尝试使用AD验证Apache-内部服务器错误

dzjeubhm  于 2023-10-23  发布在  Apache
关注(0)|答案(1)|浏览(148)

我希望我的用户通过Active Directory登录到我的Apache网站。我得到一个登录提示,但随后我得到内部服务器错误:
服务器遇到内部错误或配置错误,无法完成您的请求。出现此错误的根本原因取决于处理该错误的是哪一个模块以及出现此错误时工作进程中出现了何种情况。有关此错误的详细信息,请参阅服务器错误日志。
这是我的设置。

  1. "Red Hat Enterprise Linux"
  2. VERSION="9.2 (Plow)"
  3. ID="rhel"
  4. ID_LIKE="fedora"
  5. VERSION_ID="9.2"
  6. httpd -v
  7. Server version: Apache/2.4.53 (Red Hat Enterprise Linux)
  8. Server built: Apr 28 2023 00:00:00

使用LDAP和Apache HTTPD进行HTTP基本身份验证(https://access.redhat.com/solutions/20284
它说把这个添加到httpd.conf

  1. <Directory /directory/ldap_auth_needed>
  2. Options Indexes FollowSymLinks
  3. AllowOverride None
  4. order allow,deny
  5. allow from all
  6. AuthType Basic
  7. AuthName Internal
  8. AuthBasicAuthoritative off
  9. AuthBasicProvider ldap
  10. AuthzLDAPAuthoritative off
  11. # AuthLDAPURL ldap://<ldap server ip>/<base DN>
  12. AuthLDAPURL ldap://ldap.example.com/dc=example,dc=com
  13. require valid-user
  14. AuthLDAPBindDN cn=Manager,dc=example,dc=com
  15. AuthLDAPBindPassword secret
  16. </Directory>

它还指出,在httpd 2.4.x中,已删除了AuthzLDAP Authoritative、AuthzDBDAuthoritative、AuthzDBMAuthoritative、AuthzGroupFileAuthoritative、AuthzUserAuthoritative和AuthzOwnerAuthoritative指令
因此,对于我的域acme.corp,我将使用帐户bindAcc,我实际上在Rundeck服务器上使用该帐户进行AD身份验证。另外,我想先用/var/www/html/private进行测试,它包含一个文件,new.html
下面是我添加到httpd.conf中的内容

  1. <Directory /var/www/html/private>
  2. Options Indexes FollowSymLinks
  3. AllowOverride None
  4. order allow,deny
  5. allow from all
  6. AuthType Basic
  7. AuthName "private"
  8. AuthBasicAuthoritative off
  9. AuthBasicProvider ldap
  10. AuthLDAPURL ldap://server:389/OU=Users,OU=Management,dc=acme,dc=corp?sAMAccountName?sub?(objectClass=*)
  11. require valid-user
  12. AuthLDAPBindDN "CN=bindACC,OU=Service Accounts,OU=Management,DC=acme,DC=corp"
  13. AuthLDAPBindPassword password##!!
  14. </Directory>

对于“require”,我已经尝试了“ldap-user =Users,admin =Management,DC=acme,DC=corp”,但没有成功。
Apache Linux服务器加入到域中。
我去http://mywebsite/private/new.html.在日志里看到这个
/var/log/httpd/access_log .
10.120.10.189 - bindACC [06/Oct/2023:11:55:35 -0400]“GET/private/new.html HTTP/1.1”500 527“-”“Mozilla/5.0(Windows NT 10.0; Win64; x64)AppleWebKit/537.36(KHTML,like Gecko)Chrome/117.0.0.0 Safari/537.36”
/var/log/httpd/error_log .
Fri Oct 06 11:55:35.326078 2023] [authn_core:error] [pid 177338:tid 177378] [client 10.120.10.189:57483] AH01796:AuthType Basic配置没有对应模块
我试着把它添加到httpd. conf。

  1. LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
  2. LoadModule ldap_module modules/mod_ldap.so

但在httpd重启错误日志显示

  1. [so:warn] [pid 176628:tid 176628] AH01574: module authnz_ldap_module is already loaded, skipping.
  2. [so:warn] [pid 176628:tid 176628] AH01574: module ldap_module is already loaded, skipping.

httpd的输出显示模块已加载。

  1. httpd.
  2. [Fri Oct 06 12:01:04.971547 2023] [so:warn] [pid 180550:tid 180550] AH01574: module authnz_ldap_module is already loaded, skipping.
  3. [Fri Oct 06 12:01:04.971620 2023] [so:warn] [pid 180550:tid 180550] AH01574: module ldap_module is already loaded, skipping.
  4. httpd (pid 176628) already running.

我做错了什么?谢谢

xfyts7mz

xfyts7mz1#

我暂时修好了。

  1. <Directory /var/www/html/private>
  2. allow from all
  3. AuthType Basic
  4. AuthName "Internal"
  5. AuthBasicAuthoritative off
  6. AuthBasicProvider ldap
  7. AuthLDAPURL "ldap://server:389/OU=Users,OU=Management,dc=acme,dc=corp?sAMAccountName?sub?(objectClass=*)"
  8. Require valid-user
  9. AuthLDAPBindDN [email protected]
  10. AuthLDAPBindPassword XXXXXXXXXX
  11. </Directory>

相关问题