Skip to main content
S
SimonLucas1-Visitor
1-Visitor
August 18, 2015
Question

external access apache filter woes

  • August 18, 2015
  • 8 replies
  • 3655 views


Hi,

we are currently trying to set up external access to our main PLM server, and have a secondary apache server which will control access for external clients to the system.

As part of the apache config we are trying to limit login to a particular group in Windchill DS but are having trouble getting the correct format for this filter.

The filter would end up in the 'Apache\conf\extra\app-Windchill-Auth.conf' file and so far we have the filter looking like this:

AuthLDAPURL "ldap://<server name>:<port>/ou=xxx,cn=xxx,cn=xxx,o=ptc??sub?(isMemberOf=cn=xxx,cn=xxx,o=xxx,ou=xxx,cn=xxx,cn=xxx,o=ptc)”

With this apache appears to accept the login details but we just get a spinning circle and do not progress any further. There is nothing in the MS logs either to suggest if there is an issue or otherwise. If we just have the default filter of 'AuthLDAPURL "ldap://<server name>:<port>/ou=xxx,cn=xxx,cn=xxx,o=ptc' then anyone can log in OK, but we need to filter down to the group.

The main Windchill apache then authenticates against either corp Ldap or Windchill DS as appropriate.

Any suggestions?

Cheers

forgot to add we are on 10.1 M040

Message was edited by: Simon Lucas

8 replies

T
TomU23-Emerald IV
23-Emerald IV
August 18, 2015

Not sure how similar 10.1 is to 10.2 in this regard, but here is what I have on my 10.2 system (edited of course):

AuthLDAPURL "ldap://<server 1 name> <server 2 name>:<port>/dc=xx,dc=com?sAMAccountName?sub?(objectClass=user)(|(memberOf:1.2.840.113556.1.4.1941:=CN=<group_1_name>,CN=Users,DC=xx,DC=com)(memberOf:1.2.840.113556.1.4.1941:=CN=<group_2_name>,CN=Users,DC=xx,DC=com)(memberOf:1.2.840.113556.1.4.1941:=CN=<group_3_name>,CN=Users,DC=xx,DC=com))"

By the way, I never edit the app-Windchill-Auth.conf file directly.  Instead I updated the app-Windchill-AuthProvider.xml file and then propagate the changes using the "ant -f webAppConfig.xml regenAllWebApps" command.

B
BineshKumar12-Explorer
2-Explorer
August 18, 2015

I agree with Tom, It is a syntax error in the ldap provider file

<ldapUrl>ldap://myldapserver.mydomain.com:3268/OU=User,DC=mydomain,dc=com?sAMAccountName?sub?(memberOf=<DN of group>)(objectClass=user)</ldapUrl>

We do have similar configuration, but we use split DNS configuration to route all the external access to reverse proxy and local users directly to WC server. Reverse proxy is in DMZ and WC is not exposed to public internet

Thanks

Binesh Kumar

Barry Wehmiller

S
SimonLucas1-VisitorAuthor
1-Visitor
August 18, 2015

Hi,

this sounds similar to our setup (I am not the IT guy so most of that is above my head), but I do know we are using a reverse proxy in a DMZ. I believe it is the apache in this area that we are trying to set the filter for, and only to authenticate to Windchill DS before then allowing the user through to authenticate against windchill / corp ldap as normal if that makes sense?

So if checking against Windchill DS what would the sAMAccountName be?

Apologies if I am missing something obvious here, but this area really is all new to me - I normally only worry about business config .

Terms & ConditionsAccessibility statement