title: Difference between mod_auth_ldap and mod_authnz_ldap
body: <p>We use LDAP for Subversion access using Apache httpd. We originally had all of our Subversion repositories accessible by all users using the following:</p>
  
  <pre><code>&lt;Location /src&gt;
      DAV svn
      SVNParentPath /opt/svn_repos
      AuthType basic
      AuthName "SVN Repository"
      AuthBasicProvider ldap
      AuthzLDAPAuthoritative off
      AuthLDAPURL "ldap://ldap.mycorp.com:3268/dc=mycorp,dc=com?sAMAccountName" NONE
      AuthLDAPBindDN "CN=svn_acct,OU=Users,DC=mycorp,DC=com"
      AuthLDAPBindPassword "swordfish"
      Require valid-user
  &lt;/Location&gt;
  </code></pre>
  
  <p>Everything was fine. I was asked to move the CM repository to a different location, and make it accessible for only people in the CM group. I did the following:</p>
  
  <pre><code>&lt;Location /cm&gt;
      DAV svn
      SVNPath /opt/cm_svn_repos
      AuthType basic
      AuthName "CM Repository"
      AuthBasicProvider ldap
      AuthzLDAPAuthoritative off
      AuthLDAPURL "ldap://ldap.mycorp.com:3268/dc=mycorp,dc=com?sAMAccountName" NONE
      AuthLDAPBindDN "CN=svn_acct,OU=Users,DC=mycorp,DC=com"
      AuthLDAPBindPassword "swordfish"
      Require group CN=cm-group,OU=Groups,DC=mycorp,DC=com
  &lt;/Location&gt;
  </code></pre>
  
  <p>I spent a couple of hours on this before realizing that I was using mod_auth<i><b>nz</b></i>_ldap and not plain ol' mod_auth_ldap. Thus, I needed <code>ldap-group</code> instead of <code>group</code> in my <code>Require</code> statement. That worked.</p>
  
  <p>My coworker informed me that there was a reason why we used mod_auth<b>nz</b>_ldap and not mod_auth_ldap, but he couldn't remember why. We looked up the Apache httpd documentation, but the documentation provides no clues why you'd use one over the other.</p>
  
  <p>So, what is the difference between mod_auth_ldap and mod_auth<b>nz</b>_ldap, and why would you use one over the other?</p>