MBCDN

Dies ist eine alte Version des Dokuments!

---

apt install apache2
a2enmod auth_basic ldap authnz_ldap ssl
systemctl reload apache2

<Directory "/var/www/html/secret">
    AuthType Basic
    AuthName "Intern"
    AuthBasicProvider ldap

    # 1) LDAP-Query: BaseDN / Attribut / Scope / Filter
    # Single-Domain: sAMAccountName ist typisch
    AuthLDAPURL "ldaps://dc1.example.com:636/DC=example,DC=com?sAMAccountName?sub?(objectClass=user)"

    # 2) Bind-User (Service-Account) fürs Suchen der User-DN (AD erlaubt anonym i.d.R. nicht)
    AuthLDAPBindDN "CN=apache-bind,OU=Service Accounts,DC=example,DC=com"
    AuthLDAPBindPassword "SEHR_GEHEIM"

    # Optional, aber bei AD häufig hilfreich:
    LDAPReferrals Off

    # A) Jeder gültige AD-User:
    # Require valid-user

    # B) Oder nur Mitglieder einer AD-Gruppe:
    AuthLDAPGroupAttribute member
    AuthLDAPGroupAttributeIsDN On
    AuthLDAPMaxSubGroupDepth 5
    Require ldap-group CN=WebApp-Users,OU=Groups,DC=example,DC=com
</Directory>

─$ ldapsearch -H ldap://vie-srv-dc01.d2000.local -D "admin_zarat@d2000.local" -w "*****" -b "DC=d2000,DC=local" "sAMAccountName=manuel.zarat" dn
# extended LDIF
#
# LDAPv3
# base <DC=d2000,DC=local> with scope subtree
# filter: sAMAccountName=manuel.zarat
# requesting: dn 
#

# Zarat Manuel, USER-INFRA-IT-Microsoft365, INFRA-IT, GBI, AKM, d2000.local
dn: CN=Zarat Manuel,OU=USER-INFRA-IT-Microsoft365,OU=INFRA-IT,OU=GBI,OU=AKM,DC
 =d2000,DC=local

# search reference
ref: ldap://DomainDnsZones.d2000.local/DC=DomainDnsZones,DC=d2000,DC=local

# search reference
ref: ldap://ForestDnsZones.d2000.local/DC=ForestDnsZones,DC=d2000,DC=local

# search reference
ref: ldap://d2000.local/CN=Configuration,DC=d2000,DC=local

# search result
search: 2
result: 0 Success

# numResponses: 5
# numEntries: 1
# numReferences: 3
                                                                             
┌──(manuel㉿kali)-[~]
└─$ 

  GNU nano 8.6                                              /etc/apache2/apache2.conf                                                       
IncludeOptional sites-enabled/*.conf

<Directory "/var/www/html">
    AuthType Basic
    AuthName "Intern"
    AuthBasicProvider ldap

    # 1) LDAP-Query: BaseDN / Attribut / Scope / Filter
    # Single-Domain: sAMAccountName ist typisch
    AuthLDAPURL "ldaps://vie-srv-dc1.d2000.local:636/DC=d2000,DC=local?sAMAccountName?sub?(objectClass=user)"

    # 2) Bind-User (Service-Account) fürs Suchen der User-DN (AD erlaubt anonym i.d.R. nicht)
    AuthLDAPBindDN "CN=admin_zarat,OU=IT,OU=AKM,DC=d2000,DC=local"
    AuthLDAPBindPassword "Lunikoff0310#"

    # Optional, aber bei AD häufig hilfreich:
    LDAPReferrals Off

    # A) Jeder gültige AD-User:
    Require valid-user

    # B) Oder nur Mitglieder einer AD-Gruppe:
    #AuthLDAPGroupAttribute member
    #AuthLDAPGroupAttributeIsDN On
    #AuthLDAPMaxSubGroupDepth 5
    #Require ldap-group CN=WebApp-Users,OU=Groups,DC=example,DC=com
</Directory>