![在 Windows Apache 2.4 中看不到 ldap 变量](https://linux22.com/image/706934/%E5%9C%A8%20Windows%20Apache%202.4%20%E4%B8%AD%E7%9C%8B%E4%B8%8D%E5%88%B0%20ldap%20%E5%8F%98%E9%87%8F.png)
在 Windows Apache (2.4) 上工作时,我想向 LDAP 服务器验证用户身份
我在 httpd.conf 中有以下内容
<Directory "C:\Apache24\htdocs">
LDAPReferrals Off
AuthBasicProvider ldap
AuthName "LDAP NAME"
AuthType Basic
AllowOverride None
Options Indexes FollowSymLinks
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"
</Directory>
并在正确文件夹中的 .htaccess 文件中添加以下内容
AuthLDAPBindDN "CN=USER,CN=Users,DC=YY,DC=ZZZZZZZ,DC=QQQ"
AuthLDAPBindPassword "PASSWORD"
Require all denied
AuthLDAPUrl ldap://ldapIP:LDAPPORT/CN=XXX,DC=YY,DC=ZZZZZZZ,DC=QQQ?sAMAccountName?sub?(objectClass=*)
Require valid-user
AuthLDAPRemoteUserAttribute sAMAccountName
AuthLDAPRemoteUserIsDN on
当我访问该网站时,我会收到用户提示,输入正确的凭据后我才能进入该网站(输入错误的凭据将出现 401 - 正常)
我的问题是我需要“检查”谁是访问该网站的用户,我理解 LDAP 应该在环境变量中的“REMOTE_USER”下插入访问该网站的用户名 - 但在 CMD 上检查“设置”,并检查os.envrion
(在 python 上 - 服务器端用 python 编写)什么也没显示..
编辑:
当前的httpd.conf文件是:
<Directory "C:\Apache24\htdocs">
LDAPReferrals Off
AuthBasicProvider ldap
AuthName "LDAP NAME"
AuthType Basic
AllowOverride AuthConfig
Options Indexes FollowSymLinks
Header always set Access-Control-Allow-Origin "*"
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT"
Header always set Access-Control-Allow-Headers "x-requested-with, Content-Type, origin, authorization, accept, client-security-token"
</Directory>
当前的.htaccess 文件是:
AuthLDAPBindDN "CN=USER,CN=Users,DC=YY,DC=ZZZZZZZ,DC=QQQ"
AuthLDAPBindPassword "PASSWORD"
Require all denied
AuthLDAPUrl ldap://ldapIP:LDAPPORT/CN=XXX,DC=YY,DC=ZZZZZZZ,DC=QQQ?sAMAccountName?sub?(objectClass=*)
Require valid-user
我已经打开 Apache 调试日志,并且看到下面相关的日志 - 显示他确实“接受”了我的用户名...但仍然无法从环境变量中“获取”它...
Tue Jul 04 14:28:44.088576 2017] [authz_core:debug] [pid PID1:tid TID1] mod_authz_core.c(806): [client IP:PORT1] AH01626: authorization result of Require all denied: denied
Tue Jul 04 14:28:44.089582 2017] [authz_core:debug] [pid PID1:tid TID1] mod_authz_core.c(806): [client IP:PORT1] AH01626: authorization result of Require valid-user : granted
Tue Jul 04 14:28:44.089582 2017] [authz_core:debug] [pid PID1:tid TID1] mod_authz_core.c(806): [client IP:PORT1] AH01626: authorization result of <RequireAny>: granted
Tue Jul 04 14:28:44.558595 2017] [authz_core:debug] [pid PID1:tid TID2] mod_authz_core.c(806): [client IP:PORT2] AH01626: authorization result of Require all granted: granted, referer: http://domain
Tue Jul 04 14:28:44.558595 2017] [authz_core:debug] [pid PID1:tid TID2] mod_authz_core.c(806): [client IP:PORT2] AH01626: authorization result of <RequireAny>: granted, referer: http://domain
Tue Jul 04 14:28:44.559596 2017] [authz_core:debug] [pid PID1:tid TID2] mod_authz_core.c(806): [client IP:PORT2] AH01626: authorization result of Require all denied: denied, referer: http://domain
Tue Jul 04 14:28:44.559596 2017] [authz_core:debug] [pid PID1:tid TID2] mod_authz_core.c(806): [client IP:PORT2] AH01626: authorization result of Require valid-user : denied (no authenticated user yet), referer: http://domain
Tue Jul 04 14:28:44.559596 2017] [authz_core:debug] [pid PID1:tid TID2] mod_authz_core.c(806): [client IP:PORT2] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet), referer: http://domain
Tue Jul 04 14:28:44.559596 2017] [authnz_ldap:debug] [pid PID1:tid TID2] mod_authnz_ldap.c(515): [client IP:PORT2] AH01691: auth_ldap authenticate: using URL ldap://ldapIP:LDAPPORT/CN=XXX,DC=YY,DC=ZZZZZZZ,DC=QQQ?sAMAccountName?sub?(objectClass=*), refrer: http://domain
Tue Jul 04 14:28:44.559596 2017] [authnz_ldap:debug] [pid PID1:tid TID2] mod_authnz_ldap.c(612): [client IP:PORT2] AH01697: auth_ldap authenticate: accepting **USERNAME**, referer: http://domain
Tue Jul 04 14:28:44.559596 2017] [authz_core:debug] [pid PID1:tid TID2] mod_authz_core.c(806): [client IP:PORT2] AH01626: authorization result of Require all denied: denied, referer: http://domain
Tue Jul 04 14:28:44.559596 2017] [authz_core:debug] [pid PID1:tid TID2] mod_authz_core.c(806): [client IP:PORT2] AH01626: authorization result of Require valid-user : granted, referer: http://domain
Tue Jul 04 14:28:44.559596 2017] [authz_core:debug] [pid PID1:tid TID2] mod_authz_core.c(806): [client IP:PORT2] AH01626: authorization result of <RequireAny>: granted, referer: http://domain
有什么想法吗?谢谢。
答案1
我设法解决了这个问题。
需要访问 WSGI 环境变量,我的应用程序使用 falcon 通过 apache 运行 - 因此通过中间件 API 类访问正确的变量 - falcon 将这些变量附加到 Request 类中的“env”字典中。
class AuthMiddleware(object):
def process_request(self, req, resp):
#auth validation here