You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Graham Leggett <mi...@sharp.fm> on 2003/01/17 08:59:29 UTC
authz / authn and mod_auth_ldap
Hi all,
If I were to change mod_auth_ldap to use the new authz/authn system in
v2.1, I have to split mod_auth_ldap into mod_authn_ldap (the
is-password-correct part) and mod_authz_ldap (group-membership part). Am
I correct?
Regards,
Graham
--
-----------------------------------------
minfrin@sharp.fm "There's a moon
over Bourbon Street
tonight..."
Re: authz / authn and mod_auth_ldap
Posted by Estrade Matthieu <es...@ifrance.com>.
Will it be the same for user, or will he had to add more modules when
he will compile his apache ?
I understand it will be the same when he will setup the authentication,
the Directives will be the same, but if the user forget to compile
authn, maybe i will not understand why some directives are working and
not the others.
I understand too it's better to split the code, it will be easier to
read, so good for all developper like me who are coding apache modules.
but the documentation must be uptodate with the split.
Last month, i wanted to setup an ldap authentication, i spent many times
to understand the gap between now and 3 month before when my setup was
working. The auth changed, i had to use basic auth modules instead of
before...
And i took hours to find a directive, to let auth_basic make the
password go to auth_ldap, the directive wasn't on the mod_ldap
documentation, and was lost in the auth_basic help....
So splitting the modules is maybe a good idea, but the right
documentation must folow...
Regards,
Matthieu
Graham Leggett wrote:
> Estrade Matthieu wrote:
>
>> I read the discussion for few messages, i am not an apache
>> developper, so i will speak as a user. IMHO, Splitting into two
>> modules will make auth more complex. actually, it's not really easy
>> to setup, and the documentation is not always up to date.
>
>
> The configuration for users will remain exactly the same as it is now,
> so I don't believe a split will make it any harder for users. It will
> however make the code a lot simpler to read, and hopefully more stable
> as a result.
>
> Regards,
> Graham
_____________________________________________________________________
GRAND JEU SMS : Pour gagner un NOKIA 7650, envoyez le mot IF au 61321
(prix d'un SMS + 0.35 euro). Un SMS vous dira si vous avez gagn�.
R�glement : http://www.ifrance.com/_reloc/sign.sms
Re: authz / authn and mod_auth_ldap
Posted by Graham Leggett <mi...@sharp.fm>.
Estrade Matthieu wrote:
> I read the discussion for few messages, i am not an apache developper,
> so i will speak as a user. IMHO, Splitting into two modules will make
> auth more complex. actually, it's not really easy to setup, and the
> documentation is not always up to date.
The configuration for users will remain exactly the same as it is now,
so I don't believe a split will make it any harder for users. It will
however make the code a lot simpler to read, and hopefully more stable
as a result.
Regards,
Graham
--
-----------------------------------------
minfrin@sharp.fm "There's a moon
over Bourbon Street
tonight..."
Re: authz / authn and mod_auth_ldap
Posted by Estrade Matthieu <es...@ifrance.com>.
Hi,
I read the discussion for few messages, i am not an apache developper,
so i will speak as a user. IMHO, Splitting into two modules will make
auth more complex. actually, it's not really easy to setup, and the
documentation is not always up to date.
regards
Matthieu
Bill Stoddard wrote:
> Graham Leggett wrote:
>
>> Justin Erenkrantz wrote:
>>
>>> No, you don't *have* to split them into different modules. One
>>> module could register for both authn/authz providers. The only
>>> reason we split was because their wasn't a lot of shared code
>>> between the other auth modules. I think mod_auth_ldap has a lot of
>>> shared code in its authn/authz split.
>>
>>
>>
>> All (or most) of the shared code is in mod_ldap already. It should be
>> relatively easy to split mod_auth_ldap into mod_authn_ldap and
>> mod_authz_ldap.
>
>
> Why would we want to split the module into two pieces? What benefit
> to users does it provide and do those benefits (whatever they are)
> outweigh the additional complexity of knowing when/whether you need to
> load each piece?
>
> Bill
>
>
> _____________________________________________________________________
> Envie de discuter en "live" avec vos amis ? Télécharger MSN Messenger
> http://www.ifrance.com/_reloc/m la 1ère messagerie instantanée de France
>
_____________________________________________________________________
GRAND JEU SMS : Pour gagner un NOKIA 7650, envoyez le mot IF au 61321
(prix d'un SMS + 0.35 euro). Un SMS vous dira si vous avez gagné.
Règlement : http://www.ifrance.com/_reloc/sign.sms
Open and read a file...
Posted by fabio rohrich <ro...@yahoo.it>.
HI all,
I have to open the requested file and manipulate the
html code (apache 1.3.x)
SO. I open the file with ap_pfopen.
Somebody knows how I can get a string (I want to check
each line). I can do it with the UNix function read()
but it doesn't sound me good. (I get the fd of the
file and after I pass it to the read () ).
So, to catch each line (and parsing each word in the
line)(I mean till the new line) in the file and to
save it in a buffer, which is the best function?
Thanks!!
______________________________________________________________________
Mio Yahoo!: personalizza Yahoo! come piace a te
http://it.yahoo.com/mail_it/foot/?http://it.my.yahoo.com/
Re: authz / authn and mod_auth_ldap
Posted by Bill Stoddard <bi...@wstoddard.com>.
Graham Leggett wrote:
> Justin Erenkrantz wrote:
>
>> No, you don't *have* to split them into different modules. One
>> module could register for both authn/authz providers. The only
>> reason we split was because their wasn't a lot of shared code between
>> the other auth modules. I think mod_auth_ldap has a lot of shared
>> code in its authn/authz split.
>
>
> All (or most) of the shared code is in mod_ldap already. It should be
> relatively easy to split mod_auth_ldap into mod_authn_ldap and
> mod_authz_ldap.
Why would we want to split the module into two pieces? What benefit to
users does it provide and do those benefits (whatever they are) outweigh
the additional complexity of knowing when/whether you need to load each
piece?
Bill
Re: authz / authn and mod_auth_ldap
Posted by Dirk-Willem van Gulik <di...@webweaving.org>.
> All (or most) of the shared code is in mod_ldap already. It should be
> relatively easy to split mod_auth_ldap into mod_authn_ldap and
> mod_authz_ldap.
Perhaps we need to go into the terminilogy that modules which have no
handlers (except init, etc) or no directives are called something like
'lib_ldap' or libmod.
I would certainly split N and Z in the case of ldap; as I've seen useful
cases in the fields where one or the other was merged with other means;
such as RSA SecurID and 'fail over' static lists in case LDAP (or evil
things like fragile SideMinder) where down.
Dw.
Re: authz / authn and mod_auth_ldap
Posted by Graham Leggett <mi...@sharp.fm>.
Justin Erenkrantz wrote:
> No, you don't *have* to split them into different modules. One module
> could register for both authn/authz providers. The only reason we split
> was because their wasn't a lot of shared code between the other auth
> modules. I think mod_auth_ldap has a lot of shared code in its
> authn/authz split.
All (or most) of the shared code is in mod_ldap already. It should be
relatively easy to split mod_auth_ldap into mod_authn_ldap and
mod_authz_ldap.
Regards,
Graham
--
-----------------------------------------
minfrin@sharp.fm "There's a moon
over Bourbon Street
tonight..."
Re: authz / authn and mod_auth_ldap
Posted by Justin Erenkrantz <je...@apache.org>.
--On Friday, January 17, 2003 9:59 AM +0200 Graham Leggett
<mi...@sharp.fm> wrote:
> If I were to change mod_auth_ldap to use the new authz/authn system
> in v2.1, I have to split mod_auth_ldap into mod_authn_ldap (the
> is-password-correct part) and mod_authz_ldap (group-membership
> part). Am I correct?
No, you don't *have* to split them into different modules. One
module could register for both authn/authz providers. The only
reason we split was because their wasn't a lot of shared code between
the other auth modules. I think mod_auth_ldap has a lot of shared
code in its authn/authz split. Perhaps a mod_auth_ldap core module
that exports the basic LDAP functionality, then a mod_authn_ldap and
mod_authz_ldap module that does the direct auth code? I dunno. --
justin