SLES15中Apache 2.4 Kerberos认证后LDAP组授权失败求助

问题背景 #

在SLES15机器上配置的Apache 2.4 Kerberos认证功能正常，但LDAP组授权无法生效，关键信息如下：

• Kerberos票据中的用户主体为 myuser@MY.COMPANY.COM
• LDAP目录中无MY.COMPANY.COM域，用户sAMAccountName仅为myuser，UPN为myuser@DIFFERENT.REALM

当前Apache配置 #

<Directory "/srv/www/htdocs/protected">
    Options FollowSymLinks SymLinksIfOwnerMatch
    LogLevel debug
    AuthType Kerberos
    AuthName "Kerberos Login"
    KrbMethodNegotiate On
    KrbMethodK5Passwd Off
    KrbAuthRealms MY.COMPANY.COM
    Krb5KeyTab /etc/apache2/keytab/my.keytab
    KrbSaveCredentials Off
    AuthLDAPRemoteUserAttribute sAMAccountName
    AuthLDAPCompareAsUser on
    AuthLDAPUrl "ldap://myldapserver/OU=Users,OU=Company,DC=company,DC=com?sAMAccountName?sub?(objectClass=*)"
    AuthLDAPBindDN "CN=binduser,CN=Users,DC=company,DC=com"
    AuthLDAPBindPassword "password"
    AuthUserFile /dev/null
    Require ldap-filter "(&(objectClass=user)(sAMAccountName=myuser)(memberOf=CN=MyGroup,CN=Users,DC=company,DC=com))"
</Directory>

调试日志 #

[Wed Dec 27 17:09:03.539584 2023] [authnz_ldap:debug] [pid 55004] mod_authnz_ldap.c(1331): [client 10.200.xxx.xxx:14134] AH01741: auth_ldap authorise: User DN not found with filter (&(objectClass=*)(sAMAccountName=myuser@MY.COMPANY.COM)): User not found
[Wed Dec 27 17:09:03.539588 2023] [authz_core:debug] [pid 55004] mod_authz_core.c(818): [client 10.200.xxx.xxx:14134] AH01626: authorization result of Require ldap-filter "(&(objectClass=user)(sAMAccountName=myuser)(memberOf=CN=mygroup,CN=Users,DC=company,DC=com))": denied

已尝试的排查动作 #

• 编写Python程序测试LDAP过滤器，确认过滤器能正常匹配到目标用户
• 修改LDAP过滤器、调整AuthLDAPUrl配置，但授权失败问题仍未解决

内容的提问来源于stack exchange，提问作者Marco