mod_authnz_ldap.html

这个是我在web培训时老师提供的手册

    <table border="1" cellpadding="0" cellspacing="0" bordercolor="#AAAAAA">
<tr><td><code class="directive"><a href="#authldapurl">AuthLDAPURL</a></code> </td><td>The attribute specified in the
        URL is used in compare operations for the <code>require
        ldap-user</code> operation.</td></tr>
<tr><td><code class="directive"><a href="#authldapcomparednonserver">AuthLDAPCompareDNOnServer</a></code></td><td>Determines the behavior of the
        <code>require ldap-dn</code> directive.</td></tr>
<tr><td><code class="directive"><a href="#authldapgroupattribute">AuthLDAPGroupAttribute</a></code></td><td>Determines the attribute to
        use for comparisons in the <code>require ldap-group</code>
        directive.</td></tr>
<tr><td><code class="directive"><a href="#authldapgroupattributeisdn">AuthLDAPGroupAttributeIsDN</a></code></td><td>Specifies whether to use the
        user DN or the username when doing comparisons for the
        <code>require ldap-group</code> directive.</td></tr>
</table>

</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="requiredirectives" id="requiredirectives">The require Directives</a></h2>

    <p>Apache's <code class="directive"><a href="../mod/core.html#require">Require</a></code>
    directives are used during the authorization phase to ensure that
    a user is allowed to access a resource.  mod_authnz_ldap extends the 
    authorization types with <code>ldap-user</code>, <code>ldap-dn</code>, <code>ldap-group</code>, <code>ldap-attribute</code>和<code>ldap-filter</code>.  Other authorization types may also be 
    used but may require that additional authorization modules be loaded.</p>

<h3><a name="reqvaliduser" id="reqvaliduser">require valid-user</a></h3>

    <p>If this directive exists, <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> grants
    access to any user that has successfully authenticated during the
    search/bind phase.  Requires that <code class="module"><a href="../mod/mod_authz_user.html">mod_authz_user</a></code> be 
    loaded and that the 
    <code class="directive"><a href="#authzldapauthoritative">AuthzLDAPAuthoritative</a></code>
    directive be set to off.</p>


<h3><a name="requser" id="requser">require ldap-user</a></h3>

    <p><code>require ldap-user</code> directive specifies what
    usernames can access the resource. Once
    <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> has retrieved a unique DN from the
    directory, it does an LDAP compare operation using the username
    specified in the <code>require ldap-user</code> to see if that username
    is part of the just-fetched LDAP entry.  Multiple users can be
    granted access by putting multiple usernames on the line,
    separated with spaces. If a username has a space in it, then it
    must be surrounded with double quotes. Multiple users can also be
    granted access by using multiple <code>require ldap-user</code>
    directives, with one user per line. For example, with a <code class="directive"><a href="#authldapurl">AuthLDAPURL</a></code> of
    <code>ldap://ldap/o=Airius?cn</code> (i.e., <code>cn</code> is
    used for searches), the following require directives could be used
    to restrict access:</p>
<div class="example"><p><code>
require ldap-user "Barbara Jenson"<br />
require ldap-user "Fred User"<br />
require ldap-user "Joe Manager"<br />
</code></p></div>

    <p>Because of the way that <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> handles this
    directive, Barbara Jenson could sign on as <em>Barbara
    Jenson</em>, <em>Babs Jenson</em> or any other <code>cn</code> that
    she has in her LDAP entry. Only the single <code>require
    ldap-user</code> line is needed to support all values of the attribute
    in the user's entry.</p>

    <p>If the <code>uid</code> attribute was used instead of the
    <code>cn</code> attribute in the URL above, the above three lines
    could be condensed to</p>
<div class="example"><p><code>require ldap-user bjenson fuser jmanager</code></p></div>


<h3><a name="reqgroup" id="reqgroup">require ldap-group</a></h3>

    <p>This directive specifies an LDAP group whose members are
    allowed access. It takes the distinguished name of the LDAP
    group. Note: Do not surround the group name with quotes.
    For example, assume that the following entry existed in
    the LDAP directory:</p>
<div class="example"><p><code>
dn: cn=Administrators, o=Airius<br />
objectClass: groupOfUniqueNames<br />
uniqueMember: cn=Barbara Jenson, o=Airius<br />
uniqueMember: cn=Fred User, o=Airius<br />
</code></p></div>

    <p>The following directive would grant access to both Fred and
    Barbara:</p>
<div class="example"><p><code>require ldap-group cn=Administrators, o=Airius</code></p></div>

    <p>Behavior of this directive is modified by the <code class="directive"><a href="#authldapgroupattribute">AuthLDAPGroupAttribute</a></code>和<code class="directive"><a href="#authldapgroupattributeisdn">AuthLDAPGroupAttributeIsDN</a></code>
    directives.</p>


<h3><a name="reqdn" id="reqdn">require ldap-dn</a></h3>

    <p><code>require ldap-dn</code> directive allows the administrator
    to grant access based on distinguished names. It specifies a DN
    that must match for access to be granted. If the distinguished
    name that was retrieved from the directory server matches the
    distinguished name in the <code>require ldap-dn</code>, then
    authorization is granted. Note: do not surround the distinguished
    name with quotes.</p>

    <p>The following directive would grant access to a specific
    DN:</p>
<div class="example"><p><code>require ldap-dn cn=Barbara Jenson, o=Airius</code></p></div>

    <p>Behavior of this directive is modified by the <code class="directive"><a href="#authldapcomparednonserver">AuthLDAPCompareDNOnServer</a></code>
    directive.</p>


<h3><a name="reqattribute" id="reqattribute">require ldap-attribute</a></h3>

    <p><code>require ldap-attribute</code> directive allows the
    administrator to grant access based on attributes of the authenticated
    user in the LDAP directory.  If the attribute in the directory
    matches the value given in the configuration, access is granted.</p>
    
    <p>The following directive would grant access to anyone with
    the attribute employeeType = active</p>

    <div class="example"><p><code>require ldap-attribute employeeType=active</code></p></div>

    <p>Multiple attribute/value pairs can be specified on the same line
    separated by spaces or they can be specified in multiple 
    <code>require ldap-attribute</code> directives. The effect of listing 
    multiple attribute/values pairs is an OR operation. Access will be 
    granted if any of the listed attribute values match the value of the 
    corresponding attribute in the user object. If the value of the 
    attribute contains a space, only the value must be within double quotes.</p>

    <p>The following directive would grant access to anyone with
    the city attribute equal to "San Jose" or status equal to "Active"</p>

    <div class="example"><p><code>require ldap-attribute city="San Jose" status=active</code></p></div>



<h3><a name="reqfilter" id="reqfilter">require ldap-filter</a></h3>

    <p><code>require ldap-filter</code> directive allows the
    administrator to grant access based on a complex LDAP search filter.
    If the dn returned by the filter search matches the authenticated user
    dn, access is granted.</p>
    
    <p>The following directive would grant access to anyone having a cell phone
    and is in the marketing department</p>

    <div class="example"><p><code>require ldap-filter &amp;(cell=*)(department=marketing)</code></p></div>

    <p>The difference between the <code>require ldap-filter</code> directive and the 
    <code>require ldap-attribute</code> directive is that <code>ldap-filter</code> 
    performs a search operation on the LDAP directory using the specified search 
    filter rather than a simple attribute comparison. If a simple attribute 
    comparison is all that is required, the comparison operation performed by 
    <code>ldap-attribute</code> will be faster than the search operation 
    used by <code>ldap-filter</code> especially within a large directory.</p>



</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="examples" id="examples">Examples</a></h2>

    <ul>
      <li>
        Grant access to anyone who exists in the LDAP directory,
        using their UID for searches. 
<div class="example"><p><code>
AuthLDAPURL ldap://ldap1.airius.com:389/ou=People, o=Airius?uid?sub?(objectClass=*)<br />
require valid-user
</code></p></div>
      </li>

      <li>
        The next example is the same as above; but with the fields
        that have useful defaults omitted. Also, note the use of a
        redundant LDAP server. 
<div class="example"><p><code>AuthLDAPURL ldap://ldap1.airius.com ldap2.airius.com/ou=People, o=Airius<br />
require valid-user
</code></p></div>
      </li>

      <li>
        The next example is similar to the previous one, but it
        uses the common name instead of the UID. Note that this
        could be problematical if multiple people in the directory
        share the same <code>cn</code>, because a search on <code>cn</code>
        <strong>must</strong> return exactly one entry. That's why
        this approach is not recommended: it's a better idea to
        choose an attribute that is guaranteed unique in your
        directory, such as <code>uid</code>. 
<div class="example"><p><code>
AuthLDAPURL ldap://ldap.airius.com/ou=People, o=Airius?cn<br />
require valid-user
</code></p></div>
      </li>

      <li>
        Grant access to anybody in the Administrators group. The
        users must authenticate using their UID. 
<div class="example"><p><code>
AuthLDAPURL ldap://ldap.airius.com/o=Airius?uid<br />
require ldap-group cn=Administrators, o=Airius
</code></p></div>
      </li>

      <li>
        The next example assumes that everyone at Airius who
        carries an alphanumeric pager will have an LDAP attribute
        of <code>qpagePagerID</code>. The example will grant access
        only to people (authenticated via their UID) who have
        alphanumeric pagers: 
<div class="example"><p><code>
AuthLDAPURL ldap://ldap.airius.com/o=Airius?uid??(qpagePagerID=*)<br />
require valid-user
</code></p></div>