You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Rick Strahl <rs...@west-wind.com> on 2004/12/22 22:15:24 UTC
Apache and Application driven Basic Auth
Hi all,
I'm trying to integrate with Apache for an application server interface that
works with ISAPI. The application server is responsible for generating the
full server response including headers. I'm dong this using the mod-ISAPI
module at this point in testing for compatibility with Apache.
This works reasonably well (I had to make a number of changes to the ISAPI
interface in order to get it to work with Apache), but the biggest issue I
have is I can't figure out how to get Apache to authenticate application
generated Auth requests.
The app requests return 401 Not Authorized headers. Looking with an HTTP spy
(Fiddler) I can see that both browser and server are sending the right
headers back and forth for Basic Authentication (the browser returns the
Authentication header with the username and password).
However, Apache does not validate the username and password, and
authentication fails.
I have the following for the directory I'm working with:
#*** WEB CONNECTION VIRTUAL - wconnect
Alias /wconnect/ "D:/Programs/Apache Group/Apache2/htdocs/wconnect/"
<directory "D:/Programs/Apache Group/Apache2/htdocs/wconnect/">
Options ExecCGI
DirectoryIndex default.htm
AddHandler isapi-isa dll
AuthType Basic
AuthUserFile d:\server\users\passwords.txt
AllowOverride None
Allow From all
#*** WEB CONNECTION VIRTUAL SCRIPT MAPS
AddType application/webconnection-script .wc .wcs .fxp .wwt .wwd .wwsoap
Action webconnection-script /wconnect/wc.dll
AddHandler webconnection-script .wc .wcs .fxp .wwt .wwd .wwsoap
#*** END WEB CONNECTION VIRTUAL SCRIPT MAPS
</directory>
#*** END WEB CONNECTION VIRTUAL - wconnect
The login dialog pops up fine for the Auth request, however Apache seems to
not go to the user file to validate...
Is there anything I'm missing here?
+++ Rick ---
Rick Strahl
West Wind Technologies
http://www.west-wind.com/
http://www.west-wind.com/wwThreads
----------------------------------
Making waves on the Web
Re: Apache and Application driven Basic Auth
Posted by Geoffrey Young <ge...@modperlcookbook.org>.
ok, it just hit me that my last response was probably too academic for your
needs. this part escaped me...
> Apache does all that but only against its files, not against application
> generated requests.
> Anyway if I do this inside of my <directory> tag:
> All requests are going through and my Auth requests for 401 Authentication
> are not validated and fail.
<Directory> is a filesystem-based container, but it is only one of several
ways to configure your server. see also <Location> and <LocationMatch> for
URI-based configuration and even <Files> and <FilesMatch> for filename-based
configuration. between all of them, and a basic understanding of how the
different containers merge, you can effectively apply the Require directive
only to the parts of the configuration that you want. see
http://httpd.apache.org/docs/sections.html
for some helpful guidelines.
--Geoff
Re: Apache and Application driven Basic Auth
Posted by Geoffrey Young <ge...@modperlcookbook.org>.
> I'm trying to understand whether Apache even supports application driven
> Basic Authentication.
it does, but our ideas of "application" are very different. more on that
later...
> It seems odd that this should be difficult to do -
> I've worked with a fair number of Web Servers over the yaers and this the
> first time I've run into a situation where the Web Server does not auto
> negotiate the protocol when enabled in a directory. But then most other
> Windows Web Servers use the built-in OS security to manage directory level
> authentication.
it does, just not where you want it to be.
> All the discussion I've seen so far seems to center around authenticating
> against resources in the file system, which works as expected. But Basic
> Auth as a protocol is not bound to the file system. So my question is how do
> I make Apache pass through all requests to my application *and* authenticate
> the applications Basic Auth negotiation when I ask for it with a 401 header?
for apache, authentication and content are distinctly separate. you want to
place both in the content phase (your "application") but apache's default
authentication mechanism just doesn't work that way.
> Apache does all that but only against its files, not against application
> generated requests. With my Application generated requests it basically
> interjects itself but doesn't process or forward the browser's Auth
> information. So you get a situation where there's no hook.
the hook is called the authen phase.
>
> This is a fairly common task in Web applications... I get the feeling Apache
> can't do this at least not without writing custom auth (which would be
> preferred anyway,
I think you've got it :)
> but this is a generic tool and people want use Web Server
> integrated security from their own applications).
if you want to control security from within your own, content-only
application you can. you just can't use apache's default file-based
user:password mechanism (mod_auth) - it's simply too late in the request for
that to happen.
> I do apologize for my ignorance on Apache - as stated this is not my primary
> tool and that's why I'm asking <g>. I've spent a fair amount of time trying
> to google info on this subject but I've come up pretty much blank.
> I'm more than happy to dig if there are any pointers where to look. What
> I've found in the docs and via Google all deals with file based
> permissions...
you might understand apache a bit better by trying one of the books that
discuss the apache request cycle. just because I know it's decent, you can
try this:
http://www.modperlcookbook.org/chapters/part3.pdf
while it discusses the perl interface to the apache apu instead of the C
interface, the concepts are the same.
HTH
--Geoff
RE: Apache and Application driven Basic Auth
Posted by Rick Strahl <rs...@west-wind.com>.
Hi Geoffrey,
Thanks for your helpful comments. I appreciate any help I can get...
I understand that Apache isn't IIS. I don't use Apache, but some of our
customers are, so I'm trying to make sure our product works with Apache.
It's not been an easy road to make the ISAPI extension work, but it does
work well now after doing a bunch of minor tweaks... with this exception
which is really our issue, but an Apache issue.
So...
I'm trying to understand whether Apache even supports application driven
Basic Authentication. It seems odd that this should be difficult to do -
I've worked with a fair number of Web Servers over the yaers and this the
first time I've run into a situation where the Web Server does not auto
negotiate the protocol when enabled in a directory. But then most other
Windows Web Servers use the built-in OS security to manage directory level
authentication.
I definitely think this is a *Dev* issue because it is after all about
trying to force Authentication not through the file/directory system but
from within an application. While it may be a configuration setting that's
involved, it would seem developers would have a clue how to set this up more
likely than an admin.
All the discussion I've seen so far seems to center around authenticating
against resources in the file system, which works as expected. But Basic
Auth as a protocol is not bound to the file system. So my question is how do
I make Apache pass through all requests to my application *and* authenticate
the applications Basic Auth negotiation when I ask for it with a 401 header?
> that isn't how Apache works, really. or http for that
> matter. you can send a 401 response/WWW-Authenticate header
I don't know about how Apache works (obviously <g>), but in HTTP it's
supposed to wokrk like this:
HTTP 401 works by sending an auth header and the browser responding with a
response header that contains the username and password (which is taken from
the login dialog box). It's normally the Web Server's job to validate the
user at that point and then set the HTTP_AUTHORIZATION server variable if
the user can be authenticated.
Apache does all that but only against its files, not against application
generated requests. With my Application generated requests it basically
interjects itself but doesn't process or forward the browser's Auth
information. So you get a situation where there's no hook.
This is a fairly common task in Web applications... I get the feeling Apache
can't do this at least not without writing custom auth (which would be
preferred anyway, but this is a generic tool and people want use Web Server
integrated security from their own applications).
Anyway if I do this inside of my <directory> tag:
AuthType Basic
Require valid-user
Allow From All
Satisfy Any
AuthName "Authorized Users Only"
AuthUserFile d:/passwords.txt
All requests are going through and my Auth requests for 401 Authentication
are not validated and fail. If I remove:
Allow From All
Satisfy Any
Then *every* request is authenticated and Apache handles it but only on the
file level.
I do apologize for my ignorance on Apache - as stated this is not my primary
tool and that's why I'm asking <g>. I've spent a fair amount of time trying
to google info on this subject but I've come up pretty much blank.
I'm more than happy to dig if there are any pointers where to look. What
I've found in the docs and via Google all deals with file based
permissions...
TIA,
+++ Rick ---
Rick Strahl
West Wind Technologies
http://www.west-wind.com/
http://www.west-wind.com/wwThreads
----------------------------------
Making waves on the Web
> -----Original Message-----
> From: Geoffrey Young [mailto:geoff@modperlcookbook.org]
> Sent: Thursday, December 23, 2004 4:52 AM
> To: dev@httpd.apache.org
> Subject: Re: Apache and Application driven Basic Auth
>
>
>
> Rick Strahl wrote:
> > Thanks Geoff,
> >
> >
> >>I think you need a Require directive
> >
> >
> > Yes I do <g>... but as soon as I put a Require in there it tries to
> > validate every request into the directory.
>
> yes it does :)
>
> > This is not what's requried.
> >
> > I need conditional authentication that's generated through
> the application.
> > I can do this with my own implementation of course, but it seems
> > Apache should allow me to do this under program control.
> IIS handles
> > this no problem...
>
> Apache isn't IIS :)
>
> >
> > There's an update to where I'm at here:
> >
> > http://west-wind.com/weblog/posts/1211.aspx
> >
> > I now at least have Authentication working, but it's still not what
> > I'd like to see for the app server with users getting the
> ability to
> > simply ask for auth from within the application by sending
> a 401 header.
>
> that isn't how Apache works, really. or http for that
> matter. you can send a 401 response/WWW-Authenticate header
> to your browser, and the browser will send an appropriate
> Authorization header, but on the next request. _that_
> incoming request needs to be authenticated, and the way
> apache does that is via the authen/authz phases. without the
> Require directive those phases won't be run, so no
> authentication will take place.
>
> so, typically what you need to do for conditional
> authentication is apply the Require directive to enable
> authentication, then _disable_ auth for the requests that
> don't require it. one way is to use the Satisfy directive
> with the "Any" option and code your access phase according to
> your specifications.
>
> anyway, at this point the conversation doesn't really belong
> on dev@httpd since this is a developer list and you're having
> a user/config issue. you might want to try #apache on
> irc.freenode.net for more pointers.
>
> HTH
>
> --Geoff
>
Re: Apache and Application driven Basic Auth
Posted by Geoffrey Young <ge...@modperlcookbook.org>.
Rick Strahl wrote:
> Thanks Geoff,
>
>
>>I think you need a Require directive
>
>
> Yes I do <g>... but as soon as I put a Require in there it tries to validate
> every request into the directory.
yes it does :)
> This is not what's requried.
>
> I need conditional authentication that's generated through the application.
> I can do this with my own implementation of course, but it seems Apache
> should allow me to do this under program control. IIS handles this no
> problem...
Apache isn't IIS :)
>
> There's an update to where I'm at here:
>
> http://west-wind.com/weblog/posts/1211.aspx
>
> I now at least have Authentication working, but it's still not what I'd like
> to see for the app server with users getting the ability to simply ask for
> auth from within the application by sending a 401 header.
that isn't how Apache works, really. or http for that matter. you can send
a 401 response/WWW-Authenticate header to your browser, and the browser will
send an appropriate Authorization header, but on the next request. _that_
incoming request needs to be authenticated, and the way apache does that is
via the authen/authz phases. without the Require directive those phases
won't be run, so no authentication will take place.
so, typically what you need to do for conditional authentication is apply
the Require directive to enable authentication, then _disable_ auth for the
requests that don't require it. one way is to use the Satisfy directive
with the "Any" option and code your access phase according to your
specifications.
anyway, at this point the conversation doesn't really belong on dev@httpd
since this is a developer list and you're having a user/config issue. you
might want to try #apache on irc.freenode.net for more pointers.
HTH
--Geoff
RE: Apache and Application driven Basic Auth
Posted by Rick Strahl <rs...@west-wind.com>.
Thanks Geoff,
> I think you need a Require directive
Yes I do <g>... but as soon as I put a Require in there it tries to validate
every request into the directory. This is not what's requried.
I need conditional authentication that's generated through the application.
I can do this with my own implementation of course, but it seems Apache
should allow me to do this under program control. IIS handles this no
problem...
There's an update to where I'm at here:
http://west-wind.com/weblog/posts/1211.aspx
I now at least have Authentication working, but it's still not what I'd like
to see for the app server with users getting the ability to simply ask for
auth from within the application by sending a 401 header.
+++ Rick ---
Rick Strahl
West Wind Technologies
http://www.west-wind.com/
http://www.west-wind.com/wwThreads
----------------------------------
Making waves on the Web
> -----Original Message-----
> From: Geoffrey Young [mailto:geoff@modperlcookbook.org]
> Sent: Thursday, December 23, 2004 4:28 AM
> To: dev@httpd.apache.org
> Subject: Re: Apache and Application driven Basic Auth
>
>
> > AuthType Basic
> > AuthUserFile d:\server\users\passwords.txt
>
> > Is there anything I'm missing here?
>
> I think you need a Require directive
>
> http://httpd.apache.org/docs/mod/core.html#require
>
> HTH
>
> --Geoff
>
Re: Apache and Application driven Basic Auth
Posted by Geoffrey Young <ge...@modperlcookbook.org>.
> AuthType Basic
> AuthUserFile d:\server\users\passwords.txt
> Is there anything I'm missing here?
I think you need a Require directive
http://httpd.apache.org/docs/mod/core.html#require
HTH
--Geoff