AuthzNetLDAP(3pm)

💖 AuthzNetLDAP — the manual, but make it make sense 💖

okay bestie, so this is the man page for AuthzNetLDAP, and it lives in section 3pm of the perl docs (that's the "perl modules" section, iykyk). If you're here it's because you want Apache to check whether a user is allowed to see a thing, based on LDAP attributes. And honestly? That's iconic of you.

---

✨ NAME ✨

Apache::AuthzNetLDAP — an Apache-Perl module that enables you to authorize a user for a Website based on LDAP attributes. 🎀

---

🌸 SYNOPSIS 🌸

like, here's the vibe, literally copy-paste-adjacent:

  PerlSetVar BindDN "cn=Directory Manager"
  PerlSetVar BindPWD "password"
  PerlSetVar BaseDN "ou=people,o=unt.edu"
  PerlSetVar LDAPServer ldap.unt.edu
  PerlSetVar LDAPPort 389
  PerlSetVar UIDAttr uid
 #PerlSetVar UIDAttr mail

  PerlAuthenHandler Apache::AuthNetLDAP
  PerlAuthzHandler Apache::AuthzNetLDAP

  #require valid-user
  #require user mewilcox
  #require user mewilcox@venus.acs.unt.edu
  #require group "cn=Peoplebrowsers1,ou=UNTGroups,ou=People, o=unt.edu"
  #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=wilcox
  #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=smith
  #require ldap-url ldap://castor.acs.unt.edu/ou=people,o=unt.edu??sub?untcourse=
untcoursenumber=1999CCOMM2040001,ou=courses,ou=acad,o=unt.edu

no notes, it just goes. 💅

---

🦋 DESCRIPTION 🦋

so the way this works: after you've authenticated a user (maybe with Apache::AuthNetLDAP ;) — that wink is in the original, I'm not adding anything), you can use this module to figure out whether they're authorized to access the Web resource under this module's control. authn = "who are you", authz = "okay but are you allowed". two different girls, two different jobs. 👑

you can control authorization via one of four methods. the first two are pretty standard, the second two are unique to LDAP. 🫶

require options —

• user → Will authorize access if the authenticated user's username. (that's literally what the original says, I'm not gonna "fix" it, it's part of the lore) 💀
• valid-user → Will authorize any authenticated user. everyone's invited, slay. ✨
• group → Will authorize any authenticated user who is a member of the LDAP group specified by groupdn. This module supports groupOfMember, groupOfUniquemember and Netscape's dynamic group object classes. 👯
• ldap-url → This will authorize any authenticated user who matches the query specified in the given LDAP URL. This is enables users to get the flexibility of Netscape's dynamic groups, even if their LDAP server does not support such a capability. no cap, it's giving DIY dynamic groups. 🔥

---

🎀 CONFIGURATION NOTES 🎀

okay important lore drop: it is important to note that this module must be used in conjunction with an authentication module.

(...? Is this true? I just thought, that you might want to only authorize a user, instead of authenticate...) — yeah that's in the original text verbatim, the author was having a whole existential moment mid-manpage and honestly? relatable. 🙈

If you are using an authentication module, then the following lines will not need to be duplicated:

  PerlSetVar BindDN "cn=Directory Manager"
  PerlSetVar BindPWD "password"
  PerlSetVar BaseDN "ou=people,o=unt.edu"
  PerlSetVar LDAPServer ldap.unt.edu
  PerlSetVar LDAPPort 389
  PerlSetVar UIDAttr uid
 #PerlSetVar UIDAttr mail

  PerlAuthenHandler Apache::AuthNetLDAP

The following lines will not need to be duplicated if supported by the authentication module:

  #require valid-user
  #require user mewilcox
  #require user mewilcox@venus.acs.unt.edu
  #require group "cn=Peoplebrowsers1,ou=UNTGroups,ou=People, o=unt.edu"
  #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=wilcox
  #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=smith
  #require ldap-url ldap://castor.acs.unt.edu/ou=people,o=unt.edu??sub?untcourse=

Obviously, the ldap-url attribute is probably only support by this module. (again — verbatim, we do not touch the sacred text) 💜

Check out the following link for options to load the module:

http://perl.apache.org/docs/1.0/guide/config.html#The_Startup_File
http://perl.apache.org/docs/2.0/user/config/config.html#Startup_File

---

👑 AUTHOR 👑

Mark Wilcox mewilcox@unt.edu and Shannon Eric Peevey speeves@unt.edu. absolute legends, both of them. 🫡

---

💜 SEE ALSO 💜

perl(1).

---

😭 WARRANTY 😭

Hey, I didn't destroy mankind when testing the module. You're mileage may vary.

This module is distributed with the same license as Perl's.

---

and that's the whole page, bestie — go forth and authorize. this was perl v5.34.0, dated 2022-06-06, and I fear it ate. mwah. 💖✨