This Apache LDAP authentication/authorization module has additional support for using client certificates for authentication by using name mapping attributes.

Special features:
1.Map the short form of the distinguished name of a certificate and its issuer obtained from the environment of mod_ssl to a user distinguished name in an LDAP directory.
2.Check the age of a password in an LDAP directory, denying authorization in case the password is to old.
3.Authorize a user based on roles or an arbitrary LDAP filter expression.
4.Authorize a user based on whether he owns a file or belongs to the group owning a file.

The module also tries to do reduce LDAP connection overhead by caching a connection between requests (one per server record).

mod_authz_ldap uses some functions from libraries that are only available on Unix systems, it will most probably not work on a Win32 system. There are no plans to fix this problem.

This module is supported by the authzldap@lists.othello.ch list.