Redirection from Authentication...

[Trevor Phillips <ph...@central.murdoch.edu.au>]

Ok, this is a follow-up to an earlier issue I posted about DocumentRoot issues.

The module is a PerlAccessHandler, which redirects internally to a login screen
if Authentication checks fail. I've written a Test module JUST to test
Redirection issues (see below for not-overly-big module).

Ok, so the DocumentRoot problem I was having before doesn't occur for this test
module; I'll have to revisit my (more complex) module, and see what's
different...

I'd like to clarify, though, other problems concerning the module:
  - How to redirect: I've included two methods of redirection (note; I didn't
actually include any Auth check for the purposes of the test module - it should
redirect every time).

Method #1: Setting the handlers.

Basically, change the content handler to point to our own custom routine:

      $r->handler("perl-script");
      $r->set_handlers(PerlHandler=>[\&LoginScreen]);

This is a nice implementation, and works well for static HTML docs, and
mod_perl content handlers. However, it seems to be TOTALLY ignored by .cgi
files!! This makes it useless for protecting CGI's (one of the primary
candidates for Authentication Protection). Is it possible to protect CGI's with
this method? Why can't CGI Handlers be overridden this way?

Method #2: Giving an error with a Custom Response.

      $r->custom_response(FORBIDDEN,"/mais/login.html");
      return FORBIDDEN;

To me, this isn't as nice as the other method; the forced error seems like a
hack, as does the redirect to the URI. But it works! Even if the other URI is a
Perl Handled login screen and doesn't even exist. ^_^
This method was the one having problems with DocumentRoot before (but this test
script seems to work with them! Grr!)

In the module, I've also included a check to see if HTTPS is on, by checking
out the HTTPS environment variable. On one of my Solaris servers though, the
script doesn't see this environment variable at ALL. I've tried PerlPassEnv and
other techniques, all to no avail. Printing out what env vars it does get shows
a very limited set of standard vars... Any idea what's going on here? (This is
sort of a side-issue that's bugging me).

(All techniques derived from the Tutelage of the Eagle Bible. ^_^)

The Test Module:
# ----------------------------------------
package AccessTest;

use Apache::Constants qw(:common :remotehost);

# Check for secure server?
$HTTPSCheck = 0;

# Use custom_response redirect instead of set_handlers...
$CustomRedirect = 1;

sub handler
{
   my $r = shift;

   if ($r->current_callback eq "PerlAccessHandler")
   {
      return AccessHandler($r);
   }
# Else handle it differently...
}

sub AccessHandler
{
   my $r = shift;

# Secure Server Check
   if ($HTTPSCheck)
   {
            
      $r->subprocess_env; # Set up Environment.
   
      DebugLog("Checking Secureness: HTTPS is ".$r->subprocess_env('HTTPS'));

      if ($r->subprocess_env('HTTPS') ne "on")
      {
         my $surl=
"https://".$r->get_server_name.$r->uri.($r->args?"?".$r->args:"");
# Redirecting to secure server ($surl)
         $r->custom_response(FORBIDDEN,$surl);
         return FORBIDDEN;
      }
   }

# Redirecting to Login
   if ($CustomRedirect)
   {
      $r->custom_response(FORBIDDEN,"/mais/login.html");
      return FORBIDDEN;
   }
   else
   {   
      $r->handler("perl-script");
      $r->set_handlers(PerlHandler=>[\&LoginScreen]);
   }
   return OK;
}

sub LoginScreen 
{
   my $r = shift;
 
   $r->content_type("text/html"); 
   $r->send_http_header;
  
   $r->print("Login screen here!");
}


-- 
. Trevor Phillips             -           http://jurai.murdoch.edu.au/ . 
: CWIS Systems Administrator     -           T.Phillips@murdoch.edu.au : 
| IT Services                       -               Murdoch University | 
 >------------------- Member of the #SAS# & #CFC# --------------------<
| On nights such as this, evil deeds are done. And good deeds, of     /
| course. But mostly evil, on the whole.                             /
 \      -- (Terry Pratchett, Wyrd Sisters)                          /

Re: Redirection from Authentication...

[Doug MacEachern <do...@pobox.com>]

On Mon, 6 Mar 2000, Trevor Phillips wrote:
 
> Basically, change the content handler to point to our own custom routine:
> 
>       $r->handler("perl-script");
>       $r->set_handlers(PerlHandler=>[\&LoginScreen]);

if you do that in the access handler, it's overridden by the type handler.
try this:

$r->push_handlers(PerlTypeHandler => 
                  sub { shift->handler('perl-script'); OK });
$r->set_handlers(PerlHandler=>[\&LoginScreen]);