how do I do a single point authentication with php, apache and LDAP

Question

Hi,

I have this senario. We have an application server that contains a few web based applications that our users use. Our users and the groups are stored in an OpenLDAP database. Access to these applications are restricted depending on group.

Now what I would like to do is that when the user hits the server (http://server/), a basic web application is displayed forcing the user to login against the LDAP server. When authenticated a list of applications that the user is allowed access to is displayed. They use this list to click through to the desired app.

The users can not go direct to the application e.g. http://server/someapp, if they are not authorised the apache server redirects to the root of the server.

Is this at all possible, to authenticate a user in a web app and use that authentication against apache for authorisation on the other apps hosted on the server?

The apache dialog box is something that we can not fall back on, as would you believe it that it confuses our users?!?!

If the above is not possible, any other suggestions would be really helpful.

Many thanks.

Answer 1

This might help, I attempted something like this before as a test setup, but alas did not get far, this how to should shine some light, as it goes through directory permissions

http://www.opensourcehowto.org/how-to/apache/setup-apache2-with-openldap-authentication.html Mod_Auth_LDAP http://httpd.apache.org/docs/2.0/mod/mod_auth_ldap.html

You would need in your The Authorization Phase a check against their respective group access, and that would be set in each folders .htaccess file

EDIT: I found you a PHP Form reference: http://www.phpbuilder.com/board/showthread.php?t=10257921 Try that, the user has PHP authenticating for him (if you choose to use that language).