Apache2 / mod_ldap / Active Directory

[tof06]

Hello,

I am trying to set up a reverse authenticated proxy for an internal site
of my company.
The authentication is done agaisnt a Microsoft Active Directory (on Win 2K3)
Everything works almost fine, but I'm running into problem when users
has localized chars (ex french accentued letters) in their password. They are
rejected with an invalid password.

When I try to bind to ldap with a such user with ldapsearch command, if
the password is UTF-8 encoded, it's ok, if not, password is rejected

How can I tell apache to use UTF-8 when doing authentification, or to
convert the username/password to UTF-8 before binding to ldap ?
I try to set AddDefaultCharset to utf-8, but that doesn't help.

Thanks for any help you can provide. I've googled during 3 days without finding something equivalent

System info :

[n3bul4]

Hmmm have you followed this guide to enable UTF-8 support on your box?

http://www.gentoo.org/doc/en/utf-8.xml

post your locales.......

When did you set the unicode use flag variable?
before emerging apache or after it?

Have you tried to do a

[tof06]

Thanks for your answer.

The unicode use flag were set when installing the server. So, apache, ldap, and every package were built with this flag on

Here's some information about locales :

[n3bul4]

Hmm I see....
I googled a bit around and found the following:

libapache-mod-encoding
Apache module for non-ascii filename interoperability
This module improves non-ascii filename interoperability of apache (and mod_dav).
It seems many WebDAV clients send filename in its platform-local encoding. But since mod_dav expects everything, even HTTP request line, to be in UTF-8, this causes an interoperability problem.
I believe this is a future issue for specification (RFC?) to standardize encoding used in HTTP request-line and HTTP header, but life would be much easier if mod_dav (and others) can handle various encodings sent by clients, TODAY. This module does just that.

I don't know if this will solve your problem but you told me that apache is expecting the username to be
utf-8 encoded.....maybe therefor this will work......but I am absolutely not sure.
I also don't know how the apache module is called under gentoo (libapache-mod-encoding) is debian / ubuntu...

It would be interesting to sniff a correct and an incorrect authentication as well I think.
Maybe than we could see the problem.....

[tof06]

I didn't find anything about mod_encoding on gentoo. There used to be an ebuild in portage, but it has been removed.
I tried to compile it from source, I got some errors...

BTW, I tried to sniff LDAP packets. I can't sniff HTTP Packets, because it's https.

When I do a ldapsearch -D "mybinddn" -W , the password which is éric@1234 for testing is coded as this :

0x00a0: 433d 6672 800a c3a9 7269 6340 3132 3334 C=fr....ric@1234

(C=fr is the end of the Bind DN... )

When I tried to authenticate with apache (which doesn't work), here is the same portion of code :

0x00a0: 433d 6672 8009 e972 6963 4031 3233 34 C=fr...ric@1234


There's one byte less in the second form. I'm not an expert on network analysis, but I think the first different code (09 or 0a) represent the length of string (10 bytes for the working one, 9 for the second). E9 is the ISO Code for é, and, i believe, C3A9, the UTF-8 code ??

[n3bul4]

Hmm yes I think so too......

E9 is definitely the ISO code for é (http://www.torsten-horn.de/techdocs/ascii.htm)
and C3A9 is the UTF-8 code for é (http://www1.tip.nl/~t876506/utf8tbl.html)


It sems like apache is not encoding in UTF-8......damn....
I am sry but I have no clue at the moment......

[tof06]

Hello,

Thanks for your answers...
I installed apache 2.2, but there's no difference. Password is still iso encoded.
I sent a mail on apache user's mailing list about this... But I can't imagine this is a bug. I'm not the only guy who try to authenticate users against AD, and who has specials chars in their password

I hope someone can help me...

Thanks again.

[n3bul4]

Hmm yes you are right.....
Maybe there is a trick to do it......
Sry but I am out of ideas.......

[n3bul4]

Hiho!

Did you find a way to do it?

regards....

[tof06]

No

Nobody answer me on apache ML, and I sill don't get it working.

Regards