2

I have a working Kerberos authentication on my Apache. My AuthGroupFile directive points to a file where there is one group called rnd (rnd: user@my.domain.com).

This works just fine, but I don't know how to grant access to all the users in the domain my.domain.com. Do you know how to do this?

Lauri Lehmijoki
  • 283
  • 1
  • 2
  • 7
  • 2
    If there is only one domain, you don't need `AuthGroupFile`. Just allow everyone (`require valid-user`). – chutz Oct 31 '12 at 19:06

2 Answers2

0

If this is within your own network, why not restrict/allow access via IP address or IP range? This example blocks for all—and forces a user/password combo—but allows localhost & the whole 10.x.x.x & 192.x.x.x ranges.

<Location /protected>
  AuthName "My Protected Server"
  AuthType Basic
  require valid-user
  AuthUserFile /etc/apache2/my_server_passwords

  Order Deny,Allow
  Deny from all
  Allow from 127.0.0.1 ::1
  Allow from localhost
  Allow from 10.0.0.0/8
  Allow from 192.0.0.0/8
  Satisfy Any
</Location>

Or what about using LDAP as described in this article? Config from that article here, but adding the Allow from… from above:

<Location /protected>
  # Using this to bind
  AuthLDAPBindDN "CN=John Doe,OU=IT Department,OU=Germany,DC=example,DC=com"
  AuthLDAPBindPassword "XXX"
  # search user
  AuthLDAPURL "ldap://IP-DOMAIN-CONTROLLER/ou=Germany,dc=example,dc=com?sAMAccountName?sub?(objectClass=*)"

  AuthType Basic
  AuthName "USE YOUR WINDOWS ACCOUNT"
  AuthBasicProvider ldap
  # Important, otherwise "(9)Bad file descriptor: Could not open password file: (null)"
  AuthUserFile /dev/null
  require valid-user

  Allow from 127.0.0.1 ::1
  Allow from localhost
  Allow from 10.0.0.0/8
  Allow from 192.0.0.0/8
  Satisfy Any
</Location>
Giacomo1968
  • 3,522
  • 25
  • 38
0

Could you not specify a user group rather than a user name, and then you can have a nice group of "AuthorizedWebUsers" ?

BuildTheRobots
  • 842
  • 5
  • 11
  • The user group does not support wild cards either. I would like to state that "allow access from every user in the domain 'master'". Currently I have to list every user name I wish to grant access to my application. Obviously, this is not suitable in environments where the users are changing constantly. – Lauri Lehmijoki Jan 04 '10 at 07:39