Millard's Corner

We just finished upgrading our installation of CONTENTdm to version 4.2 (now that 4.3 is just around the corner) and decided to change the way we did administrative access. It’s not difficult or brain surgery, but here’s the procedure in case anyone else wants an easy step-by-step.

Prior to the upgrade, we had just created usernames and passwords and protected the administrative interface pages with a standard htaccess file. We had a couple of accounts created, but basically everyone used the ADMIN username and password. That meant distributing the password around and letting everyone know when that password changed. We also had a student account that we were forced to change the password for everytime a student employee graduated.

So, with the upgrade, we decided to switch over to authenticating against the University’s ldap server instead. This way, everyone would use their campus password and we just restrict access on username.

According to the CONTENTdm faq:

Does CONTENTdm support authentication via LDAP?
CONTENTdm relies on the underlying Web server for authentication services. The Apache LDAP authentication module enables authentication via LDAP. Consult the Apache/LDAP documentation for details.

Here’s how to do it on Apache2 Running on Debian Stable (etch)

1. Enable mod_ldap and mod_authnz_ldap

   a2enmod ldap
   a2enmod authnz_ldap

2. Create a new .htaccess file in /content42_install_directory/cgi-bin/admin/ that looks like this (customized with your ldap server URL):
   
AuthType Basic
AuthName "Server Admin"
AuthBasicProvider ldap
AuthLDAPURL "ldap://ldapserver/ou=users,o=mu"
AuthzLDAPAuthoritative off
Require valid-user


3. Make sure /contentdm_install_directory/conf/users.txt has a line with full admin privileges for your ldap username

   admin_username AC DC UP:$ALL BD ED AR DL CF RE

4. Now, force restart your Apache2 server
   /etc/init.d/apache2 force-restart

5. That’s it. Login and see if it works. If it does, you can add more admin or whatever users using the admin interface

UPDATE: If you want to allow LDAP authentication AS WELL as some non-LDAP usernames (like general purpose users, outside collaborators etc) Add this line to your .htaccess file

AuthUserFile = /path/to/htpasswdfile

and change the line that reads:

AuthBasicProvider ldap