Apache with Winbind Authentication

[ICTNUT]

On debian etch, apache 2.2 things seem to be a little different.

 

the mod auth_ldap has been replaced by authnz_ldap so I have had to do the following:

 

a2enmod authnz_ldap

 

and under apache site-enabled I have:

 

Options Indexes FollowSymLinks MultiViews
	AllowOverride None
	Order allow,deny
	allow from all
	AuthType Basic
	AuthName "Print Server 01"
	AuthBasicProvider ldap
	AuthzLDAPAuthoritative off
	AuthLDAPUrl "ldap://jkhs-dc1.jkhs-pd.local:389/DC=jkhs-pd,DC=local?sAMAccountName?sub?(objectclass=user)"
	AuthLDAPBindDN "cn=ldapbind,dc=jkhs-pd,dc=local"
	AuthLDAPBindPassword password
	Require valid-user
	Satisfy any

 

This is connecting to LDAP and querying but at the moment every user gets a password mismatch, trying to sort this out now...

Edited March 20, 2008 by ICTNUT

[ICTNUT]

OK have figured something out, if i use the following:

 

AuthLDAPUrl "ldap://jkhs-dc1.jkhs-pd.local:389/OU=JKHSAdmins,DC=jkhs-pd,DC=local?sAMAccountName?sub?(objectclass=user)"

 

The users within the OU=JKHSAdmins are authenticated and can get in however if I use:

 

AuthLDAPUrl "ldap://jkhs-dc1.jkhs-pd.local:389/DC=jkhs-pd,DC=local?sAMAccountName?sub?(objectclass=user)"

 

No user can get in as I am asking for authentication to be done at the root of the domain and not in an OU. This is thoery should work as you will see the inclusion of ?sub? and I was with the understanding that this instructed a serach of all sub contexts within the domain but this does not seem to be happening.

 

Now our users are based in 3 OUs Teachers, Students, Admins with the Students OU have an OU for each acadenic year i.e 2005, 2006, 2007 etc.

 

How can I get this to search from the root of the domain recursively??

[Geoff]

Here's mine.

 

        
               AuthType Basic
               AuthName "Print Quota Info"
               AuthBasicProvider ldap

               AuthzLDAPAuthoritative on

               AuthLDAPURL "ldap://heritageserver:389/DC=carrhill,DC=lancs,DC=sch,DC=uk?sAMAccountName?sub?(objectclass=person)"
               AuthLDAPBindDN "cn=Linux,cn=users,dc=carrhill,dc=lancs,dc=sch,dc=uk"
               AuthLDAPBindPassword Password

               require valid-user
       

[ICTNUT]

I have been looking on the Pykota website trying to work out why a script will not work.

 

Do any of the bundled CGI's show a user how much quota they have left??

 

I have looked at each one and they seem to report on usage but not what is left.

 

If this is the case does anyone know of a tool that shows how much quota is left in the bank so to speak.

[Geoff]

that is the point of the pykotme.cgi script.

[ICTNUT]

Geoff when I got to it I gat an internal server error.

 

After checking the apache logs I can see that LDAP auth is working for me but the script itself is crashing out with an error the module pkpgpdls does not exist.

 

The other two scripts work fine and report correctly.

 

hence my question.

[Geoff]

You must install 'pkpgcounter' from the pykota site.

[ICTNUT]

oooo I thought this was installed as standard, hmmm let me get to it and let you know.....

[ICTNUT]

OK have successfully extracted and installed pkpgcounter-3.50.tar.gz and I can access pkotme.cgi without it crashing

 

This page as far as I can see alows you to get quote on how much a document would cost to print, I cannont see anywhere to get a balance for me, I should have 1.57 left.

 

Any ideas??

 

Do i need to pass something else to the script.

[Geoff]

If you look at the README in '/usr/share/pykota/cgi-bin' it explains hows it works.

 

If you protect access to printquota.cgi or dumpykota.cgi with

username+password authentication, the REMOTE_USER CGI environment variable

is honored, so an user can only see his own datas, but not

other users' datas. However, the special REMOTE_USER value 'root'

is allowed an unrestricted access.

 

If no username+password authentication takes place, then access

is completely unrestricted.

 

If you don't protect access to pykotme.cgi with username+password

authentication, then only the job's size will be displayed

to you. This is due to the cost of a print job on a particular printer

depending on the user because of the overcharging factor's value.

So if you want pykotme.cgi to produce complete web quotes, you must

ensure that the user logs in from his web browser whenever he uses

this CGI script.

[ICTNUT]

Hmmm this means that authentication is not working... hmm i am gonna need to look into this then.

 

I'll let you know how I get on.

[Geoff]

You can verify in the apache access.log if authentication is working. As the username will be logged.