Apache::AuthzNetLDAP (3pm)

  PerlSetVar BindDN "cn=Directory Manager"
  PerlSetVar BindPWD "password"
  PerlSetVar BaseDN "ou=people,o=unt.edu"
  PerlSetVar LDAPServer ldap.unt.edu
  PerlSetVar LDAPPort 389
  PerlSetVar UIDAttr uid
 #PerlSetVar UIDAttr mail

  PerlAuthenHandler Apache::AuthNetLDAP
  PerlAuthzHandler Apache::AuthzNetLDAP

  #require valid-user
  #require user mewilcox
  #require user [email protected]
  #require group "cn=Peoplebrowsers1,ou=UNTGroups,ou=People, o=unt.edu"
  #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=wilcox
  #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=smith
  #require ldap-url ldap://castor.acs.unt.edu/ou=people,o=unt.edu??sub?untcourse=
untcoursenumber=1999CCOMM2040001,ou=courses,ou=acad,o=unt.edu

After you have authenticated a user (perhaps with Apache::AuthNetLDAP ;) you can use this module to determine whether they are authorized to access the Web resource under this modules control.

You can control authorization via one of four methods. The first two are pretty standard, the second two are unique to \s-1LDAP\s0.

\*(L"require\*(R" options \*(--

user -> Will authorize access if the authenticated user's username.

valid-user -> Will authorize any authenticated user.

group -> Will authorize any authenticated user who is a member of the \s-1LDAP\s0 group specified by groupdn. This module supports groupOfMember, groupOfUniquemember and Netscape's dynamic group object classes.

ldap-url -> This will authorize any authenticated user who matches the query specified in the given \s-1LDAP\s0 \s-1URL\s0. This is enables users to get the flexibility of Netscape's dynamic groups, even if their \s-1LDAP\s0 server does not support such a capability.

It is important to note that this module must be used in conjunction with an authentication module. (...? Is this true? I just thought, that you might want to only authorize a user, instead of authenticate...) If you are using an authentication module, then the following lines will not need to be duplicated:

PerlSetVar BindDN "cn=Directory Manager" PerlSetVar BindPWD "password" PerlSetVar BaseDN "ou=people,o=unt.edu" PerlSetVar LDAPServer ldap.unt.edu PerlSetVar LDAPPort 389 PerlSetVar UIDAttr uid #PerlSetVar UIDAttr mail

PerlAuthenHandler Apache::AuthNetLDAP

The following lines will not need to be duplicated if supported by the authentication module:

#require valid-user #require user mewilcox #require user [email protected] #require group "cn=Peoplebrowsers1,ou=UNTGroups,ou=People, o=unt.edu" #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=wilcox #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=smith #require ldap-url ldap://castor.acs.unt.edu/ou=people,o=unt.edu??sub?untcourse=

Obviously, the ldap-url attribute is probably only support by this module.

Check out the following link for options to load the module:

http://perl.apache.org/docs/1.0/guide/config.html#The_Startup_File http://perl.apache.org/docs/2.0/user/config/config.html#Startup_File

Mark Wilcox [email protected] and Shannon Eric Peevey [email protected]

perl\|(1).

This module is distributed with the same license as Perl's.