<-
Apache > HTTP Server > �ĵ� > �汾2.2 > ģ��
���� ��л | �������� | ��ƪ���ߣ��𲽹� | ��ƪ��������£�?��?��?�� | ��ȡ���°汾

Apacheģ�� mod_ldap

˵��Ϊ����LDAPģ���ṩLDAP���ӳغͽ���������
״̬��չ(E)
ģ����ldap_module
Դ�ļ�util_ldap.c
���������� Apache 2.0.41 ���Ժ�İ汾�п���

����

��ģ��ͨ���������LDAP������������վ���ܡ����˱�׼LDAP���ṩ�Ĺ����⣬��ģ��������һ��LDAP���ӳغ�һ��LDAP�����ڴ滺������

Ϊ��ʹ�ñ�ģ��Ĺ��ܣ�LDAP֧�ֱ�������APU������ͨ���ڱ���Apacheʱ����configure�ű������������� --with-ldap ������ʵ�ֵġ�

Ϊ��֧��SSL/TLS ����ҪAPR��������һ��LDAP SDK ��OpenLDAP SDK(2.x�����), Novell LDAP SDK, Mozilla LDAP SDK, ���� Solaris LDAP SDK (����Mozilla), ���� Microsoft LDAP SDK, iPlanet (Netscape) SDK ���μ�APR��վ�Ի�ȡ������Ϣ��

top

ʾ������

�����������һ��ʹ��mod_ldapģ��������mod_authnz_ldap�ṩ��HTTP������֤���ܵ����ӡ�

# ����LDAP���ӳؼ������ڴ滺�塣
# ����LDAP����״̬����������Ҫ����mod_ldap��mod_authnz_ldapģ�顣
# ��"yourdomain.example.com"��Ϊ����ʵ��������

LDAPSharedCacheSize 200000
LDAPCacheEntries 1024
LDAPCacheTTL 600
LDAPOpCacheEntries 1024
LDAPOpCacheTTL 600

<Location /ldap-status>
SetHandler ldap-status
Order deny,allow
Deny from all
Allow from yourdomain.example.com
AuthLDAPEnabled on
AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one
AuthLDAPAuthoritative on
require valid-user
</Location>

top

LDAP���ӳ�

LDAP������������֮�乲��ġ��������LDAP������������unbind->connect->rebind����һ���������ڵ�����£����������Լ���Ϊ��һ������׼�����ӵ�ʱ�䡣���������Ż��е���HTTP�����Keep-Alives���ܡ�

��һ���ȽϷ�æ�ķ������ϣ����п����������ͬʱ������ͬһ��LDAP����������Ӳ��õ����ķ������һ��LDAP��������ʹ�ã�Apache����ԭ�����ӵĻ����ϣ�����һ���µ����ӡ��⽫ȷ�����ӳز����Ϊƿ����

����Ҫ��Apache�������ֶ��������ӳع��ܡ��κ�ʹ�ñ�ģ��������LDAP�����ģ����Զ��������ӳء�

top

LDAP����

Ϊ�˸������ܣ�mod_ldapģ��ʹ��һ�ֻ����Ļ�������Ծ���������LDAP����������ϵ��ͨ�����壬���Է����ʹApache���ṩ��mod_authnz_ldap������ҳ��ʱ���õ���������������������ͬʱ��LDAP�������ĸ���Ҳ�����Եؼ�С��

mod_ldap֧���������͵�LDAP���塣��search/bind�׶Σ�ʹ��һ��search/bind��������compare�׶Σ�ʹ������operation���������������õ�ÿ��LDAP URL����һ�����Լ��������������塣

Search/Bind����

����һ����ѯ�Ͱ󶨲�����LDAPʵʩ�������Ƿdz���ʱ�����䵱Ŀ¼�ܴ�ʱ����һ��������ԡ�Search/bind���������������е������ܳɹ��󶨵IJ�ѯ��ʧ�ܵĽ��(���磺���ɹ��IJ�ѯ���ѯ����޷��ɹ���)���ᱻ���塣����������Ϊ���ι�ϵʧ�ܵ�����������������ֻռ�˺�С��һ���ٷֱȣ���ˣ�ͨ����������Щ���ӣ����Լ��ٻ������Ĵ�С��

mod_ldap�ڻ������ﴢ�����û������õ���DN �������󶨵Ŀ���󶨵�ʱ�䡣��һ���µ�������ͬһ���û�������ʼ����ʱ��mod_ldap���µ����ӵĿ����뱣���ڻ�������Ŀ�����бȽϡ��������ƥ�䣬�����Ǹ�������Ŀ��δʧЧ�Ļ���mod_ldap������search/bind�׶Ρ�

��ѯ��󶨻�����LDAPCacheEntries��LDAPCacheTTLָ�������ơ�

Operation����

��������������У�mod_ldapʹ����������������������ȽϵIJ�������һ�����������������Ƿ�LDAP���Ա�IJ��Խ�����ڶ����������岻ͬ���ּ����ıȽϽ����

������������������LDAPOpCacheEntries��LDAPOpCacheTTLָ�������Ƶġ�

�������ļ��

mod_ldap������һ�������Ĵ�������ͨ��������ʹ����Ա��ػ����������ܡ������������������ldap-status ����˿���������ָ�����õ�mod_ldap�������������Ϣ��

<Location /server/cache-info>
SetHandler ldap-status
</Location>

ͨ��URL http://servername/cache-info ������Ա���Եõ�mod_ldapʹ�õ�ÿ�������״̬���档ע�⣬���Apache��֧�ֹ����ڴ棬��ôÿ��httpdʵ���������Լ��Ļ���������ˣ�ÿ��ʹ������URL�����ܻ�õ���ͬ�Ľ������ȡ���ھ����ĸ�httpdʵ���������������

top

ʹ��SSL/TSL

ͨ��LDAPTrustedGlobalCert, LDAPTrustedClientCert, LDAPTrustedModeָ����Զ�����LDAP����������SSL/TSL���ӡ���Щָ��ָ����ʹ�õ�CA�Ϳ�ѡ�Ŀͻ���֤�飬�Լ�����ʹ�õļ�������(none, SSL, TLS/STARTTLS)��

# ��636�˿ڽ���һ��SSL LDAP���ӡ���Ҫģ��mod_ldap��mod_authnz_ldap��֧�֡�
# ��"yourdomain.example.com"�޸�Ϊ���Լ���������

LDAPTrustedGlobalCert CA_DER /certs/certfile.der

<Location /ldap-status>
SetHandler ldap-status
Order deny,allow
Deny from all
Allow from yourdomain.example.com
AuthLDAPEnabled on
AuthLDAPURL ldaps://127.0.0.1/dc=example,dc=com?uid?one
AuthLDAPAuthoritative on
require valid-user
</Location>

# ��389�˿ڽ���һ��TLS LDAP���ӡ���Ҫģ��mod_ldap��mod_authnz_ldap��֧�֡�
# ��"yourdomain.example.com"�޸�Ϊ���Լ���������

LDAPTrustedGlobalCert CA_DER /certs/certfile.der

<Location /ldap-status>
SetHandler ldap-status
Order deny,allow
Deny from all
Allow from yourdomain.example.com
AuthLDAPEnabled on
LDAPTrustedMode TLS AuthLDAPURL ldap://127.0.0.1/dc=example,dc=com?uid?one
AuthLDAPAuthoritative on
require valid-user
</Location>

top

SSL/TLS Certificates

The different LDAP SDKs have widely different methods of setting and handling both CA and client side certificates.

If you intend to use SSL or TLS, read this section CAREFULLY so as to understand the differences between configurations on the different LDAP toolkits supported.

Netscape/Mozilla/iPlanet SDK

CA certificates are specified within a file called cert7.db. The SDK will not talk to any LDAP server whose certificate was not signed by a CA specified in this file. If client certificates are required, an optional key3.db file may be specified with an optional password. The secmod file can be specified if required. These files are in the same format as used by the Netscape Communicator or Mozilla web browsers. The easiest way to obtain these files is to grab them from your browser installation.

Client certificates are specified per connection using the LDAPTrustedClientCert directive by referring to the certificate "nickname". An optional password may be specified to unlock the certificate's private key.

The SDK supports SSL only. An attempt to use STARTTLS will cause an error when an attempt is made to contact the LDAP server at runtime.

# Specify a Netscape CA certificate file
LDAPTrustedGlobalCert CA_CERT7_DB /certs/cert7.db
# Specify an optional key3.db file for client certificate support
LDAPTrustedGlobalCert CERT_KEY3_DB /certs/key3.db
# Specify the secmod file if required
LDAPTrustedGlobalCert CA_SECMOD /certs/secmod
<Location /ldap-status>
SetHandler ldap-status
Order deny,allow
Deny from all
Allow from yourdomain.example.com
AuthLDAPEnabled on
LDAPTrustedClientCert CERT_NICKNAME <nickname> [password]
AuthLDAPURL ldaps://127.0.0.1/dc=example,dc=com?uid?one
AuthLDAPAuthoritative on
require valid-user
</Location>

Novell SDK

One or more CA certificates must be specified for the Novell SDK to work correctly. These certificates can be specified as binary DER or Base64 (PEM) encoded files.

Note: Client certificates are specified globally rather than per connection, and so must be specified with the LDAPTrustedGlobalCert directive as below. Trying to set client certificates via the LDAPTrustedClientCert directive will cause an error to be logged when an attempt is made to connect to the LDAP server..

The SDK supports both SSL and STARTTLS, set using the LDAPTrustedMode parameter. If an ldaps:// URL is specified, SSL mode is forced, override this directive.

# Specify two CA certificate files
LDAPTrustedGlobalCert CA_DER /certs/cacert1.der
LDAPTrustedGlobalCert CA_BASE64 /certs/cacert2.pem
# Specify a client certificate file and key
LDAPTrustedGlobalCert CERT_BASE64 /certs/cert1.pem
LDAPTrustedGlobalCert KEY_BASE64 /certs/key1.pem [password]
# Do not use this directive, as it will throw an error
#LDAPTrustedClientCert CERT_BASE64 /certs/cert1.pem

OpenLDAP SDK

One or more CA certificates must be specified for the OpenLDAP SDK to work correctly. These certificates can be specified as binary DER or Base64 (PEM) encoded files.

Client certificates are specified per connection using the LDAPTrustedClientCert directive.

The documentation for the SDK claims to support both SSL and STARTTLS, however STARTTLS does not seem to work on all versions of the SDK. The SSL/TLS mode can be set using the LDAPTrustedMode parameter. If an ldaps:// URL is specified, SSL mode is forced. The OpenLDAP documentation notes that SSL (ldaps://) support has been deprecated to be replaced with TLS, although the SSL functionality still works.

# Specify two CA certificate files
LDAPTrustedGlobalCert CA_DER /certs/cacert1.der
LDAPTrustedGlobalCert CA_BASE64 /certs/cacert2.pem
<Location /ldap-status>
SetHandler ldap-status
Order deny,allow
Deny from all
Allow from yourdomain.example.com
AuthLDAPEnabled on
LDAPTrustedClientCert CERT_BASE64 /certs/cert1.pem
LDAPTrustedClientCert KEY_BASE64 /certs/key1.pem
AuthLDAPURL ldaps://127.0.0.1/dc=example,dc=com?uid?one
AuthLDAPAuthoritative on
require valid-user
</Location>

Solaris SDK

SSL/TLS for the native Solaris LDAP libraries is not yet supported. If required, install and use the OpenLDAP libraries instead.

Microsoft SDK

SSL/TLS certificate configuration for the native Microsoft LDAP libraries is done inside the system registry, and no configuration directives are required.

Both SSL and TLS are supported by using the ldaps:// URL format, or by using the LDAPTrustedMode directive accordingly.

Note: The status of support for client certificates is not yet known for this toolkit.

top

LDAPCacheEntries ָ��

˵����LDAP����������Ŀ��
�﷨LDAPCacheEntries number
Ĭ��ֵLDAPCacheEntries 1024
������server config
״̬��չ(E)
ģ��mod_ldap

ָ����LDAP����������Ŀ������������������˳ɹ���search/bind�ԡ�������Ϊ0���Թر�search/bind���塣Ĭ��ֵ��1024 ��

top

LDAPCacheTTL ָ��

˵��search/bind������Ŀ��Чʱ��
�﷨LDAPCacheTTL seconds
Ĭ��ֵLDAPCacheTTL 600
������server config
״̬��չ(E)
ģ��mod_ldap

ָ��search/bind������Ŀ��Ч��ʱ�䣬����Ϊ��λ��Ĭ��Ϊ600��(10����)��

top

LDAPConnectionTimeout ָ��

˵��ָ���׽������ӳ�ʱ����
�﷨LDAPConnectionTimeout seconds
������server config
״̬��չ(E)
ģ��mod_ldap

Specifies the timeout value (in seconds) in which the module will attempt to connect to the LDAP server. If a connection is not successful with the timeout period, either an error will be returned or the module will attempt to connect to a secondary LDAP server if one is specified. The default is 10 seconds.

top

LDAPOpCacheEntries ָ��

˵��LDAP compare�������Ĵ�С
�﷨LDAPOpCacheEntries number
Ĭ��ֵLDAPOpCacheEntries 1024
������server config
״̬��չ(E)
ģ��mod_ldap

ָ��mod_ldapʹ�õ�LDAP compare��������С��Ĭ��ֵ��1024����������Ϊ0���Թرղ������塣

top

LDAPOpCacheTTL ָ��

˵������������Чʱ��
�﷨LDAPOpCacheTTL seconds
Ĭ��ֵLDAPOpCacheTTL 600
������server config
״̬��չ(E)
ģ��mod_ldap

ָ������������Ŀ����Чʱ��������Ϊ��λ��Ĭ��Ϊ600�롣

top

LDAPSharedCacheFile ָ��

˵�����ù����ڴ滺�����ļ�
�﷨LDAPSharedCacheFile directory-path/filename
������server config
״̬��չ(E)
ģ��mod_ldap

���ù����ڴ滺�����ļ�����δ���ã���ʹ�����������ڴ�(��ƽ̨֧��)��

top

LDAPSharedCacheSize ָ��

˵�������ڴ滺�������ֽڴ�С
�﷨LDAPSharedCacheSize bytes
Ĭ��ֵLDAPSharedCacheSize 102400
������server config
״̬��չ(E)
ģ��mod_ldap

ָ�������ڴ滺�����Ĵ�С����ByteΪ��λ��Ĭ��Ϊ100KB��

top

LDAPTrustedClientCert ָ��

˵��Sets the file containing or nickname referring to a per connection client certificate. Not all LDAP toolkits support per connection client certificates.
�﷨LDAPTrustedClientCert type directory-path/filename/nickname [password]
������server config, virtual host, directory, .htaccess
״̬��չ(E)
ģ��mod_ldap

It specifies the directory path, file name or nickname of a per connection client certificate used when establishing an SSL or TLS connection to an LDAP server. Different locations or directories may have their own independant client certificate settings. Some LDAP toolkits (notably Novell) do not support per connection client certificates, and will throw an error on LDAP server connection if you try to use this directive (Use the LDAPTrustedGlobalCert directive instead for Novell client certificates - See the SSL/TLS certificate guide above for details). The type specifies the kind of certificate parameter being set, depending on the LDAP toolkit being used. Supported types are:

top

LDAPTrustedGlobalCert ָ��

˵��Sets the file or database containing global trusted Certificate Authority or global client certificates
�﷨LDAPTrustedGlobalCert type directory-path/filename [password]
������server config
״̬��չ(E)
ģ��mod_ldap

It specifies the directory path and file name of the trusted CA certificates and/or system wide client certificates mod_ldap should use when establishing an SSL or TLS connection to an LDAP server. Note that all certificate information specified using this directive is applied globally to the entire server installation. Some LDAP toolkits (notably Novell) require all client certificates to be set globally using this directive. Most other toolkits require clients certificates to be set per Directory or per Location using LDAPTrustedClientCert. If you get this wrong, an error may be logged when an attempt is made to contact the LDAP server, or the connection may silently fail (See the SSL/TLS certificate guide above for details). The type specifies the kind of certificate parameter being set, depending on the LDAP toolkit being used. Supported types are:

top

LDAPTrustedMode ָ��

˵��Specifies the SSL/TLS mode to be used when connecting to an LDAP server.
�﷨LDAPTrustedMode type
������server config, virtual host, directory, .htaccess
״̬��չ(E)
ģ��mod_ldap

The following modes are supported:

Not all LDAP toolkits support all the above modes. An error message will be logged at runtime if a mode is not supported, and the connection to the LDAP server will fail.

If an ldaps:// URL is specified, the mode becomes SSL and the setting of LDAPTrustedMode is ignored.

top

LDAPVerifyServerCert ָ��

˵��Force server certificate verification
�﷨LDAPVerifyServerCert On|Off
Ĭ��ֵLDAPVerifyServerCert On
������server config
״̬��չ(E)
ģ��mod_ldap

Specifies whether to force the verification of a server certificate when establishing an SSL connection to the LDAP server.