proxy_ldap.conf.template

Listen ${LISTEN_PORT}

$([[ -v HTTPS_CERT_PEM ]] && { echo "
  LoadModule ssl_module         modules/mod_ssl.so
"; })

LoadModule ssl_module         modules/mod_ssl.so

LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule ldap_module        modules/mod_ldap.so

LoadModule proxy_module       modules/mod_proxy.so
LoadModule proxy_http_module  modules/mod_proxy_http.so

$([[ -v ENABLE_WEBSOCKET ]] && [[ "$ENABLE_WEBSOCKET" == "yes" ]] && { echo "
  LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
"; })

$([[ -v NO_VERIFY_SERVER_CERT ]] && { echo "
  LDAPVerifyServerCert Off
"; })

$([[ -v LDAPS_CACERT_PEM ]] && { echo "
  LDAPTrustedGlobalCert CA_BASE64 "/ldap_cacert.pem"
"; } || { echo "
  LDAPTrustedGlobalCert CA_BASE64 /etc/ssl/certs/ca-certificates.crt
 "; } )
$( [[ -v SOCACHE_TIMEOUT ]] && {
  echo "
    LoadModule authn_socache_module modules/mod_authn_socache.so
    LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
    AuthnCacheSOCache shmcb
    AuthnCacheEnable
  ";
})


LogLevel ${LOGLEVEL}
<VirtualHost *:${LISTEN_PORT}>
    ServerName ${SERVERNAME}
    
    $([[ -v HTTPS_CERT_PEM ]] && { echo "
      SSLEngine on
      SSLCertificateFile "/usr/local/apache2/conf/proxy_ldap.cert.pem"
      SSLCertificateKeyFile "/usr/local/apache2/conf/proxy_ldap.key.pem"
      SSLCompression off
      SSLProtocol All -SSLv2 -SSLv3
      SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
    "; })
    
    
    
    <Location />
      AuthName "${BASIC_AUTH_STRING}"
      
      # enable InitialBindAsUser and set InitialBindPattern if pattern given
      $([[ -v LDAP_BIND_USER_PATTERN ]] && { echo "
      AuthLDAPInitialBindAsUser on
      AuthLDAPCompareAsUser on
      AuthLDAPSearchAsUser on
      AuthLDAPInitialBindPattern ${LDAP_BIND_USER_PATTERN}
      "; })
      
      AuthType Basic
      $( if [[ -v SOCACHE_TIMEOUT ]]; then
        echo "
          AuthBasicProvider socache ldap
          AuthnCacheProvideFor ldap
          AuthnCacheTimeout $SOCACHE_TIMEOUT
        "
      else
        echo "
          AuthBasicProvider ldap
        "
      fi;)

      $([[ -v LDAP_BIND_DN ]] && { echo "
          AuthLDAPBindDN \"${LDAP_BIND_DN}\"
      ";} )

      $([[ -v LDAP_BIND_PASSWORD ]] && { echo "
          AuthLDAPBindPassword \"${LDAP_BIND_PASSWORD}\"
      "; })
      AuthLDAPURL "${LDAP_URI}"
      
      <RequireAll>
        ${REQUIRE_COND}
      </RequireAll>

#      HostnameLookups Off

      ProxyPreserveHost On
      ProxyPass "${PROXY_URI}"
      ProxyPassReverse "${PROXY_URI}"
      ${CUSTOM_APACHE_CONFIG}
    </Location>
</VirtualHost>