mod_auth_ldap.html.en

apache的软件linux版本

      <li>Grant access if there is a <a href="#reqattribute">
      <code>Require ldap-attribute</code></a> 
      directive, and the attribute fetched from the LDAP directory
      matches the given value.</li> 

      <li>otherwise, deny or decline access</li>
    </ul>

    <p><code class="module"><a href="../mod/mod_auth_ldap.html">mod_auth_ldap</a></code> uses the following directives during the
    compare phase:</p>

    <table>
      
      <tr>
        <td><code class="directive"><a href="#authldapurl">AuthLDAPURL</a></code> </td>

        <td>The attribute specified in the
        URL is used in compare operations for the <code>Require
        user</code> operation.</td>
      </tr>

      <tr>
        <td><code class="directive"><a href="#authldapcomparednonserver">AuthLDAPCompareDNOnServer</a></code></td>

        <td>Determines the behavior of the
        <code>Require dn</code> directive.</td>
      </tr>

      <tr>
        <td><code class="directive"><a href="#authldapgroupattribute">AuthLDAPGroupAttribute</a></code></td>

        <td>Determines the attribute to
        use for comparisons in the <code>Require group</code>
        directive.</td>
      </tr>

      <tr>
        <td><code class="directive"><a href="#authldapgroupattributeisdn">AuthLDAPGroupAttributeIsDN</a></code></td>

        <td>Specifies whether to use the
        user DN or the username when doing comparisons for the
        <code>Require group</code> directive.</td>
      </tr>
    </table>

</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="requiredirectives" id="requiredirectives">The Require Directives</a></h2>

    <p>Apache's <code class="directive"><a href="../mod/core.html#require">Require</a></code>
    directives are used during the authorization phase to ensure that
    a user is allowed to access a resource.</p>

<h3><a name="reqvaliduser" id="reqvaliduser">Require
    valid-user</a></h3>

    <p>If this directive exists, <code class="module"><a href="../mod/mod_auth_ldap.html">mod_auth_ldap</a></code> grants
    access to any user that has successfully authenticated during the
    search/bind phase.</p>


<h3><a name="requser" id="requser">Require user</a></h3>

    <p>The <code>Require user</code> directive specifies what
    usernames can access the resource. Once
    <code class="module"><a href="../mod/mod_auth_ldap.html">mod_auth_ldap</a></code> has retrieved a unique DN from the
    directory, it does an LDAP compare operation using the username
    specified in the <code>Require user</code> to see if that username
    is part of the just-fetched LDAP entry.  Multiple users can be
    granted access by putting multiple usernames on the line,
    separated with spaces. If a username has a space in it, then it
    must be surrounded with double quotes. Multiple users can also be
    granted access by using multiple <code>Require user</code>
    directives, with one user per line. For example, with a <code class="directive"><a href="#authldapurl">AuthLDAPURL</a></code> of
    <code>ldap://ldap/o=Airius?cn</code> (i.e., <code>cn</code> is
    used for searches), the following Require directives could be used
    to restrict access:</p>
<div class="example"><p><code>
Require user "Barbara Jenson"<br />
Require user "Fred User"<br />
Require user "Joe Manager"<br />
</code></p></div>

    <p>Because of the way that <code class="module"><a href="../mod/mod_auth_ldap.html">mod_auth_ldap</a></code> handles this
    directive, Barbara Jenson could sign on as <em>Barbara
    Jenson</em>, <em>Babs Jenson</em> or any other <code>cn</code> that
    she has in her LDAP entry. Only the single <code>Require
    user</code> line is needed to support all values of the attribute
    in the user's entry.</p>

    <p>If the <code>uid</code> attribute was used instead of the
    <code>cn</code> attribute in the URL above, the above three lines
    could be condensed to</p>
<div class="example"><p><code>Require user bjenson fuser jmanager</code></p></div>


<h3><a name="reqgroup" id="reqgroup">Require group</a></h3>

    <p>This directive specifies an LDAP group whose members are
    allowed access. It takes the distinguished name of the LDAP
    group. Note: Do not surround the group name with quotes.
    For example, assume that the following entry existed in
    the LDAP directory:</p>
<div class="example"><p><code>
dn: cn=Administrators, o=Airius<br />
objectClass: groupOfUniqueNames<br />
uniqueMember: cn=Barbara Jenson, o=Airius<br />
uniqueMember: cn=Fred User, o=Airius<br />
</code></p></div>

    <p>The following directive would grant access to both Fred and
    Barbara:</p>
<div class="example"><p><code>Require group cn=Administrators, o=Airius</code></p></div>

    <p>Behavior of this directive is modified by the <code class="directive"><a href="#authldapgroupattribute">AuthLDAPGroupAttribute</a></code> and
    <code class="directive"><a href="#authldapgroupattributeisdn">AuthLDAPGroupAttributeIsDN</a></code>
    directives.</p>


<h3><a name="reqdn" id="reqdn">Require dn</a></h3>

    <p>The <code>Require dn</code> directive allows the administrator
    to grant access based on distinguished names. It specifies a DN
    that must match for access to be granted. If the distinguished
    name that was retrieved from the directory server matches the
    distinguished name in the <code>Require dn</code>, then
    authorization is granted. Note: do not surround the distinguished
    name with quotes.</p>

    <p>The following directive would grant access to a specific
    DN:</p>
<div class="example"><p><code>Require dn cn=Barbara Jenson, o=Airius</code></p></div>

    <p>Behavior of this directive is modified by the <code class="directive"><a href="#authldapcomparednonserver">AuthLDAPCompareDNOnServer</a></code>
    directive.</p>


<h3><a name="reqattribute" id="reqattribute">Require ldap-attribute</a></h3>

    <p>The <code>Require ldap-attribute</code> directive allows the
    administrator to grant access based on attributes of the authenticated
    user in the LDAP directory.  If the attribute in the directory
    matches the value given in the configuration, access is granted.</p>
    
    <p>The following directive would grant access to anyone with
    the attribute employeeType = active</p>

    <div class="example"><p><code>Require ldap-attribute employeeType=active</code></p></div>

    <p>Multiple attribute/value pairs can be specified on the same line
    separated by spaces or they can be specified in multiple 
    <code>Require ldap-attribute</code> directives. The effect of listing 
    multiple attribute/values pairs is an OR operation. Access will be 
    granted if any of the listed attribute values match the value of a 
    corresponding attribute in the user object. If the value of the 
    attribute contains a space, only the value must be within double quotes.</p>

    <p>The following directive would grant access to anyone with
    the city attribute equal to "San Jose" or status equal to "Active"</p>

    <div class="example"><p><code>Require ldap-attribute city="San Jose" status=active</code></p></div>


</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="examples" id="examples">Examples</a></h2>

    <ul>
      <li>
        Grant access to anyone who exists in the LDAP directory,
        using their UID for searches.

<div class="example"><p><code>
 AuthLDAPURL ldap://ldap1.airius.com:389/ou=People, o=Airius?uid?sub?(objectClass=*)<br />
 Require valid-user
</code></p></div>
      </li>

      <li>
        The next example is the same as above; but with the fields
        that have useful defaults omitted. Also, note the use of a
        redundant LDAP server. 
<div class="example"><p><code>AuthLDAPURL ldap://ldap1.airius.com ldap2.airius.com/ou=People, o=Airius<br />
Require valid-user
</code></p></div>
      </li>

      <li>
        The next example is similar to the previous one, but is
        uses the common name instead of the UID. Note that this
        could be problematical if multiple people in the directory
        share the same <code>cn</code>, because a search on <code>cn</code>
        <strong>must</strong> return exactly one entry. That's why
        this approach is not recommended: it's a better idea to
        choose an attribute that is guaranteed unique in your
        directory, such as <code>uid</code>. 
<div class="example"><p><code>
AuthLDAPURL ldap://ldap.airius.com/ou=People, o=Airius?cn<br />
Require valid-user
</code></p></div>
      </li>

      <li>
        Grant access to anybody in the Administrators group. The
        users must authenticate using their UID. 
<div class="example"><p><code>
AuthLDAPURL ldap://ldap.airius.com/o=Airius?uid<br />
Require group cn=Administrators, o=Airius
</code></p></div>
      </li>

      <li>
        The next example assumes that everyone at Airius who
        carries an alphanumeric pager will have an LDAP attribute
        of <code>qpagePagerID</code>. The example will grant access
        only to people (authenticated via their UID) who have
        alphanumeric pagers: 
<div class="example"><p><code>
AuthLDAPURL ldap://ldap.airius.com/o=Airius?uid??(qpagePagerID=*)<br />
Require valid-user
</code></p></div>
      </li>