1

I am building a simple website that basically hosts a bunch of PDFs behind a PDF Viewer app. I will link to these PDFs from an external site, but I need a way of keeping these from being openly accessible. There is also a interactive map viewer component that is hosted on the server (ESRI Web Appbuilder). This already has its own security mechanism.

I am looking for a solution that allows me to basically lock an entire webserver (Apache in this case, but open to other suggestions), behind a login screen. Ideally it would support either Active Directory and/or OAuth.

I am aware of Apache basic auth, but as I understand it, this would check credentials on every page load, which might not make our IT people very happy and also would probably slow things down somewhat.

1

You should be able to use Basic with with the Apache HTTPD LDAP module. There are options for caching results, which ought to mollify your IT department. The Samba wiki - https://wiki.samba.org/index.php/Authenticating_Apache_against_Active_Directory - has details, for example:


Basic LDAP authentication

Example of where you need this: You want Apache to permit access to a directory on your webserver just for AD users that are members of a defined AD group (I used group test in the example). Username and password should be validated against AD.

  • Create a new user in ADUC or with samba-tool, that Apache will use for connecting to the AD (I used "apache-connect" in the example below).
  • Add the following to your .htaccess or your httpd.conf (vHost/directory/... directive):

    AuthName "AD authentication"
    AuthBasicProvider ldap
    AuthType Basic
    AuthLDAPGroupAttribute member
    AuthLDAPGroupAttributeIsDN On
    AuthLDAPURL ldap://{AD-Hostname/IP}:389/cn=Users,dc={your Domain DN}?sAMAccountName?sub?(objectClass=*)
    AuthLDAPBindDN cn=apache-connect,cn=Users,{your Domain DN}
    AuthLDAPBindPassword {password} require ldap-group cn=test,cn=Users,{your Domain DN} 
    

    With this configuration, the username is searched for just in the "Users" container and below. If you want to search in any OU of your domain, then you have to add

    REFERRALS off

    to your /etc/openldap/ldap.conf. Otherwise accessing doesn't work and apache will log auth_ldap authenticate: user xxx authentication failed; URI / [ldap_search_ext_s() for user failed][Operations error]!. If you're still getting this error after turning referrals off, set Apache to connect to Samba/AD port 3268 (AD global catalog) instead to the standard LDAP 389 port.

    Make sure that your configuration file is only readable by the webserver, because of the password!

  • Restart apache.

The same page also has configuration examples for browser SSO, which may be of interest.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.