You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Robert Landrum <rl...@aol.net> on 2002/06/28 21:15:18 UTC
Re: [OT] Optional HTTP Authentication ?
On Fri, Jun 28, 2002 at 06:42:16PM +0100, Jean-Michel Hiver wrote:
> Hi List,
>
> I would like apache to do the following:
>
> <location />
> # pseudo code, basically I want the authentication to happen only if the
> # user sent his credentials, otherwise continue as if nothing was there.
> IF browser sent user credentials
> authenticate
> if authentication is ok
> set $ENV{REMOTE_USER}
> </location>
>
> <location /login.html>
> # usual authentication stuff. The user HAS to authenticate when sent
> # here, i.e. sends a 401 authorization required if necessary.
> PerlAuthenHandler MKDoc::Apache::Auth::MySQL
> AuthName "Please enter your user credentials"
> AuthType Basic
> require valid-user
> </location>
>
This seems a little off topic. I think this is an architecture question, not
a mod perl question.
Basically, you want all you protected files to be located in /protected or
some other directory...
Everything else should be open to the public. When a user tries to access
/protected/whatever.html, they'll be required to enter a username and password,
or get redirected to an auth required page.
Rob
Re: [OT] Optional HTTP Authentication ?
Posted by Jean-Michel Hiver <jh...@mkdoc.com>.
> In one of the earlier stages of processing - maybe a FixupHandler or ? a
> AuthenHandler might be appropriate - you can do something like this:
>
> my $a = $r->header_in('Authorization');
> $a =~ s/^Basic (.*)/$1/;
> my( $user, $pass ) = split(':', decode_base64( $a ) );
>
> if( <check the username/password as you wish> ) {
> $ENV{REMOTE_USER} = $user;
> }
OK, I got this working using a fixup handler BUT there is a nasty trap.
It happens that the environment variables which you set from Perl aren't
inherited from sub-processes... which means that this technique is fine
if the script that comes after authentication runs under
Apache::Registry.
Unfortunately, I might need the script to run under mod_cgi... I
couldn't find how to tell the apache server to set environmental
variables in the mod_perl pocket reference, anyone has got an idea?
Cheers,
--
IT'S TIME FOR A DIFFERENT KIND OF WEB
================================================================
Jean-Michel Hiver - Software Director
jhiver@mkdoc.com
+44 (0)114 255 8097
================================================================
VISIT HTTP://WWW.MKDOC.COM
Re: [OT] Optional HTTP Authentication ?
Posted by Jean-Michel Hiver <jh...@mkdoc.com>.
> Oh, I don't know, I think the poster was asking about how to produce this
> effect with mod_perl. He wants to know *whether* a login was provided, even
> on a *non-protected* page. That would let you say (while serving any old
> page):
>
> if( $ENV{REMOTE_USER} eq 'admin' ) {
> $r->print('Yo, you can do <a href="/admin/">extra kewl stuff</a> here.');
> }
Yes, that is quite the case.
> In one of the earlier stages of processing - maybe a FixupHandler or ? a
> AuthenHandler might be appropriate - you can do something like this:
>
> my $a = $r->header_in('Authorization');
> $a =~ s/^Basic (.*)/$1/;
> my( $user, $pass ) = split(':', decode_base64( $a ) );
>
> if( <check the username/password as you wish> ) {
> $ENV{REMOTE_USER} = $user;
> }
>
> So, now you can tell later during the request with a username/password was
> offered (and you know it was a valid login/pass combo).
That's very interesting! I don't think I can use an auth handler because
then I would have to password protect the whole site (which I don't want
to).
I want to have just ONE page which is password protected (i.e.
/login.html). The page would just be a redirect, but once the user
entered his credentials then the browser should send them on the whole
site and then I could do the following:
/foo/properties.html
IF authenticated
IF authorized => trigger /foo/properties.html
ELSE => send custom error page
ELSE
redirect to /login.html?from=<uri>
Anyway I'm going to try that fixup handler thingie and I'll tell you how
it goes :-)
Cheers,
--
IT'S TIME FOR A DIFFERENT KIND OF WEB
================================================================
Jean-Michel Hiver - Software Director
jhiver@mkdoc.com
+44 (0)114 255 8097
================================================================
VISIT HTTP://WWW.MKDOC.COM
Re: [OT] Optional HTTP Authentication ?
Posted by Jean-Michel Hiver <jh...@mkdoc.com>.
> This seems a little off topic. I think this is an architecture question, not
> a mod perl question.
Well, a bit of both I guess.
> Basically, you want all you protected files to be located in /protected or
> some other directory...
No that is not possible. I am running a web application, there are no
such things as 'files' (everything is done using PATH_INFO), only
locations.
Users can create as many locations as they want (i.e. /foo/bar/) and
administrate them using URIs such as /foo/bar/properties.html,
/foo/bar/contents.html, etc.
There are some locations which do not need to be protected, i.e.
/foo/bar/
/foo/bar/print.html
/foo/bar/dc.xml
/foo/bar/rss100.rdf
But some others need to, like:
/foo/bar/properties.html
/foo/bar/contents.html
/foo/bar/move.html
etc.
I want to use HTTP authentication for that, but of course I cannot
password protect the whole site, because public users would not be so
happy!
Any ideas?
--
IT'S TIME FOR A DIFFERENT KIND OF WEB
================================================================
Jean-Michel Hiver - Software Director
jhiver@mkdoc.com
+44 (0)114 255 8097
================================================================
VISIT HTTP://WWW.MKDOC.COM
RE: [OT] Optional HTTP Authentication ?
Posted by Randy Harmon <rj...@fortheweb.com>.
> From: Robert Landrum [mailto:rlandrum@aol.net]
> On Fri, Jun 28, 2002 at 06:42:16PM +0100, Jean-Michel Hiver wrote:
[...]
> > IF browser sent user credentials
> > authenticate
> > if authentication is ok
> > set $ENV{REMOTE_USER}
[...]
> This seems a little off topic. I think this is an architecture
> question, not a mod perl question.
Oh, I don't know, I think the poster was asking about how to produce this
effect with mod_perl. He wants to know *whether* a login was provided, even
on a *non-protected* page. That would let you say (while serving any old
page):
if( $ENV{REMOTE_USER} eq 'admin' ) {
$r->print('Yo, you can do <a href="/admin/">extra kewl stuff</a> here.');
}
In one of the earlier stages of processing - maybe a FixupHandler or ? a
AuthenHandler might be appropriate - you can do something like this:
my $a = $r->header_in('Authorization');
$a =~ s/^Basic (.*)/$1/;
my( $user, $pass ) = split(':', decode_base64( $a ) );
if( <check the username/password as you wish> ) {
$ENV{REMOTE_USER} = $user;
}
So, now you can tell later during the request with a username/password was
offered (and you know it was a valid login/pass combo).
Randy
> -----Original Message-----
> From: Robert Landrum [mailto:rlandrum@aol.net]
> Sent: Friday, June 28, 2002 12:15 PM
> To: modperl@apache.org
> Subject: Re: [OT] Optional HTTP Authentication ?
>
>
> On Fri, Jun 28, 2002 at 06:42:16PM +0100, Jean-Michel Hiver wrote:
> > Hi List,
> >
> > I would like apache to do the following:
> >
> > <location />
> > # pseudo code, basically I want the authentication to
> happen only if the
> > # user sent his credentials, otherwise continue as if
> nothing was there.
> > IF browser sent user credentials
> > authenticate
> > if authentication is ok
> > set $ENV{REMOTE_USER}
> > </location>
> >
> > <location /login.html>
> > # usual authentication stuff. The user HAS to authenticate when sent
> > # here, i.e. sends a 401 authorization required if necessary.
> > PerlAuthenHandler MKDoc::Apache::Auth::MySQL
> > AuthName "Please enter your user credentials"
> > AuthType Basic
> > require valid-user
> > </location>
> >
>
> This seems a little off topic. I think this is an architecture
> question, not
> a mod perl question.
>
> Basically, you want all you protected files to be located in /protected or
> some other directory...
>
> Everything else should be open to the public. When a user tries to access
> /protected/whatever.html, they'll be required to enter a username
> and password,
> or get redirected to an auth required page.
>
> Rob
>