Sean:
This is what I've been doing, but I can't seem to tell mod_auth_ldap
to either go for a sub-tree search or search in more than one branch.
(Sorry, everyone, maybe I shouldn't have been quite that general.)
At least in my environment, it seems to default to the mostly-sane
approach of doing a subtree search. However I'm confused about what
you're using -- read on :-)
The mod_auth_ldap module that you are using is not the one that I am
using....
I hadn't looked at this module before; it actually looks in some ways
more powerful than the mod_auth_ldap that comes standard with Apache 2
(it looks like it handles nested groups, which is cool) but I've never
used it..
I'm using the standard mod_auth_ldap which comes with apache. Relevant
sections of my config file:
LoadModule ldap_module modules/mod_ldap.so
LoadModule auth_ldap_module modules/mod_auth_ldap.so
<Location /svn/its>
DAV svn
SVNPath /home/svn/its
AuthType Basic
AuthName "ITS SVN Repository"
AuthLDAPUrl ldap://ldap.weyco.com/dc=weyco,dc=com?uid
require group cn=its,ou=groups,dc=weyco,dc=com
<LimitExcept GET PROPFIND OPTIONS REPORT>
require group cn=its,ou=groups,dc=weyco,dc=com
</LimitExcept>
</Location>
In looking through the docs for the module I think you're using, I don't
see any obvious way to specifiy the search scope, so I assume that it is
doing a subtree search. One way to verify this would be to turn the
logging level of your LDAP server up to point where you can see
information about each of the queries, and reverse engineer what it's
doing that way.
Or, since it seems like Apache's own mod_auth_ldap would probably work
for you, you could try that ;-)
I'm thinking of just dumping Apache 2 (it's only use is for a frontend
to Subversion) for Apache 1 and going with the potentially easier to
use auth_ldap, like Joseph mentioned.
IMHO, I wouldn't deploy Apache 1 for anything new unless theres a Pretty
Darned Good Reason. I don't think Apache 1 would help you here.
Let me know if any more specific information about my setup would help...
Cheers,
Joseph Dickson
Unix Administrator - WEYCO, INC. | [EMAIL PROTECTED] | 800.748.0003 ext 1216
---
You are currently subscribed to [email protected] as: [EMAIL PROTECTED]
To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the
SUBJECT of the message.
