Authenticate users via LDAP using nginx

Question

I know how to auth the users via LDAP in apache2:

# put the following in the VirtualHost

<VirtualHost *:443>
    ServerAdmin [email protected] 
    DocumentRoot /var/www
    <Directory />
    AuthType Basic
    AuthName "Please provide USERNAME AND PASSWORD"
    AuthBasicProvider ldap
    Order allow,deny
    Allow from all
    AuthLDAPURL "ldaps://ehh.foo.com/ou=ehh,o=foo.com?mail"
    Require valid-user
    Require ldap-attribute [email protected]

Q: But we need to use nginx. How can we configure nginx to auth via LDAP?

Using Ubuntu 12.04.5

Anthon · Answer 1 · 2014-11-02T12:01:35.733

For this you need to download/clone, compile and install nginx-auth-ldap

You can download the zip file:

wget https://github.com/kvspb/nginx-auth-ldap/archive/master.zip
unzip master.zip

then cd to your nginx source folder and do:

./configure --add-module=~-/nginx-auth-ldap-master
sudo make install

After that you can configure nginx:

http {
  ldap_server test1 {
    url ldap://192.168.0.1:3268/DC=test,DC=local?sAMAccountName?sub?(objectClass=person);
    binddn "TEST\\LDAPUSER";
    binddn_passwd LDAPPASSWORD;
    group_attribute uniquemember;
    group_attribute_is_dn on;
    require valid_user;
  }

  ldap_server test2 {
    url ldap://192.168.0.2:3268/DC=test,DC=local?sAMAccountName?sub?(objectClass=person);
    binddn "TEST\\LDAPUSER";
    binddn_passwd LDAPPASSWORD;
    group_attribute uniquemember;
    group_attribute_is_dn on;
    require valid_user;
  }
}

server {
    listen       8000;
    server_name  localhost;

    auth_ldap "Forbidden";
    auth_ldap_servers test1;
    auth_ldap_servers test2;

    location / {
        root   html;
        index  index.html index.htm;
    }

}

As indicated in the modules documentation.

score 3 · Answer 2 · answered Jul 25 '15 at 20:35

3

You can also use the auth_pam module. It has for example been included in the last two stable Debian releases. It supports LDAP authentication (and a lot more) through PAM.

answered Jul 25 '15 at 20:35

Adrian Heine

133
6

There's a pam module for nginx authentication?! – Shōgun8 May 15 '19 at 23:10
Not built-in, this looks like an open source add-on. – Greg Glockner Feb 25 '22 at 20:55

Andreas Vögele · Answer 3 · 2022-09-16T00:12:59.603

0

I have written nginx-auth-saslauthd, which interfaces nginx with the saslauthd daemon and provides Basic authentication. The saslauthd daemon supports LDAP as well as PAM.

edited Sep 16 '22 at 00:12

answered Apr 17 '21 at 10:27

Andreas Vögele

26
4

Authenticate users via LDAP using nginx

3 Answers3