Difference between mod_authn_ldap and mod_authz_ldap

Question

What is the difference between the mod_authnz_ldap and mod_authz_ldap loadable modules for the Apache web server?

Answer 1

There is no such thing called mod_authn_ldap. There is only mod_authnz_ldap.

In versions of Apache before Apache2.2, the modules for "Access Control" were all called 'mod_authsomething'.

Apache 2.2 split the Auth* modules into modules which would keep authentication and authorization separate. See the Apache documentation, Authentication, Authorization and Access Control for a summary.

• A mod_authn_* module will provide Authentication services (Hence the name 'authn')
• A mod_authz_* module will provide Authorization services (Hence the name 'authz')
• A mod_authnz_* module will provide both Authentication and Authorization.

mod_authnz_ldap is one of the few modules which provides both Authorization and Authentication. This can be confusing and can be a hassle when trying to integrate with other services.

It is very important to learn and understand the difference between Authentication vs. Authorization, especially with respect to security of LDAP, Apache webserver, PAM, etc.

• Authentication determines that you are who you claim to be.
• Authorization determines if you have the right to do something.

Answer 2

From memory these were the modules that handled the LDAP password checking and group membership checking functions, that were combined into mod_authnz_ldap. The authn module performed authentication (is the user valid?) and authz checked authorisation (is the user permitted to access this?). My memory could be fuzzy here though.