LDAP configuration of the PAM module
Systems that use Pam for verification include:
- Linux Logon: ETC/PAM. d/system. auth
- SSH
- Vsftp
The LDAP configuration file of PAM is:
- /Etc/nsswitch. conf
- /Etc/ldap. conf
The interactive configuration command of PAM is authconfig-tui.
Subversion (APACHE) LDAP Configuration
Compared with Apache 2.0, Apache 2.2 improves the authentication and authorization module management mode, and the configuration supported by LDAP is also slightly different:
- The LDAP authentication module used by Apache 2.0 is mod_auth_ldap.so.
- The LDAP authentication module used by Apache 2.2 is mod_authnz_ldap.so.
Required Apache module:
- Mod_ldap: the required library for interaction between httpd and LDAP.
- Mod_authnz_ldap: a module that controls LDAP authentication and authorization. It depends on mod_ldap. Authnz is called because this module implements both authentication and authorization.
- Mod_dav_svn: a module used by httpd to operate SVN Repository
Notes:
- Authldapbinddn and authldapbindpassword do not need to be set unless LDAP directory allows anonymous authentication (Access Control configured in slapd. conf)
- Samaccountname in authldapurl is exclusive to the Windows Active Directory. For OpenLDAP, change it to the user name attribute, such as uid.
- You can set LDAP class filters in authldapurl to improve query efficiency. For example, objectclass = posixaccount
- The Subversion authentication system does not support LDAP groups, but only LDAP users. That is to say, When configuring the access control policy for the Subversion database, you need to set another set of LDAP-independent group definitions, which will cause data synchronization. Fortunately, some cool people have written a practical Python script for group synchronization on the Internet. For details, refer to: Using LDAP groups with subversion's authz file.
- Authzsvnaccessfile indicates the svn access control file. If the file has Syntax problems, the entire file will be ignored by SVN. The effect is equivalent to no access control file, and authentication will fail. When you configure this file, we recommend that you debug the file at least once and write all the files at a time.
- SVN location can be configured in the root directory, that is But put it in And become a virtual host. At this point the access address is like a http://svn.xxx.com, there is no other directory.
For details, see:
- Authentication and authorization for SVN access through LDAP on Apache
- Combining Apache and LDAP with subversion (English link: Subversion with Apache and LDAP: updated)
