Contents
How does mod _ authnz _ LDAP bind to the server?
During the authentication phase, mod_authnz_ldap searches for an entry in the directory that matches the username that the HTTP client passes. If a single unique match is found, then mod_authnz_ldap attempts to bind to the directory server using the DN of the entry plus the password provided by the HTTP client.
How does the AUTHN _ LDAP handler work in Apache?
The authn_ldap authentication provider can be enabled through the AuthBasicProvider directive using the ldap value. The authz_ldap handler extends the Require directive’s authorization types by adding ldap-user, ldap-dn and ldap-group values.
How does mod _ LDAP help with LDAP caching?
In addition, the load on the LDAP server will be significantly decreased. mod_ldap supports two types of LDAP caching during the search/bind phase with a search/bind cache and during the compare phase with two operation caches. Each LDAP URL that is used by the server has its own set of these three caches.
Are there any changes to the backing LDAP server?
Changes made to the backing LDAP server will not be immediately reflected on the HTTP Server, including but not limited to user lockouts/revocations, password changes, or changes to group memberships. Consult the directives in mod_ldap for details of the cache tunables. There are two phases in granting access to a user.
What is the authldapbinddn entry in LDAP?
AuthLDAPBindDN – The LDAP entry that will be used to locate the users. AuthLDAPBindPassword – The password for the user specified above. require valid-user – This directive selects which authenticated users can access a resource. The “valid-user” value implies if the user can bind, then they are allowed.
What is the AUTHN _ LDAP authentication provider directive?
The authn_ldap authentication provider can be enabled through the AuthBasicProvider directive using the ldap value. The authz_ldap handler extends the Require directive’s authorization types by adding ldap-user, ldap-dn and ldap-group values.
How does mod _ LDAP search for a password?
Whenever a new connection is initiated with the same username, mod_ldapcompares the password of the new connection with the password in the cache. If the passwords match, and if the cached entry is not too old, mod_ldapbypasses the search/bind phase.