Another question; regarding the "Require
valid-user" entry.

Does this require that you make it through
the Authentication Phase first, before it Authorizes you?


PATI MOSS
System Engineer Sr. Professional
CSC

From:	Patricia A Moss/USA/CSC@CSC
To:	users@xxxxxxxxxxxxxxxx
Cc:	users@xxxxxxxxxxxxxxxx
Date:	11/19/2010 02:11 PM
Subject:	Re: Group authentication to AD

---

>Does it happen without the mod_auth_alias?

It works fine with one, but not the other.  I may be on to something.
 Thank you Eric!  :-) 


PATI MOSS
System Engineer Sr. Professional
CSC

From:	Eric Covener <covener@xxxxxxxxx>
To:	users@xxxxxxxxxxxxxxxx
Date:	11/19/2010 11:00 AM
Subject:	Re: Group authentication to AD

---

On Fri, Nov 19, 2010 at 10:57 AM, Patricia A Moss <pmoss4@xxxxxxx>
wrote:
>
> >With what configuration exactly?
> My location block is configured as below:
> <Location /test_repo>
> dav svn
> SVNPath /disk01/home/test_repo
> AuthType Basic
> AuthName "Subversion Repository"
> AuthBasicProvider ldap-FCGNET ldap-VIET
> AuthzLDAPAuthoritative on
> Require valid-user
> Require ldap-group CN=Active_Directory Group Name,OU=U.S.,OU=Groups,DC=domain,DC=com
> #Require ldap-user pmoss
> </Location>
>
> I've configured my aliases, in my http.conf file, as follows:
> <AuthnProviderAlias ldap ldap-FCGNET>
>         AuthLDAPBindDN FCGNET\account_name
>         AuthLDAPBindPassword xxxxxxxxxx
>         AuthLDAPURL ldap://server.domain.com:3268/DC=domain,DC=com?samAccountName?sub?(objectCategory=person)
> </AuthnProviderAlias>
> <AuthnProviderAlias ldap ldap-VIET>
>         AuthLDAPBindDN "CN=account_name,OU=Service
Accounts,OU=Users,OU=Production,DC=domain,DC=com"
>         AuthLDAPBindPassword xxxxxxxxx
>         AuthLDAPURL ldap://server.domain.com:3268/DC=domain,DC=com?samAccountName?sub?(objectCategory=person)
> </AuthnProviderAlias>
>

Does it happen without the mod_auth_alias?  I thought you were
describing an error without "require valid-user"?

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html>
for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
  "   from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx