Archive for the ‘Software’ Category

h1

The definitive guide of connecting Apache via LDAP SSL to ActiveDirectory + Subversion

March 15, 2013

Being taken though hell I of configuring the damn authentication mechanism.
I needed to integrate Apache with ActiveDirectory via LDAP SSL. The manual SUCKS! It does not say anything useful, except for the syntax of the directives.
This article was the most definitive of configuring the integration. But lacks the information about how to make the SSL work correctly.

Here’s the kicker, it is as simple as the following several elements(this is in the top of /etc/apache2/sites-available/default):

# Make sure ve don’t care about the server’s certificate, because we don’t
LDAPVerifyServerCert off
LDAPTrustedMode SSL
# The server’s client cert information: the cert and the matching private key
LDAPTrustedGlobalCert CERT_BASE64 /etc/apache2/sites-available/cert1.pem
LDAPTrustedGlobalCert KEY_BASE64 /etc/apache2/sites-available/key1.pem

These go into the ROOT. Do not try to put them in the Location, nor Directory, nor VirtualHost.

And the main change to enable the SSL transport:
AuthLDAPURL “ldaps://adserver.example:636/DC=adserver,DC=example?sAMAccountName?sub?(objectClass=*)” SSL

These are the steps:

1. Create the client Key and Certificate

The cert1.pem and key1.pem are created like described here:

openssl genrsa 1024 > key1.pem
openssl req -new -x509 -nodes -sha1 -days 365 -key key1.pem > cert1.pem

For an additional configuration reduction bonus you can have it in one single file:
cat cert1.pem key1.pem > pcert.pem
LDAPTrustedGlobalCert CERT_BASE64 /etc/apache2/sites-available/pcert.pem

2. Enable the correct modules on Apache HTTP Server 2.2.

On my Ubuntu system the module enabling is done like this:

sudo a2enmod alias
sudo a2enmod auth_basic
sudo a2enmod authnz_ldap
sudo a2enmod authz_default
sudo a2enmod authz_user
sudo a2enmod dav
sudo a2enmod dav_svn
sudo a2enmod ldap

Or uncomment these elements in the httpd.conf:
LoadModule actions_module modules/mod_actions.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule authn_default_module modules/mod_authn_default.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule authz_host_module modules/mod_authz_host.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule ldap_module modules/mod_ldap.so

And the modules that are prescribed by the Subversion.

3. The access restrictions and Subversion

The short info for configuring the access restrictions.
This will allow people in the users in SVN Writers to commit and SVN Readers will be able to checkout and connect.

<Location>
# This enables Subversion
DAV svn
# Location of the Subversion repository
SVNPath /home/ldaptest/

# How we are going to get authenticated
AuthBasicProvider ldap
AuthType Basic
AuthzLDAPAuthoritative on
AuthName “My Subversion server”
#The URL of the ActiveDirectory server
AuthLDAPURL “ldaps://adserver.example:636/DC=adserver,DC=example?sAMAccountName?sub?(objectClass=*)” SSL
# Credentials for the Apache HTTP to connect to the A/D to issue queries
AuthLDAPBindDN “subversion@adserver.example”
AuthLDAPBindPassword 555

# Limit all write operations to users within SVN Writers group
<LimitExcept>
require ldap-group CN=SVN Writers,CN=Users,DC=adserver,DC=example
</LimitExcept>
# Limit logon and reading to only users in SVN Readers group
require ldap-group CN=SVN Readers,CN=Users,DC=adserver,DC=example
</Location>

4. Add the following to the default site on Apache HTTP

The file is /etc/apache2/sites-available/default
Right at the TOP.

# Make sure ve don’t care about the server’s certificate, because we don’t
LDAPVerifyServerCert off
LDAPTrustedMode SSL
# The server’s client cert information: the cert and the matching private key
LDAPTrustedGlobalCert CERT_BASE64 /etc/apache2/sites-available/cert1.pem
LDAPTrustedGlobalCert KEY_BASE64 /etc/apache2/sites-available/key1.pem

Posted 10th June 2009 by