diff --git a/docs/manual/expr.html.en b/docs/manual/expr.html.en

index 5c3ae45..8bd941a 100644

--- a/docs/manual/expr.html.en

+++ b/docs/manual/expr.html.en

@@ -46,7 +46,7 @@

 
 Other

 
 Comparison with SSLRequire

 
 Version History

-
See also
<If>
<ElseIf>
<Else>
AuthBasicFake
AuthFormLoginRequiredLocation
AuthFormLoginSuccessLocation
AuthFormLogoutLocation
RewriteCond
SetEnvIfExpr
Header
RequestHeader
FilterProvider
Require expr
SSLRequire
LogMessage
mod_include
Comments

+
See also
<If>
<ElseIf>
<Else>
AuthBasicFake
AuthFormLoginRequiredLocation
AuthFormLoginSuccessLocation
AuthFormLogoutLocation
RewriteCond
SetEnvIfExpr
Header
RequestHeader
FilterProvider
Require expr
Require ldap-user
Require ldap-group
Require ldap-dn
Require ldap-attribute
Require ldap-filter
SSLRequire
LogMessage
mod_include
Comments

 
Grammar in Backus-Naur Form notation

diff --git a/docs/manual/mod/mod_authnz_ldap.html.en b/docs/manual/mod/mod_authnz_ldap.html.en

index 7199052..c86dc8a 100644

--- a/docs/manual/mod/mod_authnz_ldap.html.en

+++ b/docs/manual/mod/mod_authnz_ldap.html.en

@@ -350,6 +350,9 @@ for HTTP Basic authentication.

     ldap-filter.  Other authorization types may also be

     used but may require that additional authorization modules be loaded.

+    
Since v2.5.0, expressions are supported

+    within the LDAP require directives.

+

 
Require ldap-user

     
The Require ldap-user directive specifies what

@@ -576,6 +579,16 @@ Require ldap-group cn=Administrators, o=Example

+        Grant access to anybody in the group whose name matches the

+        hostname of the virtual host. In this example an

+        expression is used to build the filter.

+<highlight language="config">

+AuthLDAPURL ldap://ldap.example.com/o=Example?uid

+Require ldap-group cn=%{SERVER_NAME}, o=Example

+</highlight>

+      

+

+      

         The next example assumes that everyone at Example who

         carries an alphanumeric pager will have an LDAP attribute

         of qpagePagerID. The example will grant access

diff --git a/modules/aaa/mod_authnz_ldap.c b/modules/aaa/mod_authnz_ldap.c

index 2c25dbc..063debe 100644

--- a/modules/aaa/mod_authnz_ldap.c

+++ b/modules/aaa/mod_authnz_ldap.c

@@ -607,6 +607,10 @@ static authz_status ldapuser_check_authorization(request_rec *r,

     util_ldap_connection_t *ldc = NULL;

+    const char *err = NULL;

+    const ap_expr_info_t *expr = parsed_require_args;

+    const char *require;

+

     const char *t;

     char *w;

@@ -680,11 +684,19 @@ static authz_status ldapuser_check_authorization(request_rec *r,

         return AUTHZ_DENIED;

     }

+    require = ap_expr_str_exec(r, expr, &err;;

+    if (err) {

+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02585)

+                      "auth_ldap authorize: require user: Can't evaluate expression: %s",

+                      err);

+        return AUTHZ_DENIED;

+    }

+

     /*

      * First do a whole-line compare, in case it's something like

      *   require user Babs Jensen

      */

-    result = util_ldap_cache_compare(r, ldc, sec->url, req->dn, sec->attribute, require_args);

+    result = util_ldap_cache_compare(r, ldc, sec->url, req->dn, sec->attribute, require);

     switch(result) {

         case LDAP_COMPARE_TRUE: {

             ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01703)

@@ -704,7 +716,7 @@ static authz_status ldapuser_check_authorization(request_rec *r,

     /*

      * Now break apart the line and compare each word on it

      */

-    t = require_args;

+    t = require;

     while ((w = ap_getword_conf(r->pool, &t)) && w[0]) {

         result = util_ldap_cache_compare(r, ldc, sec->url, req->dn, sec->attribute, w);

         switch(result) {

@@ -744,6 +756,10 @@ static authz_status ldapgroup_check_authorization(request_rec *r,

     util_ldap_connection_t *ldc = NULL;

+    const char *err = NULL;

+    const ap_expr_info_t *expr = parsed_require_args;

+    const char *require;

+

     const char *t;

     char filtbuf[FILTER_LENGTH];

@@ -863,7 +879,15 @@ static authz_status ldapgroup_check_authorization(request_rec *r,

         }

     }

-    t = require_args;

+    require = ap_expr_str_exec(r, expr, &err;;

+    if (err) {

+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02586)

+                      "auth_ldap authorize: require group: Can't evaluate expression: %s",

+                      err);

+        return AUTHZ_DENIED;

+    }

+

+    t = require;

     ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01713)

                   "auth_ldap authorize: require group: testing for group "

@@ -959,6 +983,10 @@ static authz_status ldapdn_check_authorization(request_rec *r,

     util_ldap_connection_t *ldc = NULL;

+    const char *err = NULL;

+    const ap_expr_info_t *expr = parsed_require_args;

+    const char *require;

+

     const char *t;

     char filtbuf[FILTER_LENGTH];

@@ -1021,7 +1049,15 @@ static authz_status ldapdn_check_authorization(request_rec *r,

         req->user = r->user;

     }

-    t = require_args;

+    require = ap_expr_str_exec(r, expr, &err;;

+    if (err) {

+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02587)

+                      "auth_ldap authorize: require dn: Can't evaluate expression: %s",

+                      err);

+        return AUTHZ_DENIED;

+    }

+

+    t = require;

     if (req->dn == NULL || strlen(req->dn) == 0) {

         ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01725)

@@ -1068,6 +1104,10 @@ static authz_status ldapattribute_check_authorization(request_rec *r,

     util_ldap_connection_t *ldc = NULL;

+    const char *err = NULL;

+    const ap_expr_info_t *expr = parsed_require_args;

+    const char *require;

+

     const char *t;

     char *w, *value;

@@ -1138,7 +1178,16 @@ static authz_status ldapattribute_check_authorization(request_rec *r,

         return AUTHZ_DENIED;

     }

-    t = require_args;

+    require = ap_expr_str_exec(r, expr, &err;;

+    if (err) {

+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02588)

+                      "auth_ldap authorize: require ldap-attribute: Can't "

+                      "evaluate expression: %s", err);

+        return AUTHZ_DENIED;

+    }

+

+    t = require;

+

     while (t[0]) {

         w = ap_getword(r->pool, &t, '=');

         value = ap_getword_conf(r->pool, &t);

@@ -1183,6 +1232,11 @@ static authz_status ldapfilter_check_authorization(request_rec *r,

         (authn_ldap_config_t *)ap_get_module_config(r->per_dir_config, &authnz_ldap_module);

     util_ldap_connection_t *ldc = NULL;

+

+    const char *err = NULL;

+    const ap_expr_info_t *expr = parsed_require_args;

+    const char *require;

+

     const char *t;

     char filtbuf[FILTER_LENGTH];

@@ -1252,7 +1306,15 @@ static authz_status ldapfilter_check_authorization(request_rec *r,

         return AUTHZ_DENIED;

     }

-    t = require_args;

+    require = ap_expr_str_exec(r, expr, &err;;

+    if (err) {

+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02589)

+                      "auth_ldap authorize: require ldap-filter: Can't "

+                      "evaluate require expression: %s", err);

+        return AUTHZ_DENIED;

+    }

+

+    t = require;

     if (t[0]) {

         ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01743)

@@ -1311,6 +1373,25 @@ static authz_status ldapfilter_check_authorization(request_rec *r,

     return AUTHZ_DENIED;

 }

+static const char *ldap_parse_config(cmd_parms *cmd, const char *require_line,

+                                     const void **parsed_require_line)

+{

+    const char *expr_err = NULL;

+    ap_expr_info_t *expr;

+

+    expr = ap_expr_parse_cmd(cmd, require_line, AP_EXPR_FLAG_STRING_RESULT,

+            &expr_err, NULL);

+

+    if (expr_err)

+        return apr_pstrcat(cmd->temp_pool,

+                           "Cannot parse expression in require line: ",

+                           expr_err, NULL);

+

+    *parsed_require_line = expr;

+

+    return NULL;

+}

+

 /*

  * Use the ldap url parsing routines to break up the ldap url into

@@ -1769,30 +1850,30 @@ static const authn_provider authn_ldap_provider =

 static const authz_provider authz_ldapuser_provider =

 {

     &ldapuser_check_authorization,

-    NULL,

+    &ldap_parse_config,

 };

 static const authz_provider authz_ldapgroup_provider =

 {

     &ldapgroup_check_authorization,

-    NULL,

+    &ldap_parse_config,

 };

 static const authz_provider authz_ldapdn_provider =

 {

     &ldapdn_check_authorization,

-    NULL,

+    &ldap_parse_config,

 };

 static const authz_provider authz_ldapattribute_provider =

 {

     &ldapattribute_check_authorization,

-    NULL,

+    &ldap_parse_config,

 };

 static const authz_provider authz_ldapfilter_provider =

 {

     &ldapfilter_check_authorization,

-    NULL,

+    &ldap_parse_config,

 };

 static void ImportULDAPOptFn(void)