mod_auth_ldap and Active Directory
After having a server running fine for a while (about a year) a simply upgrade of ldap, and apache brought one of my “cheap hack” pages to a halt. That “cheap hack” page was developed to save account managers having to rummage their way through the company configuration screens of our app. I basically have a php app that talks directly to the DB, and allows them to update the account manage information quickly for a bunch of stores. This was protected by a login prompt that was generated by mod_auth_ldap. This hits our domain controllers, and makes management very nice. Here is the catch. We recently added a new domain controller, and I also upgraded apache and openldap on this particular server (security updates). All of a sudden, things came to a halt, the logs hinted at the issue…
auth_ldap authenticate: user *user* authentication failed; \
URI */somepage.php* [ldap_search_ext_s() for user failed][Operations error]
Mildly baffled, I jumped on google, suspecting that the upgrade for OpenLDAP had broken something, or mod_auth_ldap (packaged with Apache2) had altered their syntax. I stumbled across a post or two that hinted at group names, but I wasn’t specifying any. I then finally stumbled across this. Now I am a complete airhead sometimes, and forgot that only a week before I did all these upgrades, I started re-arranging the domain into organizational units for improved security. It appears Apache’s mod_auth_ldap module gets itself in a tizzy when the results from the search are in OUs. A suggestion was to hit the global catalog instead. This was just a case of changing the port number from 389, to 3268. Another quick test, and it appears to all be working rather nicely again.
Thank you very much for the post. It saved my countless hours of head scratching. –Yurik
Mine has worked all along by specifying the OU, but as you noted, works about 95%+ of the time. There is a small amount of time it’s like it can’t connect or authenticate the user. I am not sure what causes this even if I am specifying the OU. I could use the global catalog (and may try that next) to see if it helps, but this simply doesn’t make sense to me why it’s so inconsistent.
You rock. This totally worked.
Thank you! This was exactly what I needed to know! Fixed my problem right away.
What a life saver !!! our repository suddenly (without anyone fiddling) stopped authenticating this morning – tried just about everything – then 6 hours later – found this…. worked 1st time – thanks for posting.