HAPROXY with auth LDAP

[TJarriault]

Hi,
I need to add an LDAP authentication on my haproxy. Is it possible to do this instead basic auth ?

Many thanks,

Tony

[ciprian.craciun]

There was a similar question a few days ago. I’ll link to my reply:

LDAP as backend for BasicAuth (Userlist)

To my knowledge HAProxy doesn’t support LDAP (or any non-static configuration) backend for authentication. However, given that HAProxy does have support for Lua based fetches or actions, one could implement a simple web service that interacts with LDAP and exposes an HTTP-based API, and then from Lua one can interrogate this translator service. (In fact if you search for HAProxy + Lua + LDAP you might be lucky and find something already implemented.)

[TJarriault]

@ciprian.craciun

HAProxy + Lua + LDAP

Many thanks, that i find, it’s not user frendly to integrate LDAP authentification on haproxy.
damn…

an other question, if you know :
is it possible to catch status code 404 from the backend to do redirect to an URI for exemple ?
I try this with you success :
acl not_there status 404
http-request redirect code 301 location http://www.yahoo.fr/ if not_there

Regards,
tony

[ciprian.craciun]

@TJarriault

is it possible to catch status code 404 from the backend to do redirect to an URI for exemple ?
I try this with you success :
acl not_there status 404
http-request redirect code 301 location http://www.yahoo.fr/ if not_there

Yes, but you need to use http-response (instead of http-request), though as per documentation there are perhaps some limitations:
http://cbonte.github.io/haproxy-dconv/1.8/configuration.html#4.2-http-response

[TJarriault]

Hi,
When i tried, the solution you mentionned, with the sample bellow, i’ve got an error during restart

Error
Jul 3 07:25:03 ip-10-215-10-68 haproxy-systemd-wrapper: [ALERT] 183/072503 (9066) : parsing [/etc/haproxy/haproxy.cfg:62]: ‘http-response’ expects ‘allow’, ‘deny’, ‘redirect’, ‘add-header’, ‘del-header’, ‘set-header’, ‘replace-header’, ‘replace-value’, ‘set-nice’, ‘set-tos’, ‘set-mark’, ‘set-log-level’, ‘del-acl’, ‘add-acl’, ‘del-map’, ‘set-map’, but got ‘redirect’.
Jul 3 07:25:03 ip-10-215-10-68 haproxy-systemd-wrapper: [ALERT] 183/072503 (9066) : Error(s) found in configuration file : /etc/haproxy/haproxy.cfg

Config file

frontend http_front
bind *:80
stats uri /haproxy?stats
default_backend app

#---------------------------------------------------------------------
backend app
balance roundrobin
server app1 openspeedtest.com:80 check

acl not_there status 404
http-response redirect location http://www.yahoo.fr/ code 301 if not_there

[ciprian.craciun]

@TJarriault

When i tried, the solution you mentionned, with the sample bellow, i’ve got an error during restart

It might be that the http-response redirect syntax is slightly different for responses than requests. Try to fiddle with the various keywords (like removing code 301 and location).

[Tlams]

Hello,

It’s a bit late, but I use to work on this problem:
https://www.tlams.fr/articles/haproxy/LDAP_Auth.html

All comments to improve it are welcome.

Regards,
Tlams.

[Gaitonde]

Hi,
The link does not work anymore. Possible to share the updated link?
Thanks