Difference between revisions of "HTTP Basic authentication against OpenLDAP directory"
From stoney cloud
| [checked revision] | [checked revision] |
(→Test the ACLs) |
(→Apache HTTP Basic authentication) |
||
| Line 121: | Line 121: | ||
+ AuthLDAPBindPassword "XXXXXXXXX" | + AuthLDAPBindPassword "XXXXXXXXX" | ||
+ # Accept only people which belongs to your company, are active and superusers. | + # Accept only people which belongs to your company, are active and superusers. | ||
| − | + AuthLDAPUrl "ldaps://ldapm.stoney-cloud.org:636/ou=people, | + | + AuthLDAPUrl "ldaps://ldapm.stoney-cloud.org:636/ou=people,dc=stoney-cloud,dc=org?mail?one?(&(sstEmployeeOfUID=4000000)(sstIsActive=TRUE)(sstBelongsToUID=1))" |
+ AuthType Basic | + AuthType Basic | ||
+ AuthName "stoney cloud" | + AuthName "stoney cloud" | ||
Latest revision as of 12:07, 9 January 2015
This page describes, how configure HTTP Basic authentication against the stoney cloud OpenLDAP directory.
Contents
Service User LDIF
You'll need to create a service user. The following example adds a new service user called cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org:
# Copyright (C) 2015 stepping stone GmbH # Switzerland # http://www.stepping-stone.ch # support@stepping-stone.ch # # Authors: # Michael Eichenberger <michael.eichenberger@stepping-stone.ch> # # This file is part of the stoney cloud. # # stoney cloud is free software: you can redistribute it and/or # modify it under the terms of the GNU Affero General Public # License as published by the Free Software Foundation, version # 3 of the License. # # stoney cloud is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU Affero General Public License for more details. # # You should have received a copy of the GNU Affero General Public # License along with stoney cloud. # If not, see <http://www.gnu.org/licenses/>. # ################################################################################ # services-administration.ldif ################################################################################ # Description: # Loads some service users into the LDAP directory used for AuthLDAPBindDN # authentication. ################################################################################ # slappasswd -s 'verysecret' dn: cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org objectclass: top objectclass: organizationalPerson objectclass: inetOrgPerson cn: cloud sn: cloud userPassword: {SSHA}TWKAnGsKhO+e3uNjoooHhEMFN8E9/D4C
Load Service User LDIF
Load the newly created services-administration.ldif into the OpenLDAP directory:
/usr/bin/ldapadd -W -M -H "ldaps://ldapm.stoney-cloud.org" -x -D "cn=Manager,dc=stoney-cloud,dc=org" -f services-administration.ldif
Password: *********** # The "cn=Manager,dc=stoney-cloud,dc=org" users password. adding new entry "cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org"
Modify the ACL's
The newly created cloud service user needs access to the people sub tree.
$EDITOR /etc/openldap/acl/slapd.acl.people.conf
# The cloud service user needs access to the people sub tree. access to dn.base="ou=people,dc=stoney-cloud,dc=org" attrs=entry by dn.exact="cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org" read by dn.regex="uid=([0-9]+),ou=people,dc=stoney-cloud,dc=org" read by * break access to dn.one="ou=people,dc=stoney-cloud,dc=org" attrs=entry,objectClass,mail,sstEmployeeOfUID,givenName,sn,sstIsActive,cn,sstBelongsToUID by dn.exact="cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org" read by * break
After modifying the ACLs, you'll need to restart the OpenLDAP directory server (slapd):
/etc/init.d/slapd restart
Test the ACLs
ldapsearch -H ldaps://ldapm.stoney-cloud.org \ -b "ou=people,dc=stoney-cloud,dc=org" \ -s one \ -D "cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org" \ -z 5 \ -W -x -LLL \ "(&(sstEmployeeOfUID=4000000)(mail=name.surname@example.com))" o sn givenName sstIsActive sstBelongsToUID
Enter LDAP Password: *********** # The "cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org" users password. dn: uid=1000000,ou=people,dc=stoney-cloud,dc=org givenName: Name sn: Surname sstIsActive: TRUE sstBelongsToUID: 1
Apache HTTP Basic authentication
Enable LDAP authentication for Apache by adding the following in /etc/conf.d/apache2:
-APACHE2_OPTS="-D PHP5 -D UMASK -D SSL" +APACHE2_OPTS="-D PHP5 -D UMASK -D SSL -D LDAP -D AUTHNZ_LDAP"
Add the restriction in /etc/apache2/vhosts.d/localhost.ssl.conf:
<Directory "/var/www/localhost/htdocs"> SSLRequireSSL Options FollowSymLinks IncludesNOEXEC SymlinksIfOwnerMatch AllowOverride AuthConfig FileInfo Indexes Limit Order Allow,Deny Allow from all + AuthLDAPBindDN "cn=cloud,ou=services,ou=administration,dc=stoney-cloud,dc=org" + AuthLDAPBindPassword "XXXXXXXXX" + # Accept only people which belongs to your company, are active and superusers. + AuthLDAPUrl "ldaps://ldapm.stoney-cloud.org:636/ou=people,dc=stoney-cloud,dc=org?mail?one?(&(sstEmployeeOfUID=4000000)(sstIsActive=TRUE)(sstBelongsToUID=1))" + AuthType Basic + AuthName "stoney cloud" + AuthBasicProvider ldap + Require valid-user </Directory>
Restart Apache:
/etc/init.d/apache2 restart
Important!
Don't forget, that you probably have two OpenLDAP directory servers and two Apache web servers!
