Apache Authentication to Domino via LDAP

hcl-bot · July 8, 2005, 8:03am

I am in the process of setting up a domino server as an LDAP server to enable authentication through a Apache Proxy server.

I have set up the Domino LDAP service and this seems to be running fine on the server. The ldapsearch utility runs and returns results, but when I try to authenticate through Apache it fails with …

LDAP> Bind failed: Username / password binds not allowed

I can see if finds the user but authentication is not working, I have listed the full Domino server log entries and also the relevant lines from my Apache config.

If anyone has had the same probelm or knows how to get this work, would be great to hear from you.

Apache lines

######################

AuthType Basic

AuthName “LDAP”

AuthLDAPAuthoritative on

AuthLDAPEnabled on

AuthLDAPUrl ldap://host/

Require valid-user

Domino Log

########################

08/07/2005 12:17:26.50 [0B30:0007-0A68] LDAP CIServ Listen> Connection Accepted on Port 389 for Session 154D0002

08/07/2005 12:17:26.50 [0B30:0009-09FC] LDAP> InitForSearch

08/07/2005 12:17:26.50 [0B30:0009-09FC] LDAP> BERGetTag State

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> BERGetLeadingLengthByte State

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> BERGetNext State

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> Bind State

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> Version: 3

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> DN:

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> Method: 0x80 (Simple)

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> Successful bind for Anonymous User

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> Return Result State

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> StateReturnResult returning result Code 0 (Success)

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> SendBufferFree

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> InitForSearch

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> BERGetTag State

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> BERGetLeadingLengthByte State

08/07/2005 12:17:26.51 [0B30:0009-09FC] LDAP> BERGetNext State

08/07/2005 12:17:26.53 [0B30:0009-09FC] LDAP> Search State

08/07/2005 12:17:26.53 [0B30:0009-09FC] LDAP> Scope: SUBTREE

08/07/2005 12:17:26.53 [0B30:0009-09FC] LDAP> Dereference Aliases: 3

08/07/2005 12:17:26.53 [0B30:0009-09FC] LDAP> TimeLimit: 0

08/07/2005 12:17:26.53 [0B30:0009-09FC] LDAP> SizeLimit: 0

08/07/2005 12:17:26.53 [0B30:0009-09FC] LDAP> Attributes to return: ALL

08/07/2005 12:17:26.53 [0B30:0009-09FC] LDAP> Base:

08/07/2005 12:17:26.53 [0B30:0009-09FC] LDAP> Filter: (&(objectclass=*)(uid=admin))

08/07/2005 12:17:26.53 [0B30:0009-09FC] LDAP> Found entry in LDAP QR Cache.

08/07/2005 12:17:26.53 [0B30:0009-09FC] LDAP> Hits:1

08/07/2005 12:17:26.53 [0B30:0009-09FC] LDAP> Return Result State

08/07/2005 12:17:26.55 [0B30:0009-09FC] LDAP> StateReturnResult returning result Code 0 (Success)

08/07/2005 12:17:26.55 [0B30:0009-09FC] LDAP> SendBufferFree

08/07/2005 12:17:26.55 [0B30:0009-09FC] LDAP> InitForSearch

08/07/2005 12:17:26.55 [0B30:0009-09FC] LDAP> BERGetTag State

08/07/2005 12:17:26.55 [0B30:0009-09FC] LDAP> BERGetLeadingLengthByte State

08/07/2005 12:17:26.55 [0B30:0009-09FC] LDAP> BERGetNext State

08/07/2005 12:17:26.55 [0B30:0009-09FC] LDAP> Bind State

08/07/2005 12:17:26.55 [0B30:0009-09FC] LDAP> Version: 3

08/07/2005 12:17:26.55 [0B30:0009-09FC] LDAP> DN: CN=TNS Administrator,O=TNSDemo

08/07/2005 12:17:26.55 [0B30:0009-09FC] LDAP> Method: 0x80 (Simple)

08/07/2005 12:17:26.57 [0B30:0009-09FC] LDAP> Bind failed: Username / password binds not allowed

08/07/2005 12:17:26.57 [0B30:0009-09FC] LDAP> Return Result State

08/07/2005 12:17:26.57 [0B30:0009-09FC] LDAP> StateReturnResult returning result Code 48 (Inappropriate authentication)

08/07/2005 12:17:26.57 [0B30:0009-09FC] LDAP> SendBufferFree

08/07/2005 12:17:26.57 [0B30:0009-09FC] LDAP> InitForSearch

08/07/2005 12:17:26.57 [0B30:0009-09FC] LDAP> BERGetTag State

08/07/2005 12:17:26.57 [0B30:0009-09FC] LDAP> BERGetLeadingLengthByte State

08/07/2005 12:17:26.57 [0B30:0009-09FC] LDAP> BERGetNext State

08/07/2005 12:17:26.59 [0B30:0009-09FC] LDAP> UnBind State

08/07/2005 12:17:26 LDAP Server: 192.30.102.52 connected

08/07/2005 12:17:26 LDAP Server: 192.30.102.52 disconnected

hcl-bot · July 8, 2005, 8:47am

Subject: Apache Authentication to Domino via LDAP

Ensure that in your LDAP Internet Site configuration document you allow Username/Password based access.

cheers,

Bram

hcl-bot · July 8, 2005, 10:30am

Subject: RE: Apache Authentication to Domino via LDAP

Username/Password based access is set to Yes in the server document as we are not using Internet Sites.

Its the Bind Failed: which I dont understand, as its already Binded as anonymous and performed the search?

hcl-bot · July 11, 2005, 4:21am

Subject: RE: Apache Authentication to Domino via LDAP

The only way Apache can verify user credentials is by binding with them to the LDAP server: if the bind succeeds, the username/password is correct, otherwise it fails.

Apache has no knowledge of the digest algorithm used by Notes to hash passwords, so it cannot check the password value against the hash in the LDAP directory.

cheers,

Bram

hcl-bot · July 11, 2005, 9:09am

Subject: RE: Apache Authentication to Domino via LDAP

Yes I understand that, but surly Domino takes the password then does the domino @Password funtion to it to compare and authenticate.

Are you saying that Apache cannot use Domino LDAP to authenticate?

hcl-bot · July 12, 2005, 7:21am

Subject: RE: Apache Authentication to Domino via LDAP

Apache should be able to use Domino LDAP, since Websphere can use a Domino LDAP (and websphere HTTPD is basically apache).

I remember when setting up a Websphere Portal Server + Lotus Domino LDAP that it required some fiddling with either the schema or the LDAP query, but I can’t recall it right now.

I’ll have to see if I still have notes from that install.

cheers,

Bram

hcl-bot · July 11, 2005, 2:15pm

Subject: RE: Apache Authentication to Domino via LDAP

Username/Password based access is set to Yes in the server document as we are not using Internet Sites.

Also make sure Domino’s Notes.INI does not somehow have either of these settings which prohibit Name/Password authentication

LDAP_TCPNP = 0

LDAP_SSLNP = 0

If they do not exist, they are treated as 1, which allows Name/Password authentication.

Its the Bind Failed: which I dont understand, as its already Binded as anonymous and performed the search?

I’m not familiar enough with Apache to know why it performs the search anonymously and the binds with credentials.

hcl-bot · July 12, 2005, 3:20am

Subject: RE: Apache Authentication to Domino via LDAP

I can set Apache to bind with a specific username and password to do the lookup, but where in Domino do I set the names that are allowed to query the LDAP server?

hcl-bot · July 14, 2005, 10:42am

Subject: RE: Apache Authentication to Domino via LDAP

I can set Apache to bind with a specific username and password to do the lookup, but where in Domino do I set the names that are allowed to query the LDAP server?

Why, in your directory’s DB ACL

e.g., Make sure CN=TNS Administrator/O=TNSDemo is listed in your directory’s DB ACL (either directly or via group membership) with Reader access or higher.

hcl-bot · July 8, 2005, 8:11am

Subject: Apache Authentication to Domino via LDAP

When you run ldapsearch, does a username/password combo work then? Also, is that username allowed to access the server?

hcl-bot · July 11, 2005, 3:13am

Subject: RE: Apache Authentication to Domino via LDAP

if I do a ldapsearch I can see all fields that are returned in a DOS window, but when I send the same search via Apache I get the error.

Maybe I am mising something, if you have had LDAP working, could you let me know all the notes settings, as it may be something really simple!

hcl-bot · July 11, 2005, 2:05pm

Subject: RE: Apache Authentication to Domino via LDAP

if I do a ldapsearch I can see all fields that are returned in a DOS window, but when I send the same search via Apache I get the error.

Greg means: have you used ldapsearch’s -D and -w switches to supply the username and password?

http://www-12.lotus.com/ldd/doc/domino_notes/Rnext/help6_admin.nsf/f4b82fbb75e942a6852566ac0037f284/f9cfdc5e6caabbef85256c1d00393d35?OpenDocument