Re: Conflict in authorization types among various authz modules...

[Brad Nicholes <BN...@novell.com>]

   Are there any comments on this?  If not then I would like to make the type name changes in trunk and then push them back into the 2.2 branch.  I don't consider this a show-stopper for the 2.1.7-beta candidate but the conflict does need to be resolved before 2.2 is released.

Brad   

>>> On Friday, August 26, 2005 at 9:44:31 am, in message
<43...@novell.com>, BNICHOLES@novell.com wrote:
> I am looking for comments from those who helped to implement the
> refactored authentication model and those who helped restructure the
> authentication modules.  
> 
>    One of the problems that I discovered while working on the
> restructuring of the authnz_ldap module was the name space for the
> authorization types.  I found that the 2.0 version of mod_auth_ldap
> implemented authorization types such as "valid-user", "user" and
> "group".  After creating mod_authnz_ldap and restructuring the ldap
> authorization types, I found that using these authorization type names
> conflicted with mod_authz_user and mod_authz_groupfile.  Meaning that if
> mod_authnz_ldap was loaded along side of mod_authz_user or
> mod_authz_groupfile, the authorization module that actually attempted to
> handle authorization was at the mercy of the module load order and in
> most cases was wrong.  In other words, the following configuration would
> not be able to accurately determine which authz module should be
> handling authorization. 
> 
> LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
> LoadModule authz_user_module modules/mod_authz_user.so
> 
> <Directory ...>
> ...
> require user bnicholes
> </Directory>
> 
> To resolve this issue I prefixed the ldap authorization types with
> "ldap-".  
> 
>    Looking through the authorization types for the other authz modules
> I noticed that there are other similar conflicts.
> 
> mod_authz_dbm             file-group, group
> mod_authz_groupfile     file-group, group
> mod_authz_owner         file-group
> 
> I would propose that the following renaming or elimination of types
> should be done before Apache 2.2 is released in order to resolve the
> conflicts
> 
> mod_authz_dbm            dbm-group
> mod_authz_groupfile     group
> mod_authz_owner         file-group
> 
> 
> Comments?
> 
> Brad

Re: Conflict in authorization types among various authz modules...

[Graham Leggett <mi...@sharp.fm>]

Brad Nicholes wrote:

>    Are there any comments on this?  If not then I would like
 > to make the type name changes in trunk and then push them back
 > into the 2.2 branch.  I don't consider this a show-stopper for
 > the 2.1.7-beta candidate but the conflict does need to be
 > resolved before 2.2 is released.

+1.

Regards,
Graham
--