mod_auth.html revision 25503838e438bb909e3ff880125732c7ed5e64ad
2N/A<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
2N/A<HTML>
2N/A<HEAD>
2N/A<TITLE>Apache module mod_auth</TITLE>
2N/A</HEAD>
2N/A
2N/A<!-- Background white, links blue (unvisited), navy (visited), red (active) -->
2N/A<BODY
2N/A BGCOLOR="#FFFFFF"
2N/A TEXT="#000000"
2N/A LINK="#0000FF"
2N/A VLINK="#000080"
2N/A ALINK="#FF0000"
2N/A>
2N/A<!--#include virtual="header.html" -->
2N/A
2N/A<H1 ALIGN="CENTER">Module mod_auth</H1>
2N/A
2N/AThis module is contained in the <CODE>mod_auth.c</CODE> file, and
2N/Ais compiled in by default. It provides for user authentication using
2N/Atextual files.
2N/A
2N/A
2N/A<MENU>
2N/A<LI><A HREF="#authgroupfile">AuthGroupFile</A>
2N/A<LI><A HREF="#authuserfile">AuthUserFile</A>
2N/A<LI><A HREF="#authauthoritative">AuthAuthoritative</A>
2N/A</MENU>
2N/A<HR>
2N/A
2N/A
2N/A<A name="authgroupfile"><H2>AuthGroupFile</H2></A>
2N/A<!--%plaintext &lt;?INDEX {\tt AuthGroupFile} directive&gt; -->
2N/A<A
2N/A HREF="directive-dict.html#Syntax"
2N/A REL="Help"
2N/A><STRONG>Syntax:</STRONG></A> AuthGroupFile <EM>filename</EM><BR>
2N/A<A
2N/A HREF="directive-dict.html#Context"
2N/A REL="Help"
2N/A><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
2N/A<A
2N/A HREF="directive-dict.html#Override"
2N/A REL="Help"
2N/A><STRONG>Override:</STRONG></A> AuthConfig<BR>
2N/A<A
2N/A HREF="directive-dict.html#Status"
2N/A REL="Help"
2N/A><STRONG>Status:</STRONG></A> Base<BR>
2N/A<A
2N/A HREF="directive-dict.html#Module"
2N/A REL="Help"
2N/A><STRONG>Module:</STRONG></A> mod_auth<P>
2N/A
2N/AThe AuthGroupFile directive sets the name of a textual file containing the list
2N/Aof user groups for user authentication. <EM>Filename</EM> is the path
2N/Ato the group file. If it is not absolute (<EM>i.e.</EM>, if it
2N/Adoesn't begin with a slash), it is treated as relative to the ServerRoot.
2N/A<P>
2N/AEach line of the group file contains a groupname followed by a colon, followed
2N/Aby the member usernames separated by spaces. Example:
2N/A<BLOCKQUOTE><CODE>mygroup: bob joe anne</CODE></BLOCKQUOTE>
2N/ANote that searching large text files is <EM>very</EM> inefficient;
2N/A<A HREF="mod_auth_dbm.html#authdbmgroupfile">AuthDBMGroupFile</A> should
2N/Abe used instead.<P>
2N/A
2N/ASecurity: make sure that the AuthGroupFile is stored outside the
2N/Adocument tree of the web-server; do <EM>not</EM> put it in the directory that
2N/Ait protects. Otherwise, clients will be able to download the AuthGroupFile.<P>
2N/A
2N/ASee also <A HREF="core.html#authname">AuthName</A>,
2N/A<A HREF="core.html#authtype">AuthType</A> and
2N/A<A HREF="#authuserfile">AuthUserFile</A>.<P><HR>
2N/A
2N/A<A name="authuserfile"><H2>AuthUserFile</H2></A>
2N/A<!--%plaintext &lt;?INDEX {\tt AuthUserFile} directive&gt; -->
2N/A<A
2N/A HREF="directive-dict.html#Syntax"
2N/A REL="Help"
2N/A><STRONG>Syntax:</STRONG></A> AuthUserFile <EM>filename</EM><BR>
2N/A<A
2N/A HREF="directive-dict.html#Context"
2N/A REL="Help"
2N/A><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
2N/A<A
2N/A HREF="directive-dict.html#Override"
2N/A REL="Help"
2N/A><STRONG>Override:</STRONG></A> AuthConfig<BR>
2N/A<A
2N/A HREF="directive-dict.html#Status"
2N/A REL="Help"
2N/A><STRONG>Status:</STRONG></A> Base<BR>
2N/A<A
2N/A HREF="directive-dict.html#Module"
2N/A REL="Help"
2N/A><STRONG>Module:</STRONG></A> mod_auth<P>
2N/A
2N/AThe AuthUserFile directive sets the name of a textual file containing
2N/Athe list of users and passwords for user
2N/Aauthentication. <EM>Filename</EM> is the path to the user
2N/Afile. If it is not absolute (<EM>i.e.</EM>, if it doesn't begin with a
2N/Aslash), it is treated as relative to the ServerRoot.
2N/A<P> Each line of the user file file contains a username followed
2N/Aby a colon, followed by the crypt() encrypted password. The behavior
2N/Aof multiple occurrences of the same user is undefined.
2N/A<P> Note that
2N/Asearching large text files is <EM>very</EM> inefficient;
2N/A<A HREF="mod_auth_dbm.html#authdbmuserfile">AuthDBMUserFile</A> should be
2N/Aused instead.
2N/A<P>
2N/A
2N/ASecurity: make sure that the AuthUserFile is stored outside the
2N/Adocument tree of the web-server; do <EM>not</EM> put it in the directory that
2N/Ait protects. Otherwise, clients will be able to download the AuthUserFile.<P>
2N/A
2N/ASee also <A HREF="core.html#authname">AuthName</A>,
2N/A<A HREF="core.html#authtype">AuthType</A> and
2N/A<A HREF="#authgroupfile">AuthGroupFile</A>.<P>
2N/A<HR>
2N/A<A name="authauthoritative"><H2>AuthAuthoritative</H2></A>
2N/A<!--%plaintext &lt;?INDEX {\tt AuthAuthoritative} directive&gt; -->
2N/A<A
2N/A HREF="directive-dict.html#Syntax"
2N/A REL="Help"
2N/A><STRONG>Syntax:</STRONG></A> AuthAuthoritative &lt; <STRONG> on</STRONG>(default) | off &gt; <BR>
2N/A<A
2N/A HREF="directive-dict.html#Context"
2N/A REL="Help"
2N/A><STRONG>Context:</STRONG></A> directory, .htaccess<BR>
2N/A<A
2N/A HREF="directive-dict.html#Override"
2N/A REL="Help"
2N/A><STRONG>Override:</STRONG></A> AuthConfig<BR>
2N/A<A
2N/A HREF="directive-dict.html#Status"
2N/A REL="Help"
2N/A><STRONG>Status:</STRONG></A> Base<BR>
2N/A<A
2N/A HREF="directive-dict.html#Module"
2N/A REL="Help"
2N/A><STRONG>Module:</STRONG></A> mod_auth<P>
2N/A
2N/ASetting the AuthAuthoritative directive explicitly to <STRONG>'off'</STRONG>
2N/Aallows for both authentication and authorization to be passed on to
2N/Alower level modules (as defined in the <CODE>Configuration</CODE> and
2N/A<CODE>modules.c</CODE> files) if there is <STRONG>no userID</STRONG> or
2N/A<STRONG>rule</STRONG> matching the supplied userID. If there is a userID and/or
2N/Arule specified; the usual password and access checks will be applied
2N/Aand a failure will give an Authorization Required reply.
2N/A
2N/A<P>
2N/A
2N/ASo if a userID appears in the database of more than one module; or if
2N/Aa valid require directive applies to more than one module; then the
2N/Afirst module will verify the credentials; and no access is passed on;
2N/Aregardless of the AuthAuthoritative setting.
2N/A
2N/A<P>
2N/A
2N/AA common use for this is in conjunction with one of the database
2N/Amodules; such as <A
2N/AHREF="mod_auth_db.html"><CODE>mod_auth_db.c</CODE></A>, <A
2N/AHREF="mod_auth_dbm.html"><CODE>mod_auth_dbm.c</CODE></A>,
2N/A<CODE>mod_auth_msql.c</CODE>, and <A
2N/AHREF="mod_auth_anon.html"><CODE>mod_auth_anon.c</CODE></A>. These modules
2N/Asupply the bulk of the user credential checking; but a few
2N/A(administrator) related accesses fall through to a lower level with a
2N/Awell protected AuthUserFile.
2N/A
2N/A<P>
2N/A
2N/A<A
2N/A HREF="directive-dict.html#Default"
2N/A REL="Help"
2N/A><STRONG>Default:</STRONG></A> By default; control is not passed on; and an unknown
2N/AuserID or rule will result in an Authorization Required reply. Not
2N/Asetting it thus keeps the system secure; and forces an NSCA compliant
2N/Abehaviour.
2N/A
2N/A<P>
2N/A
2N/ASecurity: Do consider the implications of allowing a user to allow
2N/Afall-through in his .htaccess file; and verify that this is really
2N/Awhat you want; Generally it is easier to just secure a single
2N/A.htpasswd file, than it is to secure a database such as mSQL. Make
2N/Asure that the AuthUserFile is stored outside the document tree of the
2N/Aweb-server; do <EM>not</EM> put it in the directory that it
2N/Aprotects. Otherwise, clients will be able to download the
2N/AAuthUserFile.
2N/A
2N/A<P>
2N/ASee also <A HREF="core.html#authname">AuthName</A>,
2N/A<A HREF="core.html#authtype">AuthType</A> and
2N/A<A HREF="#authgroupfile">AuthGroupFile</A>.<P>
2N/A
2N/A<!--#include virtual="footer.html" -->
2N/A</BODY>
2N/A</HTML>
2N/A
2N/A