Topic: Need help in LDAPS configuration for SVN Repo

[harty1193]

Apache Version: 2.4
Operating System: Server 2012
SVN Version: 1.8.17

Hello,

I configured the LDAPS as below:

[tangent]

Are these all the LDAP related settings in your Apache configuration?

I note you've not listed any LDAPTrustedGlobalCert file reference (containing the LDAP DC certificate), or LDAPVerifyServerCert type of entry.

So is the security team's concern that the bind password is stored in cleartext in your Apache configuration file, or that the LDAPS connection over the wire isn't secure for whatever reason? If you turn up debug, do your logs confirm the LDAP connection is secure?

If it's the former, then you have two options:

1) Put the AuthLDAPBindPassword directive in a separate include configuration file, and change the file permissions to be read only by the Apache service user account.
2) Use the exec option of the AuthLDAPBindPassword directive to get an external program (similarly protected) to return the bind password.

For me option 2) is no better than option 1), and neither are ideal, but then the LDAP protocol requires the bind password be passed in clear text, even if the network connection itself is encrypted.

If restricting access to the clear text password isn't acceptable to your security team, then I think you've got a problem. As far as I know, alternative auth modules such as Kerberos (mod_auth_kerb) and GSSAPI (mod_auth_gssapi) won't compile with native MSVC on Windows. Maybe they do with MinGW.

In the past I have user Kerberos / SPNEGO modules with Apache to auth against AD servers, but it was on Linux, and was a pain to configure.

Good luck!

[harty1193]

Thank you tangent!

I have applied the certificates and the LDAPs connection is secure. All the users login are using kerbores except the svc account which is used for binding.

Is there a way we can authenticate using the certificate only?

If there is no way we can avoid the cleartext then, I have to give up!

Regards,
Harry

[tangent]

Sorry, I don't believe you can use this Apache LDAP module to bind to AD by using a client side certificate alone.

But don't give up on a clear text password.

Surely security will accept that the AD bind account be granted minimal read only rights on the required object class attributes. Assuming your Domain Admins are worth their salt, they should be able to set up an account that doesn't expose more details than are absolutely necessary.

[James Blond]

I had no luck with mod_ldap either, but https://github.com/TQsoft-GmbH/mod_authn_ntlm works fine against AD