Peter,
On 1/9/06, Peter Schober <[EMAIL PROTECTED]> wrote:
> bind with some proxy account (as to avoid having to allow anonymous
> access) and do a subtree search for uid=$user with $BASEDN as a search
> base (replacing uid with whatever attribute is unique for your users).
> no anonymous access, no specific branch for searching.
This is what I've been doing, but I can't seem to tell mod_auth_ldap
to either go for a sub-tree search or search in more than one branch.
(Sorry, everyone, maybe I shouldn't have been quite that general.)
Here's my config as it works right now for one branch:
<Location /var/svn/AS>
DAV svn
SVNPath /var/svn/AS
AuthType Basic
AuthName "Subversion Repository"
AuthAuthoritative Off
LDAP_Protocol_Version 3
LDAP_Server host.blah.com
LDAP_Port 389
Base_DN "ou=people,dc=blah,dc=com"
Bind_DN "uid=svn,ou=services,dc=blah,dc=com"
Bind_Pass "XXXX"
UID_Attr uid
require filter "(eduPersonEntitlement=svn)"
</Location>
Setting Base_DN to "dc=blah,dc=com" does not work.
I tried setting AuthOnBind to On and setting the accompanying Sub_DN,
but Sub_DN only lets you set 1 sub tree, not several, like I had
hoped. (i.e., Sub_DN "ou=applications,ou=people" told mod_auth_ldap
to search for people as
"uid=blah,ou=applications,ou=people,dc=blah,dc=com").
The docs don't quite tell me what I need to know (or if what I want is
possible) with respect to sub-tree searching or with dynamic groups:
http://www.muquit.com/muquit/software/mod_auth_ldap/mod_auth_ldap_apache2.html
I'm thinking of just dumping Apache 2 (it's only use is for a frontend
to Subversion) for Apache 1 and going with the potentially easier to
use auth_ldap, like Joseph mentioned.
If there's an easier way, I'll consult the subversion list for that.
:) But as far as authentication goes, I'm still stuck.
Thanks!
Sean
---
You are currently subscribed to [email protected] as: [EMAIL PROTECTED]
To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the
SUBJECT of the message.
