I have the following entry in my http.conf:

#-------------
<Location /newkr>
SSLVerifyClient require
SSLVerifyDepth 1
AuthName SOME
AuthType Basic
AuthBasicProvider ldap
AuthUserFile nul
AuthLDAPUrl "ldap://ldap.bla.com/ou=People, o=bla.com" TLS
AuthzLDAPAuthoritative off
require valid-user
</Location>
#------------------

The authentication works fine, BUT the browser (IE7) prompts for the
user name and password with the following warning:

Warning: This server is requesting that your username and password be
sent in an insecure manner (basic authentication without a secure
connection).

It looks like then traffic between the browser and Apache is not
encrypted and the password can be intercepted.

Any idea how to configure to prevent this? The apache doc only says: use
SSL, but how?

[ Post a follow-up to this message ]

On Thu, 26 Jul 2007 09:17:59 -0700, Yuri Shtil <yshtil@cisco.com>
wrote:

AuthType Basic seems to be the issue here,
since it is not encrypted and the server tells you so.
Look at
http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html
Which I think covers your issue.

[ Post a follow-up to this message ]