Apache 2.4.29（Windows Server 2012 R2）反向代理LDAP验证客户端证书CN问题

Hey there! Let's work through this LDAP validation issue you're hitting with your Apache reverse proxy. Since you already have mutual SSL authentication up and running (and your C# client connects successfully), the problem is almost certainly in how you're tying the client certificate's CN to your LDAP directory. Here's a step-by-step breakdown to fix this:

1. Confirm Required Apache Modules Are Loaded #

First, make sure all the necessary modules are enabled in your httpd.conf file. You'll need these for SSL, reverse proxy, and LDAP authentication:

LoadModule ssl_module modules/mod_ssl.so
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule auth_basic_module modules/mod_auth_basic.so
LoadModule headers_module modules/mod_headers.so

Restart Apache after making any changes to the module list.

2. Update Your Reverse Proxy Location Configuration #

Modify your <Location> block for the SOAP endpoint to include LDAP validation tied to the client cert's CN. Here's a tailored example (adjust values to match your environment):

<Location /your-soap-service-path>
    # Existing mutual SSL config (keep this intact)
    SSLVerifyClient require
    SSLVerifyDepth 10
    SSLCACertificateFile "conf/your-ca-cert.crt"
    SSLCertificateFile "conf/server-cert.crt"
    SSLCertificateKeyFile "conf/server-key.key"

    # LDAP Validation Setup
    AuthType Basic
    AuthName "LDAP Authentication Required"
    AuthBasicProvider ldap
    
    # LDAP URL: Adjust base DN, attribute, and filter to match your directory
    # Example for Active Directory: maps client cert CN to sAMAccountName
    AuthLDAPURL "ldap://your-ldap-server:389/DC=your-domain,DC=local?sAMAccountName?sub?(objectClass=user)"
    
    # Bind credentials for Apache to query LDAP (use a service account with read access)
    AuthLDAPBindDN "CN=LDAP Bind User,OU=Service Accounts,DC=your-domain,DC=local"
    AuthLDAPBindPassword "your-bind-user-password"
    
    # Critical: Use the client cert's CN as the username for LDAP lookup
    RequestHeader set X-Client-CN "%{SSL_CLIENT_S_DN_CN}s"
    AuthLDAPRemoteUserAttribute sAMAccountName
    AuthLDAPRemoteUserIsDN off
    
    # Require a valid LDAP user match
    Require valid-user

    # Reverse proxy settings (keep your existing config here)
    ProxyPass http://your-backend-soap-server/endpoint-path
    ProxyPassReverse http://your-backend-soap-server/endpoint-path
</Location>

Key notes here:

• AuthLDAPURL: The attribute (second part after base DN) should match what you're comparing the client CN to. If your LDAP uses cn instead of sAMAccountName, swap that out.
• SSL_CLIENT_S_DN_CN: This Apache variable extracts the CN directly from the client's SSL certificate—this is how you bridge the cert to LDAP.

3. Troubleshoot Common Issues #

If it's still not working, check these common pain points:

• LDAP Connection Permissions: Ensure the Apache service account (on Windows Server 2012 R2, this is often Local System or a custom service account) has permission to query your LDAP directory. Test the bind credentials using Windows' built-in ldp.exe tool to confirm you can search for users.
• CN-to-LDAP Attribute Match: Verify the client cert's CN exactly matches the attribute in LDAP (e.g., if the cert CN is "JaneSmith", make sure the LDAP sAMAccountName or cn is identical—watch for extra spaces or capitalization differences).
• Apache Logs: Check the error.log and access.log in your Apache logs directory for LDAP-specific errors. Look for lines like auth_ldap authenticate: user [CN value] not found in LDAP or LDAP bind failed—these will tell you exactly where the breakdown is.
• LDAP URL Syntax: Double-check the base DN, port, and filter in your AuthLDAPURL. A typo here (like a missing DC= or wrong port) will break the lookup.

4. Test the Flow #

Once you've adjusted the config:

1. Restart Apache to apply changes.
2. Use your C# client to send a request.
3. Check Apache's logs to see if the LDAP lookup succeeds.
4. If the request goes through, you've got the validation working!

内容的提问来源于stack exchange，提问作者user3216145