I've no idea about doing what you want, but if you create the site through the Web Server app, you can force authentication there against an LDAP group. It is one of the options available to you.

Nick Howitt wrote:

I've no idea about doing what you want, but if you create the site through the Web Server app, you can force authentication there against an LDAP group. It is one of the options available to you.

Hey, Nick
Awesome that you are replying even on a Sunday. Thanks!

I might be explaining myself rather poorly, or there is some basic stuff I have misunderstood. Just to clarify:
- When you are referring to setting the LDAP group for authentication - you are referring to the "Group" option within the website config, right? And with the option "Require Authentication" set to "Enabled". Right?

It was my understanding that this method does not involve the LDAP server at all, since its actually using "pwauth" for this. Correct me if I'm wrong.
(One can argue that since clearOS seems to sync the LDAP directory with the linux users and their corresponding groups this can be viewed as one and the same, but for my case it could be an important detail)

Reason for my understanding being:

The "pwauth" mechanism can be seen in the auto-generated flex-443.conf and flex-80.conf

DefineExternalAuth pwauth pipe /usr/bin/pwauth

DefineExternalGroup pwauth pipe /usr/bin/unixgroup

And for the actual directories within the virtualhost:

        AuthType Basic

        AuthBasicProvider external

        AuthExternal pwauth

        <RequireAll>

                Require unix-group radius

        </RequireAll>

I have also managed to get the directory to use the actual LDAP server to authenticate, instead of using the pwauth method:
(reason being, I have read that pwauth does not support forms, and that authtype basic does not support sessions, so therefore i'm moving towards using authtype form with mod_ldap and mod_session)

<Directory /var/www/virtual/my-secret.server.com/html/test>;

        AuthType Basic

        AuthName "Testing auth through LDAP"

        AuthBasicProvider ldap



        Options -Indexes +FollowSymLinks +IncludesNOExec



        AuthLDAPURL "ldap://127.0.0.1:389/ou=Users,ou=Accounts,dc=system,dc=lan?uid"

        AuthLDAPBindDN "cn=accounts,ou=Internal,dc=system,dc=lan"

        AuthLDAPBindPassword "TheAccountsPasswordSetInClearOsWebConfig"



        Require ldap-group cn=radius,ou=Groups,ou=Accounts,dc=system,dc=lan

</Directory>

And this works great. But....

####

... I'm still not able to make sure that the user stays logged in through the day = I have still not been able to set up a "remember me" function (session cookie) using mod_session (and mod_session_crypto, mod_requests etc etc)

So I'm still only halfway there.

I realise that this probably is way outside of ClearOS support area, but hopefully you or someone reading this will know how to properly customise for such a situation.

-How do I "convert" my currently working LDAP auth so that it uses AuthType Form (with the needed login.html, error redirects, etc) instead of AuthType Basic?
-How do I set a cookie, or similar "remember me" function, for that AuthType so that the user wont be asked for credentials multiple times throughout the day/week?

Again, I can't help you with your underlying question, but as far as the ClearOS authentication works, the groups come from LDAP as you argue. It is up to you if you want to use them.