You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Ali Sakebi <al...@gmail.com> on 2008/07/05 02:45:13 UTC
[users@httpd] Programmatic Authorization Logic
Hi
Is there any way to provide apache http server with a piece of code
(Java or whatever) as authorization logic?
Regards,
Ali
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Programmatic Authorization Logic
Posted by Eric Covener <co...@gmail.com>.
On Fri, Jul 4, 2008 at 9:20 PM, Ali Sakebi <al...@gmail.com> wrote:
> Thanks for answer.
>
> mod_perl (*) is what I was looking for.
> But is there any Java-based solution like mod_perl available too?
The old mod_fastcgi allows you to run a fastcgi authenticator or
authorizer; you could run your logic in a java daemon.
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Programmatic Authorization Logic
Posted by André Warnier <aw...@ice-sa.com>.
Ali Sakebi wrote:
[...}
Just a thought : if you are going through Apache anyway, and are
thinking of using mod_perl anyway, can you not do both authentication
and authorization in Apache/mod_perl, before you forward to your webapp
(I presume under Tomcat) ?
mod_jk will forward the user authentication to Tomcat if you ask it
nicely. Or rather, it seems that mod_jk will pass it anyway, but Tomcat
by default disregards it and does it's own AAA. But you can tell it
otherwise :
See this :
http://tomcat.apache.org/tomcat-5.5-doc/config/ajp.html
and look for the attribute "tomcatAuthentication" of the <Connector>
element.
Note : Apache/mod_jk cannot pass a "role" to Tomcat, because there is no
such thing as a "role" really in Apache.
But if you create a PerlAuthenHandler, you could add a HTTP header to
the request, before passing it to Tomcat, and pick that header up in
your webapp (or a servlet filter) under Tomcat. The same for the
user-id by the way, so you could remove the AAA part entirely in Tomcat,
if that suits your schema.
André
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Programmatic Authorization Logic
Posted by Joshua Slive <jo...@slive.ca>.
On Sat, Jul 5, 2008 at 4:02 PM, Ali Sakebi <al...@gmail.com> wrote:
> Thanks a lot for helping.
>
> I'm developing a Java web-app and as a part of this web-app I need to
> let users to upload and share their files with some or all other
> users.
>
> Since these files are static contents I'm going to use Apache to serve
> them, but I still need to do AA before letting user to access files.
Another option for this kind of problem is the x-sendfile technique,
where you handle all requests (and therefore do all authorization)
through your own code, but pass off some response handling to apache's
default handler via a special output header:
http://tn123.ath.cx/mod_xsendfile/
Again, I've never used this myself.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Programmatic Authorization Logic
Posted by Ali Sakebi <al...@gmail.com>.
Thanks a lot for helping.
I'm developing a Java web-app and as a part of this web-app I need to
let users to upload and share their files with some or all other
users.
Since these files are static contents I'm going to use Apache to serve
them, but I still need to do AA before letting user to access files.
I'm planing to use CAS to integrate Apache authentication with ACEGI
(that I have used in my web-app).
For authorization, I think of delegating authorization to my Java
web-app via implementing an url that will return the result of
authorization and will be used by (probably) mod_perl to decide to
authorize or not:
.../bla/bla/bla/isAuthorized?userId=alis&file=doc.pdf
will return a page containing true or false.
Any idea?
Regards,
Ali
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Programmatic Authorization Logic
Posted by Joshua Slive <jo...@slive.ca>.
On Sat, Jul 5, 2008 at 8:08 AM, André Warnier <aw...@ice-sa.com> wrote:
> Ali Sakebi wrote:
>>
>> Thanks for answer.
>>
>> mod_perl (*) is what I was looking for.
>> But is there any Java-based solution like mod_perl available too?
>>
> Nothing simple that I know of.
There are also some modules available at http://modules.apache.org/
that allow you to use arbitrary programs. I'm thinking of
mod_auth_external, but I think there are others as well. I haven't
tried any of them.
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Programmatic Authorization Logic
Posted by André Warnier <aw...@ice-sa.com>.
Ali Sakebi wrote:
> Thanks for answer.
>
> mod_perl (*) is what I was looking for.
> But is there any Java-based solution like mod_perl available too?
>
Nothing simple that I know of.
Apart from C or Perl, which integrate directly into Apache, you would
have to create some external module which does what you want, and then
find a way to retrieve this information and pass it to Apache.
It would probably be relatively inefficient if this has to be done at
every call, and for every request you need to start an external process e.g.
Unless you want to write your own add-on module in C, I believe in this
case mod_perl is really what fits, because it will allow you to write
something that really integrates in the Apache logic at a deep level,
while being at a level of complexity below a C add-on module.
Question of taste of course.
But can you give us an idea of what kind of access
control/authentication/authorization you are looking for ? I mean for
instance based on which criteria ? I have written a few AAA modules
using mod_perl, and could at least give you an idea of how complex it
would be to do what you want. There are also a lot of mod_perl AAA
modules available, and since thy are open source, you can easily get an
existing one and modify it in function of your own needs.
Look also here e.g. :
http://cpan.uwinnipeg.ca/search?query=auth&mode=dist
No need to re-invent the wheel.
André
> Regards,
> Ali
>
>
> On Sat, Jul 5, 2008 at 4:27 AM, André Warnier <aw...@ice-sa.com> wrote:
>> Ali Sakebi wrote:
>>> Hi
>>>
>>> Is there any way to provide apache http server with a piece of code
>>> (Java or whatever) as authorization logic?
>> Yes, there are many many..
>>
>> I suggest that you first have a look at the existing Apache add-on modules,
>> they already provide many possibilities.
>> Check the on-line documentation at
>> http://httpd.apache.org/docs/2.2/mod/#A
>> (all the ones starting with mod_auth..)
>>
>> and if that does not cover your needs, I would suggest using mod_perl to
>> write your own. See
>> http://perl.apache.org/docs/2.0/user/handlers/http.html
>> (see PerlAccessHandler etc..)
>> and
>> http://perl.apache.org/docs/2.0/api/Apache2/Access.html
>>
>> and if that is still not what you are looking for, then give some more
>> details about what you would like to do, and maybe someone here could orient
>> you better.
>>
>> André
>>
>> ---------------------------------------------------------------------
>> The official User-To-User support forum of the Apache HTTP Server Project.
>> See <URL:http://httpd.apache.org/userslist.html> for more info.
>> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>> " from the digest: users-digest-unsubscribe@httpd.apache.org
>> For additional commands, e-mail: users-help@httpd.apache.org
>>
>>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Programmatic Authorization Logic
Posted by Ali Sakebi <al...@gmail.com>.
Thanks for answer.
mod_perl (*) is what I was looking for.
But is there any Java-based solution like mod_perl available too?
Regards,
Ali
On Sat, Jul 5, 2008 at 4:27 AM, André Warnier <aw...@ice-sa.com> wrote:
> Ali Sakebi wrote:
>>
>> Hi
>>
>> Is there any way to provide apache http server with a piece of code
>> (Java or whatever) as authorization logic?
>
> Yes, there are many many..
>
> I suggest that you first have a look at the existing Apache add-on modules,
> they already provide many possibilities.
> Check the on-line documentation at
> http://httpd.apache.org/docs/2.2/mod/#A
> (all the ones starting with mod_auth..)
>
> and if that does not cover your needs, I would suggest using mod_perl to
> write your own. See
> http://perl.apache.org/docs/2.0/user/handlers/http.html
> (see PerlAccessHandler etc..)
> and
> http://perl.apache.org/docs/2.0/api/Apache2/Access.html
>
> and if that is still not what you are looking for, then give some more
> details about what you would like to do, and maybe someone here could orient
> you better.
>
> André
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
Re: [users@httpd] Programmatic Authorization Logic
Posted by André Warnier <aw...@ice-sa.com>.
Ali Sakebi wrote:
> Hi
>
> Is there any way to provide apache http server with a piece of code
> (Java or whatever) as authorization logic?
Yes, there are many many..
I suggest that you first have a look at the existing Apache add-on
modules, they already provide many possibilities.
Check the on-line documentation at
http://httpd.apache.org/docs/2.2/mod/#A
(all the ones starting with mod_auth..)
and if that does not cover your needs, I would suggest using mod_perl to
write your own. See
http://perl.apache.org/docs/2.0/user/handlers/http.html
(see PerlAccessHandler etc..)
and
http://perl.apache.org/docs/2.0/api/Apache2/Access.html
and if that is still not what you are looking for, then give some more
details about what you would like to do, and maybe someone here could
orient you better.
André
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org