general/6744: REMOTE_USER no longer defined when user attempts to authenticate into a realm

[Joon Lee <jo...@xinet.com>]

>Number:         6744
>Category:       general
>Synopsis:       REMOTE_USER no longer defined when user attempts to authenticate into a realm
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Wed Oct 25 08:30:00 PDT 2000
>Closed-Date:
>Last-Modified:
>Originator:     joon@xinet.com
>Release:        1.3.14
>Organization:
apache
>Environment:
Win32: Occurs on both NT 4 SP6, and Win2k SP1 (Have not tested in UN*X)
Installed the binary release off the web site.
>Description:
This is change from 1.3.12.

Some of our CGI's depend on being able to determine the name of the user attempting to log in to a realm defined in the conf file. (We do some of our own authentication) 

Previously, we could call: getenv("REMOTE_USER") to determine the name of the user. but since installing 1.3.14 the value returned is NULL.

Feature? 
>How-To-Repeat:
The following defines the Realm in the conf file:

# WebNative cgi directory
<Directory C:\PROGRA~1\Xinet\WEBNAT~1\bin>
AllowOverride None
AuthType Basic
AuthName WebNative
require valid-user
AuthUserFile C:\PROGRA~1\Xinet\WEBNAT~1\Admin\apache.userfile
Options ExecCGI
</Directory>

When the user attempts to access a file in the directory the browser's authentication dialog comes up and the user types in the name and password.

The cgi used to be able to extract the user name from the REMOTE_USER variable but not after installing 1.3.14.
>Fix:
What changed between 1.3.12 & 1.3.14?
>Release-Note:
>Audit-Trail:
>Unformatted:
 [In order for any reply to be added to the PR database, you need]
 [to include <ap...@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]
 
 

RE: general/6744: REMOTE_USER no longer defined when user attempts to authenticate into a realm

["William A. Rowe, Jr." <wr...@rowe-clan.net>]

Are you using isapi or cgi?  Please clarify, as this is a 
crucial distinction, as mod_isapi was radically overhauled.

> >Number:         6744
> >Category:       general
> >Synopsis:       REMOTE_USER no longer defined when user 
> attempts to authenticate into a realm
> >Confidential:   no
> >Severity:       serious
> >Priority:       medium
> >Responsible:    apache
> >State:          open
> >Quarter:        
> >Keywords:       
> >Date-Required:
> >Class:          sw-bug
> >Submitter-Id:   apache
> >Arrival-Date:   Wed Oct 25 08:30:00 PDT 2000
> >Closed-Date:
> >Last-Modified:
> >Originator:     joon@xinet.com
> >Release:        1.3.14
> >Organization:
> apache
> >Environment:
> Win32: Occurs on both NT 4 SP6, and Win2k SP1 (Have not 
> tested in UN*X)
> Installed the binary release off the web site.
> >Description:
> This is change from 1.3.12.
> 
> Some of our CGI's depend on being able to determine the name 
> of the user attempting to log in to a realm defined in the 
> conf file. (We do some of our own authentication) 
> 
> Previously, we could call: getenv("REMOTE_USER") to determine 
> the name of the user. but since installing 1.3.14 the value 
> returned is NULL.
> 
> Feature? 
> >How-To-Repeat:
> The following defines the Realm in the conf file:
> 
> # WebNative cgi directory
> <Directory C:\PROGRA~1\Xinet\WEBNAT~1\bin>
> AllowOverride None
> AuthType Basic
> AuthName WebNative
> require valid-user
> AuthUserFile C:\PROGRA~1\Xinet\WEBNAT~1\Admin\apache.userfile
> Options ExecCGI
> </Directory>
> 
> When the user attempts to access a file in the directory the 
> browser's authentication dialog comes up and the user types 
> in the name and password.
> 
> The cgi used to be able to extract the user name from the 
> REMOTE_USER variable but not after installing 1.3.14.
> >Fix:
> What changed between 1.3.12 & 1.3.14?