7

I know how to auth the users via LDAP in apache2: 

# put the following in the VirtualHost

<VirtualHost *:443>
    ServerAdmin [email protected] 
    DocumentRoot /var/www
    <Directory />
    AuthType Basic
    AuthName "Please provide USERNAME AND PASSWORD"
    AuthBasicProvider ldap
    Order allow,deny
    Allow from all
    AuthLDAPURL "ldaps://ehh.foo.com/ou=ehh,o=foo.com?mail"
    Require valid-user
    Require ldap-attribute [email protected]

Q: But we need to use nginx. How can we configure nginx to auth via LDAP?

Using Ubuntu 12.04.5

Improve this question

3 Answers 3

Reset to default
8

For this you need to download/clone, compile and install nginx-auth-ldap

You can download the zip file:

wget https://github.com/kvspb/nginx-auth-ldap/archive/master.zip
unzip master.zip

then cd to your nginx source folder and do:

./configure --add-module=~-/nginx-auth-ldap-master
sudo make install

After that you can configure nginx:

http {
  ldap_server test1 {
    url ldap://192.168.0.1:3268/DC=test,DC=local?sAMAccountName?sub?(objectClass=person);
    binddn "TEST\\LDAPUSER";
    binddn_passwd LDAPPASSWORD;
    group_attribute uniquemember;
    group_attribute_is_dn on;
    require valid_user;
  }

  ldap_server test2 {
    url ldap://192.168.0.2:3268/DC=test,DC=local?sAMAccountName?sub?(objectClass=person);
    binddn "TEST\\LDAPUSER";
    binddn_passwd LDAPPASSWORD;
    group_attribute uniquemember;
    group_attribute_is_dn on;
    require valid_user;
  }
}

server {
    listen       8000;
    server_name  localhost;

    auth_ldap "Forbidden";
    auth_ldap_servers test1;
    auth_ldap_servers test2;

    location / {
        root   html;
        index  index.html index.htm;
    }

}

As indicated in the modules documentation.

Improve this answer
3

You can also use the auth_pam module. It has for example been included in the last two stable Debian releases. It supports LDAP authentication (and a lot more) through PAM.

Improve this answer
2
  • There's a pam module for nginx authentication?! Commented May 15, 2019 at 23:10
  • Not built-in, this looks like an open source add-on. Commented Feb 25, 2022 at 20:55
0

I have written nginx-auth-saslauthd, which interfaces nginx with the saslauthd daemon and provides Basic authentication. The saslauthd daemon supports LDAP as well as PAM.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.