You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Tom Lancaster <tl...@redhat.com> on 2000/11/17 19:01:49 UTC
Re: two identical directives in configuration
I think require => ["group payer_manager", "payer_group demo"] should do it.
On Fri, Nov 17, 2000 at 01:11:09PM -0500, Adi Fairbank wrote:
> Say I have a $Directory{} configuration in a <Perl> section like so:
>
> $Directory{"/home/httpd/html-ssl/demo"} = {
> SetHandler => "perl-script",
> PerlAuthenHandler => "Authen",
> PerlAuthzHandler => "Authz",
> require => "group payer_manager",
> require => "payer_group demo",
> };
>
> Obviously this won't work because the second "require => " directive will
> clobber the first. So what's the workaround? I couldn't think of what the
> logical perl translation to having two require directives would be...
>
> -Adi
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: modperl-unsubscribe@apache.org
> For additional commands, e-mail: modperl-help@apache.org
--
Tom Lancaster Red Hat, Inc.
Web Engineer (415) 777-9810 x 228
Re: two identical directives in configuration (doc patch
included)
Posted by Adi Fairbank <ad...@certsite.com>.
Dave Kaufman wrote:
>
> i belive it is. in fact, i didn't realize specifing two require coditions (one group and one user) worked on *separate* lines :)
>
> something like:
>
> $Location{"blah"} = {
> require => "group payer_manager, payer_group demo"
> };
>
> should do the trick.
>
> -dave
Thanks, that fixed it.
One thing I noticed through all this, is I think the mod_perl documentation is
wrong.. I don't think the following is supported...
DirectoryIndex => [qw(index.html index.htm)],
... unless DirectoryIndex is a special case.
>From perl_config.c:
1148 #define SECiter_list(t) \
1149 { \
1150 I32 i; \
1151 for(i=0; i<=AvFILL(entries); i++) { \
1152 SV *rv = *av_fetch(entries, i, FALSE); \
1153 HV *nhv; \
1154 if(!SvROK(rv) || (SvTYPE(SvRV(rv)) != SVt_PVHV)) \
1155 croak("not a HASH reference!"); \
1156 nhv = newHV(); \
1157 hv_store(nhv, (char*)key, klen, SvREFCNT_inc(rv), FALSE); \
1158 tab = nhv; \
1159 t; \
1160 SvREFCNT_dec(nhv); \
1161 } \
1162 entries = Nullav; \
1163 continue; \
1164 }
lines 1154-1155 will cause it to croak if any array value in entries is not a
hashref, so an arrayref of scalars (e.g. DirectoryIndex => [qw(index.html
index.htm)]) won't work.
Am I wrong here? I did some simple tests which confirmed my suspicions, but I
may still be missing something.
Below is a documentation patch that I think will prevent other people's
confusion in the future:
Index: mod_perl.pod
===================================================================
RCS file: /home/cvspublic/modperl/mod_perl.pod,v
retrieving revision 1.20
diff -u -r1.20 mod_perl.pod
--- mod_perl.pod 2000/03/05 23:46:30 1.20
+++ mod_perl.pod 2000/11/17 23:18:54
@@ -618,7 +618,7 @@
AuthUserFile => '/tmp/htpasswd',
AuthType => 'Basic',
AuthName => 'test',
- DirectoryIndex => [qw(index.html index.htm)],
+ DirectoryIndex => 'index.html index.htm',
Limit => {
METHODS => 'GET POST',
require => 'user dougm',
Re: two identical directives in configuration (doc patch
included)
Posted by Adi Fairbank <ad...@certsite.com>.
Dave Kaufman wrote:
>
> "Adi Fairbank" <ad...@certsite.com> wrote:
> > Dave Kaufman wrote:
> > >
> > > $Location{"blah"} = {
> > > require => "group payer_manager, payer_group demo"
> > > };
> > > should do the trick.
> >
> > I wrote:
> > > Thanks, that fixed it.
> >
> > Actually, no that didn't fix it!
> > $r->requires
> > returns
> > [{ 'group' => "payer_manager, payer_group demo"}]
>
> d'oh! we have the syntax wrong to begin with.
>
> http://www.apache.org/docs/mod/core.html#require says:
>
Yes, but I'm using Apache::AuthCookie, which allows you to implement your own
require methods. Theoretically, I could have as many require'ments as I write
perl methods in the PerlAuthzHandler.
require group payer_manager
require payer_group demo
require user_ip 127.0.0.1
require dayofweek wednesday
etc..
This is why it would be useful for <Perl> sections to support:
$Location{"blah"} = {
require => ["req 1", "req 2", "req 3", "req 4", ..]
};
-Adi
Re: two identical directives in configuration (doc patch included)
Posted by Dave Kaufman <dk...@nac.net>.
"Adi Fairbank" <ad...@certsite.com> wrote:
> Dave Kaufman wrote:
> >
> > $Location{"blah"} = {
> > require => "group payer_manager, payer_group demo"
> > };
> > should do the trick.
>
> I wrote:
> > Thanks, that fixed it.
>
> Actually, no that didn't fix it!
> $r->requires
> returns
> [{ 'group' => "payer_manager, payer_group demo"}]
d'oh! we have the syntax wrong to begin with.
http://www.apache.org/docs/mod/core.html#require says:
Require directive
The allowed syntaxes are:
Require user userid userid ...
^^^^
Only the named users can access the directory.
Require group group-name group-name ...
^^^^^
Only users in the named groups can access the directory.
Require valid-user
All valid users can access the directory.
implying that you *must* specify either
'user' username username ...
or 'group' groupname groupname ...
or 'valid-user'
but the concept of specifying access based on a combination of username-or-group-memership seems to be undefined.
i thought maybe the satisfy directive might help, ala:
satisfy any
require group simpson
require user bart
but the satisy docs say its only for mixing allow & deny type access restrictions with auth-based restrictions...
i could have sworn i had successfully done this in the past though, allowing a whole group plus one named user... (but maybe i just added him to the group in question)
perhaps someone else can enlighten us...
-dave
Re: two identical directives in configuration (doc patch
included)
Posted by Adi Fairbank <ad...@certsite.com>.
Dave Kaufman wrote:
>
> i belive it is. in fact, i didn't realize specifing two require coditions (one group and one user) worked on *separate* lines :)
>
> something like:
>
> $Location{"blah"} = {
> require => "group payer_manager, payer_group demo"
> };
>
> should do the trick.
>
> -dave
I wrote:
> Thanks, that fixed it.
Actually, no that didn't fix it!
$r->requires
returns
[{ 'group' => "payer_manager, payer_group demo"}]
for the above $Location{} directive. It does no comma separation. I guess the
only workaround is to split on comma after calling $r->requires (in the Auth
handler).
This is definitely not ideal.. I think we should fix this in perl_config.c.
Basically I think there should be some straightforward way to have two (or more)
require statements in $Location{} directives. The most logical seems to be what
Tom suggested:
require => ["group payer_manager", "payer_group demo"]
I'd be happy to submit patches if I got a go ahead from Doug that this would be
useful.
-Adi
Re: two identical directives in configuration
Posted by Dave Kaufman <dk...@nac.net>.
"Adi Fairbank" <ad...@certsite.com> wrote:
> No I tried that (sorry I should have said so). I think:
>
> <Perl>
> $Location{"blah"} = {
> require => ["group payer_manager", "payer_group demo"]
> };
> </Perl>
>
> is equivalent to:
>
> <Location "blah">
> require group payer_manager payer_group demo
> </Location>
>
> but I'm not sure.
i belive it is. in fact, i didn't realize specifing two require coditions (one group and one user) worked on *separate* lines :)
something like:
$Location{"blah"} = {
require => "group payer_manager, payer_group demo"
};
should do the trick.
-dave
Re: two identical directives in configuration
Posted by Adi Fairbank <ad...@certsite.com>.
No I tried that (sorry I should have said so). I think:
<Perl>
$Location{"blah"} = {
require => ["group payer_manager", "payer_group demo"]
};
</Perl>
is equivalent to:
<Location "blah">
require group payer_manager payer_group demo
</Location>
but I'm not sure. In any case, it doesn't work. Maybe I'll have a looksee at
the source code.
-Adi
Tom Lancaster wrote:
>
> I think require => ["group payer_manager", "payer_group demo"] should do it.
>
> On Fri, Nov 17, 2000 at 01:11:09PM -0500, Adi Fairbank wrote:
> > Say I have a $Directory{} configuration in a <Perl> section like so:
> >
> > $Directory{"/home/httpd/html-ssl/demo"} = {
> > SetHandler => "perl-script",
> > PerlAuthenHandler => "Authen",
> > PerlAuthzHandler => "Authz",
> > require => "group payer_manager",
> > require => "payer_group demo",
> > };
> >
> > Obviously this won't work because the second "require => " directive will
> > clobber the first. So what's the workaround? I couldn't think of what the
> > logical perl translation to having two require directives would be...
> >
> > -Adi
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: modperl-unsubscribe@apache.org
> > For additional commands, e-mail: modperl-help@apache.org
>
> --
> Tom Lancaster Red Hat, Inc.
> Web Engineer (415) 777-9810 x 228