1

at work we are having the problem that we want to redirect users depending on whether they are member of a particular LDAP group, when they access a URL that is managed via Apache2.

There are three cases:

  • User provides valid credentials and IS member of the LDAP group => redirect to application ABC (works)
  • User provides valid creds, but is not member of the LDAP group => redirect to Maintenance-Page (does not work and is the problem)
  • User provides invalid creds or clicks cancel => redirect to Maintenance (works)

Our problem is: How can we redirect users, if they are valid and not member of the LDAP group “THE-GROUP”?

Right now the overlay to enter credentials is displayed ad finitum, unless you click cancel or a member of “THE-GROUP”.

Our application ABC is hosted in our premises, running on Ubuntu. Our reverse proxy is Apache 2.4.18-2ubuntu3.10 running on Ubuntu 16.04. Clients will use a wide range of browers and OSes from all over the world, so filtering by IP is not an option. The reverse proxy is located in our DMZ and the App-Server located outside. A NAT-Rule was created, so that both systems can communicate via 8080 (the port ABC is running on).

Our (Test)Config looks like this:

<VirtualHost *:443>
    ServerName testabc.company.com

    SSLProxyEngine On
    SSLEngine On
    SSLCertificateKeyFile  /etc/ssl/private/our_company.key
    SSLCertificateFile /etc/ssl/certs/company_com/fullchain.cer


    ErrorLog ${APACHE_LOG_DIR}/LDAP_test_error.log
    CustomLog ${APACHE_LOG_DIR}/LDAP_test_access.log combined

    # error document shown to unauthorized users
    DocumentRoot /var/www/Maintenance_Page
    ErrorDocument 401 /TTT/index.html

        <Location />
            ProxyPass http://internal-vm-name:8080/
            ProxyPassReverse http://internal-vm-name:8080/
        </Location>

    # the following block applies to all proxied content
    <Proxy "*">
        AuthType Basic
        AuthBasicProvider ldap
        AuthUserFile /dev/null
        AuthName "Auth with our LDAP Server"

        # configuration of the mod_authnz_ldap module
        AuthLDAPURL "ldap://SOMETHING"
        AuthLDAPBindDN "FOO,BAR "
        AuthLDAPBindPassword "FOOBAR"

        # Only users belonging to group THE-GROUP can access ABC,
        # all others will see the error document specified above.
        Require ldap-group CN=THE-GROUP,OU=Company,DC=ad,DC=Company,DC=com
    </Proxy>
</VirtualHost>

# virtual host required to access images and style-sheets from the error document
<VirtualHost *:80>
    ServerName maintenance.company.com
    DocumentRoot /var/www/Maintenance_Page

    ErrorLog ${APACHE_LOG_DIR}/maintenance -error.log
    CustomLog ${APACHE_LOG_DIR}/maintenance.log combined
</VirtualHost>

# redirection from HTTP to HTTPS
<VirtualHost *:80>
    ServerName abc.company.com
    Redirect Permanent /  https://abc.company.com/
    Redirect /  https://abc.company.com/
</VirtualHost>

1 Answer 1

0

There is no good solution for your problem. You are using HTTP Basic Auth which means that the browser is trying to open a page, is getting a 401 status with a WWW-Authenticate: Basic realm="Whatever" header sent.

At that point the browser shows the authentication dialog, and once user and password have been entered, they get sent to the webserver inside the Authorization header.

If the server rejects the request, it will send a 401 status with the WWW-Authenticate header again. The browser will pop up the dialog again ad infinitum. At no point can the server say that a password is rejected for good.

If you were using a mod_dbd backed database, you could use mod_rewrite to do an SQL query for the group and redirect accordingly. I do not believe this is possible with the LDAP Auth handler.

1
  • Thank you for your reply. I will forsake this solution and probably implement a forward-proxy. This should yield the same result. May 28, 2019 at 11:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.