You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by nd...@apache.org on 2002/12/12 06:58:15 UTC
cvs commit: httpd-2.0/docs/manual/mod mod_auth.html.en mod_auth.xml quickreference.html.en
nd 2002/12/11 21:58:15
Modified: docs/manual/mod Tag: APACHE_2_0_BRANCH mod_auth.html.en
mod_auth.xml quickreference.html.en
Log:
markup, reformatting, nitpicking
Revision Changes Path
No revision
No revision
1.14.2.3 +59 -60 httpd-2.0/docs/manual/mod/Attic/mod_auth.html.en
Index: mod_auth.html.en
===================================================================
RCS file: /home/cvs/httpd-2.0/docs/manual/mod/Attic/mod_auth.html.en,v
retrieving revision 1.14.2.2
retrieving revision 1.14.2.3
diff -u -r1.14.2.2 -r1.14.2.3
--- mod_auth.html.en 11 Dec 2002 21:53:34 -0000 1.14.2.2
+++ mod_auth.html.en 12 Dec 2002 05:58:15 -0000 1.14.2.3
@@ -31,9 +31,7 @@
restrict access by looking up users in plain text password and
group files. Similar functionality and greater scalability is
provided by <code class="module"><a href="../mod/mod_auth_dbm.html">mod_auth_dbm</a></code>. HTTP Digest
- Authentication is provided by
- <code class="module"><a href="../mod/mod_auth_digest.html">mod_auth_digest</a></code>.</p>
-
+ Authentication is provided by <code class="module"><a href="../mod/mod_auth_digest.html">mod_auth_digest</a></code>.</p>
</div>
<div id="quickview"><h3 class="directives">Directives</h3>
<ul id="toc">
@@ -54,31 +52,27 @@
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets whether authorization and authentication are
passed to lower level modules</td></tr>
-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthAuthoritative on|off</code></td></tr>
-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthAuthoritative on</code></td></tr>
+<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthAuthoritative On|Off</code></td></tr>
+<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthAuthoritative On</code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth</td></tr>
</table>
- <div class="note">This information has not been updated for Apache 2.0, which
- uses a different system for module ordering.</div>
-
<p>Setting the <code class="directive">AuthAuthoritative</code> directive
- explicitly to <strong>'off'</strong> allows for both
- authentication and authorization to be passed on to lower level
- modules (as defined in the <code>Configuration</code> and
- <code>modules.c</code> files) if there is <strong>no
- userID</strong> or <strong>rule</strong> matching the supplied
- userID. If there is a userID and/or rule specified; the usual
- password and access checks will be applied and a failure will give
- an Authorization Required reply.</p>
+ explicitly to <code>Off</code> allows for both authentication and
+ authorization to be passed on to lower level modules (as defined in the
+ <code>modules.c</code> files) if there is <strong>no userID</strong>
+ or <strong>rule</strong> matching the supplied userID. If there is a
+ userID and/or rule specified; the usual password and access checks
+ will be applied and a failure will give an "Authentication Required"
+ reply.</p>
<p>So if a userID appears in the database of more than one module;
or if a valid <code class="directive"><a href="../mod/core.html#require">Require</a></code>
directive applies to more than one module; then the first module
will verify the credentials; and no access is passed on;
- regardless of the AuthAuthoritative setting.</p>
+ regardless of the <code class="directive">AuthAuthoritative</code> setting.</p>
<p>A common use for this is in conjunction with one of the
database modules; such as <code class="module"><a href="../mod/mod_auth_dbm.html">mod_auth_dbm</a></code>,
@@ -87,20 +81,19 @@
a few (administrator) related accesses fall through to a lower
level with a well protected <code class="directive"><a href="#authuserfile">AuthUserFile</a></code>.</p>
- <p>By default; control is not passed on; and an unknown userID or
- rule will result in an Authorization Required reply. Not setting
- it thus keeps the system secure; and forces an NCSA compliant
+ <p>By default control is not passed on and an unknown userID or
+ rule will result in an "Authentication Required" reply. Not setting
+ it thus keeps the system secure and forces an NCSA compliant
behaviour.</p>
- <div class="note"><h3>Security</h3> Do consider the implications of
- allowing a user to allow fall-through in his .htaccess file; and
- verify that this is really what you want; Generally it is easier
- to just secure a single .htpasswd file, than it is to secure a
- database such as mSQL. Make sure that the <code class="directive"><a href="#authuserfile">AuthUserFile</a></code> and the <code class="directive"><a href="#authgroupfile">AuthGroupFile</a></code> are stored outside the
- document tree of the web-server; do <em>not</em> put them in the
- directory that they protect. Otherwise, clients will be able to
- download the <code class="directive"><a href="#authuserfile">AuthUserFile</a></code>
- and the <code class="directive"><a href="#authgroupfile">AuthGroupFile</a></code>.
+ <div class="warning"><h3>Security</h3>
+ <p>Do consider the implications of allowing a user to allow
+ fall-through in his .htaccess file; and verify that this is really
+ what you want; Generally it is easier to just secure a single
+ .htpasswd file, than it is to secure a database such as mSQL.
+ Make sure that the <code class="directive"><a href="#authuserfile">AuthUserFile</a></code> and the <code class="directive"><a href="#authgroupfile">AuthGroupFile</a></code> are stored outside the document tree of
+ the web-server; do <em>not</em> put them in the directory that they
+ protect. Otherwise, clients will be able to download the <code class="directive"><a href="#authuserfile">AuthUserFile</a></code> and the <code class="directive"><a href="#authgroupfile">AuthGroupFile</a></code>.</p>
</div>
</div>
@@ -117,25 +110,24 @@
</table>
<p>The <code class="directive">AuthGroupFile</code> directive sets the
name of a textual file containing the list of user groups for user
- authentication. <var>File-path</var> is the path to the group
- file. If it is not absolute (<em>i.e.</em>, if it doesn't begin
- with a slash), it is treated as relative to the <code class="directive"><a href="../mod/core.html#serverroot">ServerRoot</a></code>.</p>
+ authentication. <var>File-path</var> is the path to the group
+ file. If it is not absolute, it is treated as relative to the <code class="directive"><a href="../mod/core.html#serverroot">ServerRoot</a></code>.</p>
<p>Each line of the group file contains a groupname followed by a
- colon, followed by the member usernames separated by spaces.
- Example:</p>
+ colon, followed by the member usernames separated by spaces.</p>
- <div class="example"><p><code>mygroup: bob joe anne</code></p></div>
+ <div class="example"><h3>Example:</h3><p><code>
+ mygroup: bob joe anne
+ </code></p></div>
<p>Note that searching large text files is <em>very</em>
- inefficient; <code class="directive"><a href="../mod/mod_auth_dbm.html#authdbmgroupfile">AuthDBMGroupFile</a></code> should be used
- instead.</p>
+ inefficient; <code class="directive"><a href="../mod/mod_auth_dbm.html#authdbmgroupfile">AuthDBMGroupFile</a></code> provides a much better performance.</p>
- <div class="note"><h3>Security</h3>
- <p>Make sure that the <code class="directive">AuthGroupFile</code> is
- stored outside the document tree of the web-server; do <em>not</em>
- put it in the directory that it protects. Otherwise, clients will
- be able to download the <code class="directive">AuthGroupFile</code>.</p>
+ <div class="warning"><h3>Security</h3>
+ <p>Make sure that the <code class="directive">AuthGroupFile</code> is
+ stored outside the document tree of the web-server; do <em>not</em>
+ put it in the directory that it protects. Otherwise, clients may
+ be able to download the <code class="directive">AuthGroupFile</code>.</p>
</div>
</div>
@@ -157,34 +149,41 @@
with a slash), it is treated as relative to the <code class="directive"><a href="../mod/core.html#serverroot">ServerRoot</a></code>.</p>
<p>Each line of the user file contains a username followed by
- a colon, followed by the <code>crypt()</code> encrypted
- password. The behavior of multiple occurrences of the same user is
- undefined.</p>
+ a colon, followed by the encrypted password. If the same user
+ ID is defined multiple times, <code class="module"><a href="../mod/mod_auth.html">mod_auth</a></code> will
+ use the first occurrence to verify the password.</p>
<p>The utility <a href="../programs/htpasswd.html">htpasswd</a>
which is installed as part of the binary distribution, or which
can be found in <code>src/support</code>, is used to maintain
- this password file. See the <code>man</code> page for more
- details. In short:</p>
-
- <p>Create a password file 'Filename' with 'username' as the
- initial ID. It will prompt for the password:</p>
-
- <div class="example"><p><code>htpasswd -c Filename username</code></p></div>
-
- <p>Add or modify 'username2' in the password file 'Filename':</p>
+ this password file. See the <a href="../programs/htpasswd.html">man
+ page</a> for more details. In short:</p>
- <div class="example"><p><code>htpasswd Filename username2</code></p></div>
+ <p>Create a password file <code>Filename</code> with
+ <code>username</code> as the initial ID. It will prompt for the
+ password:</p>
+
+ <div class="example"><p><code>
+ htpasswd -c Filename username
+ </code></p></div>
+
+ <p>Add or modify <code>username2</code> in the password file
+ <code>Filename</code>:</p>
+
+ <div class="example"><p><code>
+ htpasswd Filename username2
+ </code></p></div>
<p>Note that searching large text files is <em>very</em>
inefficient; <code class="directive"><a href="../mod/mod_auth_dbm.html#authdbmuserfile">AuthDBMUserFile</a></code> should be used
instead.</p>
- <div class="note"><h3>Security</h3>
- <p>Make sure that the <code class="directive">AuthUserFile</code> is
- stored outside the document tree of the web-server; do <em>not</em>
- put it in the directory that it protects. Otherwise, clients will
- be able to download the <code class="directive">AuthUserFile</code>.</p>
+ <div class="warning"><h3>Security</h3>
+ <p>Make sure that the <code class="directive">AuthUserFile</code> is
+ stored outside the document tree of the web-server. Do
+ <strong>not</strong> put it in the directory that it protects.
+ Otherwise, clients may be able to download the
+ <code class="directive">AuthUserFile</code>.</p>
</div>
</div>
1.7.2.2 +64 -63 httpd-2.0/docs/manual/mod/Attic/mod_auth.xml
Index: mod_auth.xml
===================================================================
RCS file: /home/cvs/httpd-2.0/docs/manual/mod/Attic/mod_auth.xml,v
retrieving revision 1.7.2.1
retrieving revision 1.7.2.2
diff -u -r1.7.2.1 -r1.7.2.2
--- mod_auth.xml 2 Dec 2002 19:32:07 -0000 1.7.2.1
+++ mod_auth.xml 12 Dec 2002 05:58:15 -0000 1.7.2.2
@@ -15,9 +15,7 @@
restrict access by looking up users in plain text password and
group files. Similar functionality and greater scalability is
provided by <module>mod_auth_dbm</module>. HTTP Digest
- Authentication is provided by
- <module>mod_auth_digest</module>.</p>
-
+ Authentication is provided by <module>mod_auth_digest</module>.</p>
</summary>
<seealso><directive module="core">Require</directive></seealso>
<seealso><directive module="core">Satisfy</directive></seealso>
@@ -36,27 +34,26 @@
<usage>
<p>The <directive>AuthGroupFile</directive> directive sets the
name of a textual file containing the list of user groups for user
- authentication. <var>File-path</var> is the path to the group
- file. If it is not absolute (<em>i.e.</em>, if it doesn't begin
- with a slash), it is treated as relative to the <directive
+ authentication. <var>File-path</var> is the path to the group
+ file. If it is not absolute, it is treated as relative to the <directive
module="core">ServerRoot</directive>.</p>
<p>Each line of the group file contains a groupname followed by a
- colon, followed by the member usernames separated by spaces.
- Example:</p>
+ colon, followed by the member usernames separated by spaces.</p>
- <example>mygroup: bob joe anne</example>
+ <example><title>Example:</title>
+ mygroup: bob joe anne
+ </example>
<p>Note that searching large text files is <em>very</em>
- inefficient; <directive
- module="mod_auth_dbm">AuthDBMGroupFile</directive> should be used
- instead.</p>
+ inefficient; <directive module="mod_auth_dbm"
+ >AuthDBMGroupFile</directive> provides a much better performance.</p>
- <note><title>Security</title>
- <p>Make sure that the <directive>AuthGroupFile</directive> is
- stored outside the document tree of the web-server; do <em>not</em>
- put it in the directory that it protects. Otherwise, clients will
- be able to download the <directive>AuthGroupFile</directive>.</p>
+ <note type="warning"><title>Security</title>
+ <p>Make sure that the <directive>AuthGroupFile</directive> is
+ stored outside the document tree of the web-server; do <em>not</em>
+ put it in the directory that it protects. Otherwise, clients may
+ be able to download the <directive>AuthGroupFile</directive>.</p>
</note>
</usage>
</directivesynopsis>
@@ -79,35 +76,42 @@
module="core">ServerRoot</directive>.</p>
<p>Each line of the user file contains a username followed by
- a colon, followed by the <code>crypt()</code> encrypted
- password. The behavior of multiple occurrences of the same user is
- undefined.</p>
+ a colon, followed by the encrypted password. If the same user
+ ID is defined multiple times, <module>mod_auth</module> will
+ use the first occurrence to verify the password.</p>
<p>The utility <a href="../programs/htpasswd.html">htpasswd</a>
which is installed as part of the binary distribution, or which
can be found in <code>src/support</code>, is used to maintain
- this password file. See the <code>man</code> page for more
- details. In short:</p>
+ this password file. See the <a href="../programs/htpasswd.html">man
+ page</a> for more details. In short:</p>
- <p>Create a password file 'Filename' with 'username' as the
- initial ID. It will prompt for the password:</p>
-
- <example>htpasswd -c Filename username</example>
-
- <p>Add or modify 'username2' in the password file 'Filename':</p>
-
- <example>htpasswd Filename username2</example>
+ <p>Create a password file <code>Filename</code> with
+ <code>username</code> as the initial ID. It will prompt for the
+ password:</p>
+
+ <example>
+ htpasswd -c Filename username
+ </example>
+
+ <p>Add or modify <code>username2</code> in the password file
+ <code>Filename</code>:</p>
+
+ <example>
+ htpasswd Filename username2
+ </example>
<p>Note that searching large text files is <em>very</em>
inefficient; <directive
module="mod_auth_dbm">AuthDBMUserFile</directive> should be used
instead.</p>
- <note><title>Security</title>
- <p>Make sure that the <directive>AuthUserFile</directive> is
- stored outside the document tree of the web-server; do <em>not</em>
- put it in the directory that it protects. Otherwise, clients will
- be able to download the <directive>AuthUserFile</directive>.</p>
+ <note type="warning"><title>Security</title>
+ <p>Make sure that the <directive>AuthUserFile</directive> is
+ stored outside the document tree of the web-server. Do
+ <strong>not</strong> put it in the directory that it protects.
+ Otherwise, clients may be able to download the
+ <directive>AuthUserFile</directive>.</p>
</note>
</usage>
</directivesynopsis>
@@ -116,31 +120,27 @@
<name>AuthAuthoritative</name>
<description>Sets whether authorization and authentication are
passed to lower level modules</description>
-<syntax>AuthAuthoritative on|off</syntax>
-<default>AuthAuthoritative on</default>
+<syntax>AuthAuthoritative On|Off</syntax>
+<default>AuthAuthoritative On</default>
<contextlist><context>directory</context><context>.htaccess</context>
</contextlist>
<override>AuthConfig</override>
<usage>
- <note>This information has not been updated for Apache 2.0, which
- uses a different system for module ordering.</note>
-
<p>Setting the <directive>AuthAuthoritative</directive> directive
- explicitly to <strong>'off'</strong> allows for both
- authentication and authorization to be passed on to lower level
- modules (as defined in the <code>Configuration</code> and
- <code>modules.c</code> files) if there is <strong>no
- userID</strong> or <strong>rule</strong> matching the supplied
- userID. If there is a userID and/or rule specified; the usual
- password and access checks will be applied and a failure will give
- an Authorization Required reply.</p>
+ explicitly to <code>Off</code> allows for both authentication and
+ authorization to be passed on to lower level modules (as defined in the
+ <code>modules.c</code> files) if there is <strong>no userID</strong>
+ or <strong>rule</strong> matching the supplied userID. If there is a
+ userID and/or rule specified; the usual password and access checks
+ will be applied and a failure will give an "Authentication Required"
+ reply.</p>
<p>So if a userID appears in the database of more than one module;
or if a valid <directive module="core">Require</directive>
directive applies to more than one module; then the first module
will verify the credentials; and no access is passed on;
- regardless of the AuthAuthoritative setting.</p>
+ regardless of the <directive>AuthAuthoritative</directive> setting.</p>
<p>A common use for this is in conjunction with one of the
database modules; such as <module>mod_auth_dbm</module>,
@@ -150,22 +150,23 @@
level with a well protected <directive
module="mod_auth">AuthUserFile</directive>.</p>
- <p>By default; control is not passed on; and an unknown userID or
- rule will result in an Authorization Required reply. Not setting
- it thus keeps the system secure; and forces an NCSA compliant
+ <p>By default control is not passed on and an unknown userID or
+ rule will result in an "Authentication Required" reply. Not setting
+ it thus keeps the system secure and forces an NCSA compliant
behaviour.</p>
- <note><title>Security</title> Do consider the implications of
- allowing a user to allow fall-through in his .htaccess file; and
- verify that this is really what you want; Generally it is easier
- to just secure a single .htpasswd file, than it is to secure a
- database such as mSQL. Make sure that the <directive
- module="mod_auth">AuthUserFile</directive> and the <directive
- module="mod_auth">AuthGroupFile</directive> are stored outside the
- document tree of the web-server; do <em>not</em> put them in the
- directory that they protect. Otherwise, clients will be able to
- download the <directive module="mod_auth">AuthUserFile</directive>
- and the <directive module="mod_auth">AuthGroupFile</directive>.
+ <note type="warning"><title>Security</title>
+ <p>Do consider the implications of allowing a user to allow
+ fall-through in his .htaccess file; and verify that this is really
+ what you want; Generally it is easier to just secure a single
+ .htpasswd file, than it is to secure a database such as mSQL.
+ Make sure that the <directive module="mod_auth"
+ >AuthUserFile</directive> and the <directive module="mod_auth"
+ >AuthGroupFile</directive> are stored outside the document tree of
+ the web-server; do <em>not</em> put them in the directory that they
+ protect. Otherwise, clients will be able to download the <directive
+ module="mod_auth">AuthUserFile</directive> and the <directive
+ module="mod_auth">AuthGroupFile</directive>.</p>
</note>
</usage>
</directivesynopsis>
1.47.2.8 +1 -1 httpd-2.0/docs/manual/mod/quickreference.html.en
Index: quickreference.html.en
===================================================================
RCS file: /home/cvs/httpd-2.0/docs/manual/mod/quickreference.html.en,v
retrieving revision 1.47.2.7
retrieving revision 1.47.2.8
diff -u -r1.47.2.7 -r1.47.2.8
--- quickreference.html.en 12 Dec 2002 05:14:52 -0000 1.47.2.7
+++ quickreference.html.en 12 Dec 2002 05:58:15 -0000 1.47.2.8
@@ -125,7 +125,7 @@
<tr class="odd"><td><a href="mod_auth_anon.html#anonymous_verifyemail">Anonymous_VerifyEmail on|off</a></td><td> off </td><td>dh</td><td>E</td></tr><tr class="odd"><td class="descr" colspan="4">Sets whether to check the password field for a correctly
formatted email address</td></tr>
<tr><td><a href="perchild.html#assignuserid">AssignUserID <var>user_id</var> <var>group_id</var></a></td><td /><td>v</td><td>M</td></tr><tr><td class="descr" colspan="4">-</td></tr>
-<tr class="odd"><td><a href="mod_auth.html#authauthoritative">AuthAuthoritative on|off</a></td><td> on </td><td>dh</td><td>B</td></tr><tr class="odd"><td class="descr" colspan="4">Sets whether authorization and authentication are
+<tr class="odd"><td><a href="mod_auth.html#authauthoritative">AuthAuthoritative On|Off</a></td><td> On </td><td>dh</td><td>B</td></tr><tr class="odd"><td class="descr" colspan="4">Sets whether authorization and authentication are
passed to lower level modules</td></tr>
<tr><td><a href="mod_auth_dbm.html#authdbmauthoritative">AuthDBMAuthoritative on|off</a></td><td> on </td><td>dh</td><td>E</td></tr><tr><td class="descr" colspan="4">Sets whether authentication and authorization will be
passwed on to lower level modules</td></tr>