NAME

       Apache::AuthzNetLDAP - Apache-Perl module that enables you to authorize a user for Website
       based on LDAP attributes.

SYNOPSIS

         PerlSetVar BindDN "cn=Directory Manager"
         PerlSetVar BindPWD "password"
         PerlSetVar BaseDN "ou=people,o=unt.edu"
         PerlSetVar LDAPServer ldap.unt.edu
         PerlSetVar LDAPPort 389
         PerlSetVar UIDAttr uid
        #PerlSetVar UIDAttr mail

         PerlAuthenHandler Apache::AuthNetLDAP
         PerlAuthzHandler Apache::AuthzNetLDAP

         #require valid-user
         #require user mewilcox
         #require user mewilcox@venus.acs.unt.edu
         #require group "cn=Peoplebrowsers1,ou=UNTGroups,ou=People, o=unt.edu"
         #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=wilcox
         #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=smith
         #require ldap-url ldap://castor.acs.unt.edu/ou=people,o=unt.edu??sub?untcourse=
       untcoursenumber=1999CCOMM2040001,ou=courses,ou=acad,o=unt.edu

DESCRIPTION

       After you have authenticated a user (perhaps with Apache::AuthNetLDAP ;) you can use this
       module to determine whether they are authorized to access the Web resource under this
       modules control.

       You can control authorization via one of four methods. The first two are pretty standard,
       the second two are unique to LDAP.

       "require" options --

       user -> Will authorize access if the authenticated user's username.

       valid-user -> Will authorize any authenticated user.

       group -> Will authorize any authenticated user who is a member of the LDAP group specified
       by groupdn. This module supports groupOfMember, groupOfUniquemember and Netscape's dynamic
       group object classes.

       ldap-url -> This will authorize any authenticated user who matches the query specified in
       the given LDAP URL. This is enables users to get the flexibility of Netscape's dynamic
       groups, even if their LDAP server does not support such a capability.

CONFIGURATION NOTES

        It is important to note that this module must be used in conjunction with an authentication module. (...?
       Is this true?  I just thought, that you might want to only authorize a user, instead of authenticate...)
       If you are using an authentication module, then the following lines will not need to be duplicated:

         PerlSetVar BindDN "cn=Directory Manager"
         PerlSetVar BindPWD "password"
         PerlSetVar BaseDN "ou=people,o=unt.edu"
         PerlSetVar LDAPServer ldap.unt.edu
         PerlSetVar LDAPPort 389
         PerlSetVar UIDAttr uid
        #PerlSetVar UIDAttr mail

         PerlAuthenHandler Apache::AuthNetLDAP

       The following lines will not need to be duplicated if supported by the authentication
       module:

         #require valid-user
         #require user mewilcox
         #require user mewilcox@venus.acs.unt.edu
         #require group "cn=Peoplebrowsers1,ou=UNTGroups,ou=People, o=unt.edu"
         #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=wilcox
         #require ldap-url ldap://pandora.acs.unt.edu/o=unt.edu??sub?sn=smith
         #require ldap-url ldap://castor.acs.unt.edu/ou=people,o=unt.edu??sub?untcourse=

       Obviously, the ldap-url attribute is probably only support by this module.

       Check out the following link for options to load the module:

       http://perl.apache.org/docs/1.0/guide/config.html#The_Startup_File
       http://perl.apache.org/docs/2.0/user/config/config.html#Startup_File

AUTHOR

       Mark Wilcox mewilcox@unt.edu and Shannon Eric Peevey speeves@unt.edu

SEE ALSO

       perl(1).

WARRANTY Hey, I didn't destroy mankind when testing the module. You're mileage may vary.

       This module is distributed with the same license as Perl's.