mod_auth.c revision 2dcfdce30a4dabc6a194c367c9ef5e53d37df638
842ae4bd224140319ae7feec1872b93dfd491143fielding/* ====================================================================
842ae4bd224140319ae7feec1872b93dfd491143fielding * The Apache Software License, Version 1.1
842ae4bd224140319ae7feec1872b93dfd491143fielding *
842ae4bd224140319ae7feec1872b93dfd491143fielding * Copyright (c) 2000-2002 The Apache Software Foundation. All rights
842ae4bd224140319ae7feec1872b93dfd491143fielding * reserved.
842ae4bd224140319ae7feec1872b93dfd491143fielding *
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * Redistribution and use in source and binary forms, with or without
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd * modification, are permitted provided that the following conditions
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * are met:
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd *
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd * 1. Redistributions of source code must retain the above copyright
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd * notice, this list of conditions and the following disclaimer.
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd *
ce9621257ef9e54c1bbe5ad8a5f445a1f211c2dcnd * 2. Redistributions in binary form must reproduce the above copyright
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * notice, this list of conditions and the following disclaimer in
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * the documentation and/or other materials provided with the
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * distribution.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * 3. The end-user documentation included with the redistribution,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * if any, must include the following acknowledgment:
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * "This product includes software developed by the
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * Apache Software Foundation (http://www.apache.org/)."
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * Alternately, this acknowledgment may appear in the software itself,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * if and wherever such third-party acknowledgments normally appear.
dc80439e9fba60c753cd145cb6799409ffea9b71ronald *
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * 4. The names "Apache" and "Apache Software Foundation" must
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * not be used to endorse or promote products derived from this
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * software without prior written permission. For written
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * permission, please contact apache@apache.org.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * 5. Products derived from this software may not be called "Apache",
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * nor may "Apache" appear in their name, without prior written
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * permission of the Apache Software Foundation.
dc80439e9fba60c753cd145cb6799409ffea9b71ronald *
f7376afc33a9e035921be9114c0e246820d7c8besf * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * SUCH DAMAGE.
e8f95a682820a599fe41b22977010636be5c2717jim * ====================================================================
f7376afc33a9e035921be9114c0e246820d7c8besf *
f7376afc33a9e035921be9114c0e246820d7c8besf * This software consists of voluntary contributions made by many
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * individuals on behalf of the Apache Software Foundation. For more
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * information on the Apache Software Foundation, please see
b980ad7fdc218b4855cde9f75a747527f50c554dwrowe * <http://www.apache.org/>.
b980ad7fdc218b4855cde9f75a747527f50c554dwrowe *
694e8dc146faadc46b2455f3bd0998121fc76c5drbb * Portions of this software are based upon public domain software
c7d0205ec1649076e7742d72a25ac53779768312stoddard * originally written at the National Center for Supercomputing Applications,
c7d0205ec1649076e7742d72a25ac53779768312stoddard * University of Illinois, Urbana-Champaign.
29c30db45f6a469017e16b606611e460cc1a1f2caaron */
032b8a34c3911bbc5ad5385ca40af65af273bff9wrowe
e33b627b40578d0166fdb79ce0487f9e46586befgstein/*
cd9f429ff62d134cdf6ec903c33430c5ebae12f0trawick * http_auth: authentication
cd9f429ff62d134cdf6ec903c33430c5ebae12f0trawick *
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * Rob McCool
e33b627b40578d0166fdb79ce0487f9e46586befgstein *
e33b627b40578d0166fdb79ce0487f9e46586befgstein * Adapted to Apache by rst.
e33b627b40578d0166fdb79ce0487f9e46586befgstein *
e33b627b40578d0166fdb79ce0487f9e46586befgstein * dirkx - Added Authoritative control to allow passing on to lower
e33b627b40578d0166fdb79ce0487f9e46586befgstein * modules if and only if the userid is not known to this
e33b627b40578d0166fdb79ce0487f9e46586befgstein * module. A known user with a faulty or absent password still
e33b627b40578d0166fdb79ce0487f9e46586befgstein * causes an AuthRequired. The default is 'Authoritative', i.e.
864c5615d55b8ebbde24e72043f6325741335a74fielding * no control is passed along.
e33b627b40578d0166fdb79ce0487f9e46586befgstein */
11f2c481e1d57bedb3f758565307501e9a2730ddtrawick
26dfa083a1662d57ba7cc410eec4e0696b9be469wrowe#include "apr_strings.h"
26dfa083a1662d57ba7cc410eec4e0696b9be469wrowe#include "apr_lib.h" /* for apr_password_validate */
e9f8410b788ef1e6f1baed6c706ffdf3da395a16jerenkrantz
e33b627b40578d0166fdb79ce0487f9e46586befgstein#include "ap_config.h"
322b350d0f1ac750b112ec15481a33efc92d182cjerenkrantz#include "httpd.h"
322b350d0f1ac750b112ec15481a33efc92d182cjerenkrantz#include "http_config.h"
97d20d37d21b8d427a920e211858172f0a82427epoirier#include "http_core.h"
97d20d37d21b8d427a920e211858172f0a82427epoirier#include "http_log.h"
97d20d37d21b8d427a920e211858172f0a82427epoirier#include "http_protocol.h"
8ec8f1c8f0f37ca3f5ebb0e0b491dd07481dccbfronald#include "http_request.h"
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingtypedef struct {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding char *auth_pwfile;
bdfba727693ab86e9914ca90af68e62896946755jerenkrantz char *auth_grpfile;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding int auth_authoritative;
fd9b4a0b713bc4816b9b80f52d567f5c2ac06bafsf} auth_config_rec;
b980ad7fdc218b4855cde9f75a747527f50c554dwrowe
1ccd992d37d62c8cb2056126f2234f64ec189bfddougmstatic void *create_auth_dir_config(apr_pool_t *p, char *d)
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding auth_config_rec *conf = apr_palloc(p, sizeof(*conf));
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding conf->auth_pwfile = NULL; /* just to illustrate the default really */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding conf->auth_grpfile = NULL; /* unless you have a broken HP cc */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding conf->auth_authoritative = 1; /* keep the fortress secure by default */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return conf;
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron}
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
e0fe4de2016336428729a620ac0034cd1198ad7awrowestatic const char *set_auth_slot(cmd_parms *cmd, void *offset, const char *f,
e0fe4de2016336428729a620ac0034cd1198ad7awrowe const char *t)
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if (t && strcmp(t, "standard")) {
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron return apr_pstrcat(cmd->pool, "Invalid auth file type: ", t, NULL);
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron }
ec486beb201583aafddf7c7ee9009727a3ade0aafielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return ap_set_file_slot(cmd, offset, f);
c7de1955eb0eaeabf7042902476397692672d549sf}
c7de1955eb0eaeabf7042902476397692672d549sf
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingstatic const command_rec auth_cmds[] =
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding AP_INIT_TAKE12("AuthUserFile", set_auth_slot,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding (void *)APR_OFFSETOF(auth_config_rec, auth_pwfile),
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding OR_AUTHCFG, "text file containing user IDs and passwords"),
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron AP_INIT_TAKE12("AuthGroupFile", set_auth_slot,
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron (void *)APR_OFFSETOF(auth_config_rec, auth_grpfile),
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron OR_AUTHCFG,
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron "text file containing group names and member user IDs"),
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding AP_INIT_FLAG("AuthAuthoritative", ap_set_flag_slot,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding (void *)APR_OFFSETOF(auth_config_rec, auth_authoritative),
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding OR_AUTHCFG,
dc80439e9fba60c753cd145cb6799409ffea9b71ronald "Set to 'no' to allow access control to be passed along to "
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding "lower modules if the UserID is not known to this module"),
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding {NULL}
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding};
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingmodule AP_MODULE_DECLARE_DATA auth_module;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingstatic char *get_pw(request_rec *r, char *user, char *auth_pwfile)
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding ap_configfile_t *f;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding char l[MAX_STRING_LEN];
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding const char *rpw, *w;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding apr_status_t status;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if ((status = ap_pcfg_openfile(&f, r->pool, auth_pwfile)) != APR_SUCCESS) {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding "Could not open password file: %s", auth_pwfile);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return NULL;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
7ddfd45e4d3d13de264931df8eb27ee7619fdb0ejerenkrantz while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if ((l[0] == '#') || (!l[0])) {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding continue;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding rpw = l;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding w = ap_getword(r->pool, &rpw, ':');
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if (!strcmp(user, w)) {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding ap_cfg_closefile(f);
dc80439e9fba60c753cd145cb6799409ffea9b71ronald return ap_getword(r->pool, &rpw, ':');
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron }
78b8e4dd910f03af0a602bc4b63ad7bc69868ee3sf }
78b8e4dd910f03af0a602bc4b63ad7bc69868ee3sf ap_cfg_closefile(f);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return NULL;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding}
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingstatic apr_table_t *groups_for_user(apr_pool_t *p, char *user, char *grpfile)
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding ap_configfile_t *f;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding apr_table_t *grps = apr_table_make(p, 15);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding apr_pool_t *sp;
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron char l[MAX_STRING_LEN];
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm const char *group_name, *ll, *w;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding apr_status_t status;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
c7de1955eb0eaeabf7042902476397692672d549sf if ((status = ap_pcfg_openfile(&f, p, grpfile)) != APR_SUCCESS) {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding/*add? aplog_error(APLOG_MARK, APLOG_ERR, NULL,
dc80439e9fba60c753cd145cb6799409ffea9b71ronald "Could not open group file: %s", grpfile);*/
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return NULL;
26dfa083a1662d57ba7cc410eec4e0696b9be469wrowe }
26dfa083a1662d57ba7cc410eec4e0696b9be469wrowe
26dfa083a1662d57ba7cc410eec4e0696b9be469wrowe apr_pool_create(&sp, p);
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron
29c30db45f6a469017e16b606611e460cc1a1f2caaron while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
29c30db45f6a469017e16b606611e460cc1a1f2caaron if ((l[0] == '#') || (!l[0])) {
43997561b2302d13dee973998e77743a3ddd2374trawick continue;
43997561b2302d13dee973998e77743a3ddd2374trawick }
97d20d37d21b8d427a920e211858172f0a82427epoirier ll = l;
dc80439e9fba60c753cd145cb6799409ffea9b71ronald apr_pool_clear(sp);
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron group_name = ap_getword(sp, &ll, ':');
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding while (ll[0]) {
4c25fdfa5f370d29e55aea846eb9fe6c1d51ede3wrowe w = ap_getword_conf(sp, &ll);
4c25fdfa5f370d29e55aea846eb9fe6c1d51ede3wrowe if (!strcmp(w, user)) {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding apr_table_setn(grps, apr_pstrdup(p, group_name), "in");
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding break;
138c8f7cb8254e035c6f45288e3909cd9c21be5cmartin }
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding ap_cfg_closefile(f);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding apr_pool_destroy(sp);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return grps;
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm}
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
185aa71728867671e105178b4c66fbc22b65ae26sf/* These functions return 0 if client is OK, and proper error status
678a15e91d6a44569c956445442731bb64a98a63sf * if not... either HTTP_UNAUTHORIZED, if we made a check, and it failed, or
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * HTTP_INTERNAL_SERVER_ERROR, if things are so totally confused that we
97d20d37d21b8d427a920e211858172f0a82427epoirier * couldn't figure out how to tell if the client is authorized or not.
97d20d37d21b8d427a920e211858172f0a82427epoirier *
97d20d37d21b8d427a920e211858172f0a82427epoirier * If they return DECLINED, and all other modules also decline, that's
97d20d37d21b8d427a920e211858172f0a82427epoirier * treated by the server core as a configuration error, logged and
97d20d37d21b8d427a920e211858172f0a82427epoirier * reported as such.
dc80439e9fba60c753cd145cb6799409ffea9b71ronald */
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron/* Determine user ID, and check if it really is that user, for HTTP
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * basic authentication...
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding */
dc80439e9fba60c753cd145cb6799409ffea9b71ronald
29c30db45f6a469017e16b606611e460cc1a1f2caaronstatic int authenticate_basic_user(request_rec *r)
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding auth_config_rec *conf = ap_get_module_config(r->per_dir_config,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding &auth_module);
dc80439e9fba60c753cd145cb6799409ffea9b71ronald const char *sent_pw;
29c30db45f6a469017e16b606611e460cc1a1f2caaron char *real_pw;
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron apr_status_t invalid_pw;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding int res;
d0a225bdac006f3361e80bfc1be7e6f9b0e81f80ronald
92108a6c4fd7ca6e9acc94d2485920436763e491sf if ((res = ap_get_basic_auth_pw(r, &sent_pw))) {
92108a6c4fd7ca6e9acc94d2485920436763e491sf return res;
d0a225bdac006f3361e80bfc1be7e6f9b0e81f80ronald }
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if (!conf->auth_pwfile) {
c7de1955eb0eaeabf7042902476397692672d549sf return DECLINED;
c7de1955eb0eaeabf7042902476397692672d549sf }
c7de1955eb0eaeabf7042902476397692672d549sf
c7de1955eb0eaeabf7042902476397692672d549sf if (!(real_pw = get_pw(r, r->user, conf->auth_pwfile))) {
c7de1955eb0eaeabf7042902476397692672d549sf if (!(conf->auth_authoritative)) {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return DECLINED;
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm }
c7de1955eb0eaeabf7042902476397692672d549sf ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
c7de1955eb0eaeabf7042902476397692672d549sf "user %s not found: %s", r->user, r->uri);
c7de1955eb0eaeabf7042902476397692672d549sf ap_note_basic_auth_failure(r);
c7de1955eb0eaeabf7042902476397692672d549sf return HTTP_UNAUTHORIZED;
c7de1955eb0eaeabf7042902476397692672d549sf }
c7de1955eb0eaeabf7042902476397692672d549sf invalid_pw = apr_password_validate(sent_pw, real_pw);
c7de1955eb0eaeabf7042902476397692672d549sf if (invalid_pw != APR_SUCCESS) {
c7de1955eb0eaeabf7042902476397692672d549sf ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
c7de1955eb0eaeabf7042902476397692672d549sf "user %s: authentication failure for \"%s\": "
c7de1955eb0eaeabf7042902476397692672d549sf "Password Mismatch",
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding r->user, r->uri);
c7de1955eb0eaeabf7042902476397692672d549sf ap_note_basic_auth_failure(r);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return HTTP_UNAUTHORIZED;
afd0a335375c636605c8625b0d5755dd2408be2btrawick }
c7de1955eb0eaeabf7042902476397692672d549sf return OK;
afd0a335375c636605c8625b0d5755dd2408be2btrawick}
c7de1955eb0eaeabf7042902476397692672d549sf
afd0a335375c636605c8625b0d5755dd2408be2btrawick/* Checking ID */
c7d0205ec1649076e7742d72a25ac53779768312stoddard
e1753aabf5df187b5b04e72a958af4b65b1a125daaronstatic int check_user_access(request_rec *r)
185aa71728867671e105178b4c66fbc22b65ae26sf{
16ceb754873fe06f67a9c52c45d1e583a0f112ddsf auth_config_rec *conf = ap_get_module_config(r->per_dir_config,
c7de1955eb0eaeabf7042902476397692672d549sf &auth_module);
e1753aabf5df187b5b04e72a958af4b65b1a125daaron char *user = r->user;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding int m = r->method_number;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding int method_restricted = 0;
c7de1955eb0eaeabf7042902476397692672d549sf register int x;
c7de1955eb0eaeabf7042902476397692672d549sf const char *t, *w;
e1753aabf5df187b5b04e72a958af4b65b1a125daaron apr_table_t *grpstatus;
c7de1955eb0eaeabf7042902476397692672d549sf const apr_array_header_t *reqs_arr = ap_requires(r);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding require_line *reqs;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm /* BUG FIX: tadc, 11-Nov-1995. If there is no "requires" directive,
dc80439e9fba60c753cd145cb6799409ffea9b71ronald * then any user will do.
185aa71728867671e105178b4c66fbc22b65ae26sf */
f7376afc33a9e035921be9114c0e246820d7c8besf if (!reqs_arr) {
f7376afc33a9e035921be9114c0e246820d7c8besf return OK;
dc80439e9fba60c753cd145cb6799409ffea9b71ronald }
dc80439e9fba60c753cd145cb6799409ffea9b71ronald reqs = (require_line *)reqs_arr->elts;
dc80439e9fba60c753cd145cb6799409ffea9b71ronald
dc80439e9fba60c753cd145cb6799409ffea9b71ronald if (conf->auth_grpfile) {
a6b9ed64fdf548c61de9714e2cfb999ec59d149cgstein grpstatus = groups_for_user(r->pool, user, conf->auth_grpfile);
a6b9ed64fdf548c61de9714e2cfb999ec59d149cgstein }
97d20d37d21b8d427a920e211858172f0a82427epoirier else {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding grpstatus = NULL;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding for (x = 0; x < reqs_arr->nelts; x++) {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if (!(reqs[x].method_mask & (AP_METHOD_BIT << m))) {
97d20d37d21b8d427a920e211858172f0a82427epoirier continue;
97d20d37d21b8d427a920e211858172f0a82427epoirier }
5bfaaf573bacb45c1cf290ce85ecc676587e8a64jim
5bfaaf573bacb45c1cf290ce85ecc676587e8a64jim method_restricted = 1;
97d20d37d21b8d427a920e211858172f0a82427epoirier
97d20d37d21b8d427a920e211858172f0a82427epoirier t = reqs[x].requirement;
1124a56faf0228410656abbe08451d7330d906e8trawick w = ap_getword_white(r->pool, &t);
1124a56faf0228410656abbe08451d7330d906e8trawick if (!strcmp(w, "valid-user")) {
97d20d37d21b8d427a920e211858172f0a82427epoirier return OK;
97d20d37d21b8d427a920e211858172f0a82427epoirier }
97d20d37d21b8d427a920e211858172f0a82427epoirier if (!strcmp(w, "user")) {
97d20d37d21b8d427a920e211858172f0a82427epoirier while (t[0]) {
97d20d37d21b8d427a920e211858172f0a82427epoirier w = ap_getword_conf(r->pool, &t);
185aa71728867671e105178b4c66fbc22b65ae26sf if (!strcmp(user, w)) {
5bfaaf573bacb45c1cf290ce85ecc676587e8a64jim return OK;
97d20d37d21b8d427a920e211858172f0a82427epoirier }
97d20d37d21b8d427a920e211858172f0a82427epoirier }
97d20d37d21b8d427a920e211858172f0a82427epoirier }
97d20d37d21b8d427a920e211858172f0a82427epoirier else if (!strcmp(w, "group")) {
97d20d37d21b8d427a920e211858172f0a82427epoirier if (!grpstatus) {
97d20d37d21b8d427a920e211858172f0a82427epoirier return DECLINED; /* DBM group? Something else? */
97d20d37d21b8d427a920e211858172f0a82427epoirier }
97d20d37d21b8d427a920e211858172f0a82427epoirier
97d20d37d21b8d427a920e211858172f0a82427epoirier while (t[0]) {
dc80439e9fba60c753cd145cb6799409ffea9b71ronald w = ap_getword_conf(r->pool, &t);
97d20d37d21b8d427a920e211858172f0a82427epoirier if (apr_table_get(grpstatus, w)) {
97d20d37d21b8d427a920e211858172f0a82427epoirier return OK;
dc80439e9fba60c753cd145cb6799409ffea9b71ronald }
dc80439e9fba60c753cd145cb6799409ffea9b71ronald }
97d20d37d21b8d427a920e211858172f0a82427epoirier }
97d20d37d21b8d427a920e211858172f0a82427epoirier else if (conf->auth_authoritative) {
dc80439e9fba60c753cd145cb6799409ffea9b71ronald /* if we aren't authoritative, any require directive could be
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron * valid even if we don't grok it. However, if we are
97d20d37d21b8d427a920e211858172f0a82427epoirier * authoritative, we can warn the user they did something wrong.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * That something could be a missing "AuthAuthoritative off", but
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * more likely is a typo in the require directive.
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron */
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron "access to %s failed, reason: unknown require "
dc80439e9fba60c753cd145cb6799409ffea9b71ronald "directive:\"%s\"", r->uri, reqs[x].requirement);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
024e70e05386a6367eb45d0d1cc406764520ff4cwrowe
024e70e05386a6367eb45d0d1cc406764520ff4cwrowe if (!method_restricted) {
dc80439e9fba60c753cd145cb6799409ffea9b71ronald return OK;
29c30db45f6a469017e16b606611e460cc1a1f2caaron }
97d20d37d21b8d427a920e211858172f0a82427epoirier
dc80439e9fba60c753cd145cb6799409ffea9b71ronald if (!(conf->auth_authoritative)) {
dc80439e9fba60c753cd145cb6799409ffea9b71ronald return DECLINED;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
97d20d37d21b8d427a920e211858172f0a82427epoirier "access to %s failed, reason: user %s not allowed access",
dc80439e9fba60c753cd145cb6799409ffea9b71ronald r->uri, user);
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron
97d20d37d21b8d427a920e211858172f0a82427epoirier ap_note_basic_auth_failure(r);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return HTTP_UNAUTHORIZED;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding}
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
024e70e05386a6367eb45d0d1cc406764520ff4cwrowestatic void register_hooks(apr_pool_t *p)
024e70e05386a6367eb45d0d1cc406764520ff4cwrowe{
dc80439e9fba60c753cd145cb6799409ffea9b71ronald ap_hook_check_user_id(authenticate_basic_user,NULL,NULL,APR_HOOK_MIDDLE);
29c30db45f6a469017e16b606611e460cc1a1f2caaron ap_hook_auth_checker(check_user_access,NULL,NULL,APR_HOOK_MIDDLE);
97d20d37d21b8d427a920e211858172f0a82427epoirier}
dc80439e9fba60c753cd145cb6799409ffea9b71ronald
dc80439e9fba60c753cd145cb6799409ffea9b71ronaldmodule AP_MODULE_DECLARE_DATA auth_module =
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding STANDARD20_MODULE_STUFF,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding create_auth_dir_config, /* dir config creater */
97d20d37d21b8d427a920e211858172f0a82427epoirier NULL, /* dir merger --- default is to override */
dc80439e9fba60c753cd145cb6799409ffea9b71ronald NULL, /* server config */
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron NULL, /* merge server config */
97d20d37d21b8d427a920e211858172f0a82427epoirier auth_cmds, /* command apr_table_t */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding register_hooks /* register hooks */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding};
0ec6007a40ac877a7c8d87767ca8e306d89f6595aaron