---
title: Configuring Apache to Authenticate Against Active Directory
description: Configuring Apache to Authenticate Against Active Directory
---

[![Exxa Managed IT Services Brisbane](https://blog.exxa.tech/hubfs/Exxa_June2019%20/Images/logo_Png_small_1.png)](https://exxa.tech)

- [Home](https://exxa.tech/)
- [Services](https://exxa.tech/services/it-services-inforgraphic) 
    - [All Services](https://exxa.tech/services/services)
    - [Managed IT Services](https://exxa.tech/services/it-managed-services)
    - [Compute and Email to Cloud Migrations](https://exxa.tech/services/compute-and-email-to-cloud-migrations)
    - [Automated Backups](https://exxa.tech/services/automated-backups)
    - [IT Security Services](https://exxa.tech/services/it-security-services)
    - [VOIP Hosted Phone Service](https://exxa.tech/services/pbx-voip-hosted-phone-service)
    - [Microsoft 365 Business & Office 365 Discounts](https://exxa.tech/services/office365-discounts)
    - [Surface Pro 6 for Business Tax Time offer!](https://exxa.tech/services/surface-pro-6-for-business-tax-time)
- [Insights](https://exxa.tech/insights/managed-it-services-insights) 
    - [News](https://exxa.tech/news)
    - [Articles](https://exxa.tech/table/articles/)
    - [LinkedIn](https://www.linkedin.com/company/exxa-tech)
- [Partners](https://exxa.tech/partners/partners)
- [STORE](https://store.exxa.tech/find/computer-systems)
- [FREE AUDIT](https://info.exxa.tech/audit)
- [CONTACT](https://exxa.tech/about/contact-us)

![Managed IT Services Brisbane Articles](https://blog.exxa.tech/hubfs/Exxa_June2019%20/Images/server_racks_blue.png "Managed IT Services Brisbane Articles")

# Exxa Articles

# Configuring Apache to Authenticate Against Active Directory

# CONFIGURING APACHE TO AUTHENTICATE AGAINST ACTIVE DIRECTORY

 

The purpose of doing this could be .htaccess authentication or any website application that requires advanced authentication, such as Subversion.

In my example I am using CentOS as the Linux Operating System which hosts Apache, but apart from the initial module configuration, the .htaccess file commands should work on most \*nix's.

 

## Prerequisites

The first requirement which nowadays should already be installed is the LDAP authentication modules in Apache.  
Just edit /etc/httpd/conf/httpd.conf and uncomment the following lines:

**LoadModule ldap\_module modules/mod\_ldap.so**  
**LoadModule authnz\_ldap\_module modules/mod\_authnz\_ldap.so**

In other flavours of Linux the modules may be listed elsewhere.

Next, create a user which will bind to Active Directory to get the user information from the domain. This should NOT be an administrator or have any more than the minimal security rights as the password has to be put in plain text in the conf or .htaccess file.

For security purposes then, it is highly recommended that the website be SSL enabled so the password is effectively encrypted on it's way to the Windows Domain Controller.  
In order to find out the exact path of the user details, you will require either adsiedit.msc or JXplorer and Domain Administrator rights.  
In my case I created a user called adsync in the default user location. This is **cn=adsync,cn=users,dc=example,dc=com** - assuming your domain is called example.com of course.

You can easily adapt the above example to your configuration.  
Once you have logged into JXplorer, you can navigate to the OU you set up containing the users and groups in Active Directory you want to authenticate against.  
Highlight the Group or User Organisational Unit you wish to include and select Table editor. Next to the **distinguishedName** attribute type is the information you need, in our case:

**OU=Example Container,DC=example,DC=com**

This needs to contain all the users and / or groups that will be authenticating against Active Directory. Users not in this file path will not be able to authenticate.  
**For some reason it won't allow you to specify DC=example,DC=com only - you need at least one OU.**

## .htaccess or conf file configuration

OK, below is the .htaccess file corresponding to the example data above and each command explained.

**AuthLDAPBindDN "CN=adsync,CN=Users,DC=example,DC=com"**  
**AuthLDAPBindPassword "password"**  
**# search user**  
**AuthLDAPURL "ldap://dc01.example.com:389/OU=Example Container,DC=example,DC=com?sAMAccountName?sub?(objectClass=**)"\*  
**AuthType Basic**  
**AuthName "USE YOUR WINDOWS ACCOUNT"**  
**AuthBasicProvider ldap**  
**# Important, otherwise "(9)Bad file descriptor: Could not open password file: (null)"**  
**AuthUserFile /dev/null**  
**Require ldap-group CN=Example Group,OU=Example Container,DC=example,DC=com**  
**require valid-user**

**AuthLDAPBindDN "CN=adsync,CN=Users,DC=example,DC=com"**

This is the username you setup specifically to bind to the domain. It should be exactly like this - ie. " at the beginning and end" and Capital CN / DC etc, not lower case

**AuthLDAPBindPassword "password"**

This is the password which should have the actual user password (don't make it password!), again with quotation marks around it.

**AuthLDAPURL "ldap://dc01.example.com:389/OU=Example Container,DC=example,DC=com?sAMAccountName?sub?(objectClass=**)"\*

This is the search path where the users and groups must live. They can be containers within this OU or at the top level of the OU, both works. Should be sufficient to copy and paste.

**AuthType Basic**  
**AuthName "USE YOUR WINDOWS ACCOUNT"**  
**AuthBasicProvider ldap**

This specifies it is unencrypted authentication, hence the SSL suggestion.  
The Comments on the username / password box that will come up when you try and access the website resource  
Obvious really - that we are using LDAP as the authentication type.

**AuthUserFile /dev/null**

Not sure about this one, you just need it OK!?!?

**Require ldap-group CN=Example Group,OU=Example Container,DC=example,DC=com**

**Require valid-user**

Specify that only users in the Example Group who are within the OU specified in **AuthLDAPURL** are allowed access.

**Require ldap-group** is not required but added security functionality, or you can specify

**Require ldap-user Example.User**

or

**Require ldap-dn CN=Example User,CN=Example Group,OU=Example Container,DC=example,DC=com**

or whatever you like to your particular requirements.

 

## Related Articles

## Fixing Windows 2012 R2 Server Time after Reboot

[Read More](http://wordpress.exxa.tech/2018/03/03/fixing-w2k12-r2-server-time/)

### Articles

### NEVER MISS A NEWS UPDATE

- [Legal](https://exxa.tech/about/legal)
- [Privacy Policy](https://exxa.tech/about/privacy-policy)
- [Terms & Conditions](https://exxa.tech/about/terms-and-conditions)
- [Sitemap](https://exxa.tech/sitemap)

[LinkedIn](https://www.linkedin.com/company/exxa-tech)    |    [Twitter](https://twitter.com/exxatech)     |    [Facebook](https://www.facebook.com/Exxa.tech)                                            Copyright Exxa