使用 Puppet 对 Apache 进行 LDAP 身份验证

Question

I am currently setting up a reverse proxy in puppet so that I can authenticate using Active Directory.

I have the following in my puppet module.

class { 'apache::mod::ldap' :}
class { 'apache::mod::authnz_ldap' :}

apache::vhost { 'reverse-proxy':
  port           => '443',
  docroot        => '/var/www/html',
  ssl            => true,
  ssl_cert       => '/etc/httpd/ssl/cert.crt',
  ssl_key        => '/etc/httpd/ssl/cert.key',
  require        => [ File['/etc/httpd/ssl/cert.crt'], File['/etc/httpd/ssl/cert.key']],
  rewrites       => [
    {  
      comment      => 'Eliminate Trace and Track',
      rewrite_cond => ['%{REQUEST_METHOD} ^(TRACE|TRACK)'],
      rewrite_rule => [' .* - [F]'],
    },
  ],
  proxy_preserve_host => true,
  proxy_pass => {
      path => '/',
      url => 'http://127.0.0.1:5601/',
  }, 
  directories => [
    { 
      path => '/',
      provider => 'location',
      auth_name => 'Kibana Authentication',
      auth_type => 'Basic',
      auth_basic_provider => 'ldap',
      auth_ldap_bind_dn => 'cn=serviceuser,ou=Users,dc=example,dc=com',
      auth_ldap_bind_password => 'supersecretpassword',
      auth_ldap_url => 'ldaps://ldap.example.com/dc=example,dc=com?CN?
sub?(objectClass=user)',
      require => 'ldap-group 
cn=application_users,ou=application_groups,ou=groups,dc=example,dc=com',
    },
  ],
}

The problem I'm running into is that when I apply this configuration to my apache server auth_ldap_bind_dn , auth_ldap_bind_password , and auth_ldap_url are not being copied over. Puppet isn't throwing any errors and apache runs fine, but it isn't authenticating against LDAP.

Answer 1

old thread but for the benefit of anyone else with the same issue:

I've taken a look at the apache module's code in github and it doesn't appear to support the parameters you've mentioned ( auth_ldap_bind_dn , auth_ldap_bind_password , and auth_ldap_url ).

However, the directories resource allows you to include custom fragments, which you can use to inject any custom configuration outside of the apache module's scope into your config.

In your case, this should work:

class { 'apache::mod::ldap' :}
class { 'apache::mod::authnz_ldap' :}

apache::vhost { 'reverse-proxy':
  port           => '443',
  docroot        => '/var/www/html',
  ssl            => true,
  ssl_cert       => '/etc/httpd/ssl/cert.crt',
  ssl_key        => '/etc/httpd/ssl/cert.key',
  require        => [ File['/etc/httpd/ssl/cert.crt'], File['/etc/httpd/ssl/cert.key']],
  rewrites       => [
    {  
      comment      => 'Eliminate Trace and Track',
      rewrite_cond => ['%{REQUEST_METHOD} ^(TRACE|TRACK)'],
      rewrite_rule => [' .* - [F]'],
    },
  ],
  proxy_preserve_host => true,
  proxy_pass => {
      path => '/',
      url => 'http://127.0.0.1:5601/',
  }, 
  directories => [
    { 
      path => '/',
      provider => 'location',
      auth_name => 'Kibana Authentication',
      auth_type => 'Basic',
      auth_basic_provider => 'ldap',
      custom_fragment => "AuthLDAPURL 'ldaps://ldap.example.com/dc=example,dc=com?CN?sub?(objectClass=user)'
        AuthLDAPBindDN 'cn=serviceuser,ou=Users,dc=example,dc=com'
        AuthLDAPBindPassword supersecretpassword",
      require => 'ldap-group cn=application_users,ou=application_groups,ou=groups,dc=example,dc=com',
    },
  ],
}