title: Apache Active Directory mod_authnz_ldap not working
body: <p>I have been trying to get AD auth on a virtualhost page working for the past several days, to no avail. Help...</p>
  
  <p>CentOS 7</p>
  
  <p>Apache 2.4.6</p>
  
  <p>mod_ldap and mod_authnz_ldap installed and loading</p>
  
  <pre><code>&lt;VirtualHost *:80&gt; 
      DocumentRoot /var/www/wwwtest/public
      ServerName wwwtest.example.com
      ErrorLog logs/wwwtest.example.com-error_log
      CustomLog logs/wwwtest.example.com-access_log common
      &lt;Directory /var/www/wwwtest/public&gt;
          Allow from all
          Order Allow,Deny
          Options Indexes MultiViews FollowSymLinks
          AllowOverride None
          AuthType Basic
          AuthName "login"
          AuthBasicProvider ldap
          AuthLDAPBindDN ldapuser@EXAMPLE.COM
          AuthLDAPBindPassword ldappassword
          AuthLDAPURL "ldap://ldap01.example.com:3268/ou=employees,ou=users,dc=example,dc=com?sAMAccountName?sub?(objectClass=user)"
          AuthLDAPBindAuthoritative off
          Require valid-user
      &lt;/Directory&gt;
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>I have trace8 enabled in /etc/httpd/conf/httpd.conf</p>
  
  <p>And this is what I see in /var/log/httpd/wwwtest.example.com-error.log</p>
  
  <pre><code>[Wed Oct 21 12:12:56.213178 2015] [http:trace4] [pid 20648] http_request.c(301): [client 172.16.250.250:49559] Headers received from client:
  [Wed Oct 21 12:12:56.213263 2015] [http:trace4] [pid 20648] http_request.c(305): [client 172.16.250.250:49559]   Host: wwwtest.example.com
  [Wed Oct 21 12:12:56.213278 2015] [http:trace4] [pid 20648] http_request.c(305): [client 172.16.250.250:49559]   User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:41.0) Gecko/20100101 Firefox/41.0
  [Wed Oct 21 12:12:56.213284 2015] [http:trace4] [pid 20648] http_request.c(305): [client 172.16.250.250:49559]   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  [Wed Oct 21 12:12:56.213289 2015] [http:trace4] [pid 20648] http_request.c(305): [client 172.16.250.250:49559]   Accept-Language: en-US,en;q=0.5
  [Wed Oct 21 12:12:56.213293 2015] [http:trace4] [pid 20648] http_request.c(305): [client 172.16.250.250:49559]   Accept-Encoding: gzip, deflate
  [Wed Oct 21 12:12:56.213297 2015] [http:trace4] [pid 20648] http_request.c(305): [client 172.16.250.250:49559]   DNT: 1
  [Wed Oct 21 12:12:56.213301 2015] [http:trace4] [pid 20648] http_request.c(305): [client 172.16.250.250:49559]   Connection: keep-alive
  [Wed Oct 21 12:12:56.213305 2015] [http:trace4] [pid 20648] http_request.c(305): [client 172.16.250.250:49559]   Cache-Control: max-age=0
  [Wed Oct 21 12:12:56.213309 2015] [http:trace4] [pid 20648] http_request.c(305): [client 172.16.250.250:49559]   Authorization: Basic RTAxMDEwMTAxOkNvbmNvcmRpYTIwMTU=
  [Wed Oct 21 12:12:56.213530 2015] [authz_core:debug] [pid 20648] mod_authz_core.c(809): [client 172.16.250.250:49559] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)
  [Wed Oct 21 12:12:56.213556 2015] [authz_core:debug] [pid 20648] mod_authz_core.c(809): [client 172.16.250.250:49559] AH01626: authorization result of &lt;RequireAny&gt;: denied (no authenticated user yet)
  [Wed Oct 21 12:12:56.213644 2015] [authnz_ldap:debug] [pid 20648] mod_authnz_ldap.c(501): [client 172.16.250.250:49559] AH01691: auth_ldap authenticate: using URL ldap://ldap01.example.com:3268/ou=employees,ou=users,dc=example,dc=edu?sAMAccountName?sub?(objectClass=user)
  [Wed Oct 21 12:12:56.213705 2015] [authnz_ldap:trace1] [pid 20648] mod_authnz_ldap.c(522): [client 172.16.250.250:49559] auth_ldap authenticate: final authn filter is (&amp;(objectClass=user)(sAMAccountName=TESTUSER))
  [Wed Oct 21 12:12:56.215123 2015] [ldap:debug] [pid 20648] util_ldap.c(372): AH01278: LDAP: Setting referrals to On.
  [Wed Oct 21 12:12:56.216479 2015] [ldap:trace2] [pid 20648] util_ldap.c(591): [client 172.16.250.250:49559] ldap_simple_bind() failed with server down (try 1)
  [Wed Oct 21 12:12:56.217336 2015] [ldap:trace2] [pid 20648] util_ldap.c(591): [client 172.16.250.250:49559] ldap_simple_bind() failed with server down (try 2)
  [Wed Oct 21 12:12:56.217358 2015] [ldap:trace2] [pid 20648] util_ldap.c(606): [client 172.16.250.250:49559] attempt to re-init the connection
  [Wed Oct 21 12:12:56.217398 2015] [ldap:debug] [pid 20648] util_ldap.c(372): AH01278: LDAP: Setting referrals to On.
  [Wed Oct 21 12:12:56.218332 2015] [ldap:trace2] [pid 20648] util_ldap.c(591): [client 172.16.250.250:49559] ldap_simple_bind() failed with server down (try 3)
  [Wed Oct 21 12:12:56.219355 2015] [ldap:trace2] [pid 20648] util_ldap.c(591): [client 172.16.250.250:49559] ldap_simple_bind() failed with server down (try 4)
  [Wed Oct 21 12:12:56.219392 2015] [ldap:trace2] [pid 20648] util_ldap.c(606): [client 172.16.250.250:49559] attempt to re-init the connection
  [Wed Oct 21 12:12:56.219430 2015] [ldap:debug] [pid 20648] util_ldap.c(372): AH01278: LDAP: Setting referrals to On.
  [Wed Oct 21 12:12:56.219444 2015] [authnz_ldap:debug] [pid 20648] mod_authnz_ldap.c(539): [client 172.16.250.250:49559] AH01694: auth_ldap authenticate: user TESTUSER authentication failed; URI / [LDAP: ldap_simple_bind() failed][Can't contact LDAP server] (not authoritative)
  [Wed Oct 21 12:12:56.219454 2015] [auth_basic:error] [pid 20648] [client 172.16.250.250:49559] AH01618: user TESTUSER not found: /
  [Wed Oct 21 12:12:56.219469 2015] [core:trace3] [pid 20648] request.c(119): [client 172.16.250.250:49559] auth phase 'check user' gave status 401: /
  [Wed Oct 21 12:12:56.219530 2015] [http:trace3] [pid 20648] http_filters.c(992): [client 172.16.250.250:49559] Response sent with status 401, headers:
  [Wed Oct 21 12:12:56.219532 2015] [http:trace5] [pid 20648] http_filters.c(999): [client 172.16.250.250:49559]   Date: Wed, 21 Oct 2015 19:12:56 GMT
  [Wed Oct 21 12:12:56.219534 2015] [http:trace5] [pid 20648] http_filters.c(1002): [client 172.16.250.250:49559]   Server: Apache/2.4.6 (CentOS)
  [Wed Oct 21 12:12:56.219536 2015] [http:trace4] [pid 20648] http_filters.c(835): [client 172.16.250.250:49559]   WWW-Authenticate: Basic realm=\\”login\\”
  [Wed Oct 21 12:12:56.219538 2015] [http:trace4] [pid 20648] http_filters.c(835): [client 172.16.250.250:49559]   Content-Length: 381
  [Wed Oct 21 12:12:56.219540 2015] [http:trace4] [pid 20648] http_filters.c(835): [client 172.16.250.250:49559]   Keep-Alive: timeout=5, max=100
  [Wed Oct 21 12:12:56.219541 2015] [http:trace4] [pid 20648] http_filters.c(835): [client 172.16.250.250:49559]   Connection: Keep-Alive
  [Wed Oct 21 12:12:56.219542 2015] [http:trace4] [pid 20648] http_filters.c(835): [client 172.16.250.250:49559]   Content-Type: text/html; charset=iso-8859-1
  </code></pre>
  
  <p>I can do ldapsearch with these credentials and it returns user objects from our DC, so the credentials are correct. I ran Wireshark on the DC. It never saw any LDAP packets from this web server. I ran tcpdump on the web server and it never sent any LDAP packets when I attempted to auth...</p>
  
  <p>We got AD auth via PHP working in like 10 minutes, but I had previously been working on this for days...so sure, it auth works now, but I want to know why mod_ldap and mod_authnz_ldap aren't working...or...what isn't working.</p>
  
  <p>Also, I'm kinda new with Apache...so the problem is more than likely something I'm misunderstanding.</p>
  
  <p>Thanks in advance.</p>
  
  <p><strong>UPDATE</strong>: Apparently it works just fine in Debian. (Apache 2.2.22, bu still) <strong><em>sigh</em></strong></p>