Authenticating Users into Apache with $req_rec

[Sam Michel <sa...@chinwag.com>]

Hello,

This is probably a very dumb question, I'm fairly new to mod_perl, so please
excuse me if it's very obvious.

I'd like to use EmbperlObject to login a user that's coming to my website. I
don't want to set up Authentication and Authorization handlers, because the
website doesn't need anything that complicated. The user will only see
sensitive infortmation if they are logged in.

I'd like to be able to log them in manually by doing:

[- $req_rec->connection->user('somebody'); -]

which seems to work fine on the individual page, but doesn't get carried
through to subsequent pages. I'm assuming this is because EmbperlObject
needs to have sessions set up in order to track this information.

In a standard mod_perl script, I'd just get the Apache request object and
set the username. Is there a way of doing this in EmbperlObject or do I need
to set up sessions.

I have thought about including hidden fields on each page, but I'm not happy
with the potential security holes that this opens up.

Any help would be much appreciated.

Toodle Pip

Sam
----------------------------------------------------------------------
       Sam Michel - sam@chinwag.com
       t: 0870 730 7313  f: 0870 730 7312

     Chinwag - http://www.chinwag.com
   email publishing & marketing specialists
----------------------------------------------------------------------


---------------------------------------------------------------------
To unsubscribe, e-mail: embperl-unsubscribe@perl.apache.org
For additional commands, e-mail: embperl-help@perl.apache.org

Re: Authenticating Users into Apache with $req_rec

[Andrew O'Brien <an...@switchonline.com.au>]

On Wed, Nov 07, 2001 at 11:55:28AM -0000, Sam Michel wrote:

> I'd like to use EmbperlObject to login a user that's coming to my website. I
> don't want to set up Authentication and Authorization handlers, because the
> website doesn't need anything that complicated. The user will only see
> sensitive infortmation if they are logged in.
> 
> I'd like to be able to log them in manually by doing:
> 
> [- $req_rec->connection->user('somebody'); -]
> 
> which seems to work fine on the individual page, but doesn't get carried
> through to subsequent pages. I'm assuming this is because EmbperlObject
> needs to have sessions set up in order to track this information.
> 
> In a standard mod_perl script, I'd just get the Apache request object and
> set the username. Is there a way of doing this in EmbperlObject or do I need
> to set up sessions.
> 
> I have thought about including hidden fields on each page, but I'm not happy
> with the potential security holes that this opens up.

Setting the authenticated user like you have don only lasts for the
durection of the request (http is a stateless protocol so everything
has to be set up each request, generally speaking)

Is there a reason you can't seperate the base directory of the
"logged-in only" section from the rest of the site? If not then just a
simple Basic Auth setup should be all you need. This is assuming that
the apache in question has mod_auth loaded.

See documentation at: http://httpd.apache.org/docs/mod/mod_auth.html

All the directives below are documented on the apache site as well.

eg normal site is under /
restricted site is under /members/

The file /members/.htaccess:
AuthUserFile /path/to/.htpasswd
AuthGroupFile  /path/to/.htgroup
AuthName "Access to my stuff"
AuthType Basic
<Limit GET>
require user andrewo notandrewo
# or
require group mygroup
# or
require valid-user
</Limit>

The file /path/to/.htpasswd:
andrewo:AA6DMg.RcbiBE
notandrewo:AG6Dab.EcbiBE

The file /path/to/.htgroup
mygroup: andrewo notandrewo

(there should be a htpasswd executable that comes with your apache
distro that you can use to generate the encrypted passwords)

If this isn't available and you want to do something in Embperl then
setting up sessions and using %udat is the easiest and probably most
efficient way.

-- 
 Andrew O'Brien                                                               
 Product Engineer                        email: andrewo@switchonline.com.au.
 Switch Online Group Pty Limited         phone: +61 2 9299 1133             
 ABN 89 092 286 327                      fax: +61 2 9299 1134             

---------------------------------------------------------------------
To unsubscribe, e-mail: embperl-unsubscribe@perl.apache.org
For additional commands, e-mail: embperl-help@perl.apache.org