modules/aaa/mod_authz_dbd.c

	mod_authz_dbd.c revision 2e242dca7111f99d54dd144b7b8418d88d560032
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding/* Licensed to the Apache Software Foundation (ASF) under one or more
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * contributor license agreements.  See the NOTICE file distributed with
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * this work for additional information regarding copyright ownership.
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * The ASF licenses this file to You under the Apache License, Version 2.0
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * (the "License"); you may not use this file except in compliance with
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding * the License.  You may obtain a copy of the License at
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *     http://www.apache.org/licenses/LICENSE-2.0
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding * Unless required by applicable law or agreed to in writing, software
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding * distributed under the License is distributed on an "AS IS" BASIS,
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding * See the License for the specific language governing permissions and
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding * limitations under the License.
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding */
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "httpd.h"
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "http_log.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_config.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "ap_provider.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_request.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_protocol.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_core.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "apr_dbd.h"
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "mod_dbd.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "apr_strings.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "mod_authz_dbd.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "mod_auth.h"
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffieldingmodule AP_MODULE_DECLARE_DATA authz_dbd_module;
64185f9824e42f21ca7b9ae6c004484215c031a7rbb
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding/* Export a hook for modules that manage clientside sessions
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * (e.g. mod_auth_cookie)
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * to deal with those when we successfully login/logout at the server
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding *
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * XXX: WHY would this be specific to dbd_authz?  Why wouldn't we track
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding * this across all authz user providers in a lower level mod, such as
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * mod_auth_basic/digest?
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding */
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffieldingAPR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(authz_dbd, AUTHZ_DBD, int, client_login,
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding                            (request_rec *r, int code, const char *action),
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding                            (r, code, action), OK, DECLINED)
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingtypedef struct {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    const char *query;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    const char *redir_query;
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding    int redirect;
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding} authz_dbd_cfg ;
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic ap_dbd_t *(*dbd_handle)(request_rec*) = NULL;
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffieldingstatic void (*dbd_prepare)(server_rec*, const char*, const char*) = NULL;
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffieldingstatic const char *const noerror = "???";
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic void *authz_dbd_cr_cfg(apr_pool_t *pool, char *dummy)
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    authz_dbd_cfg *ret = apr_pcalloc(pool, sizeof(authz_dbd_cfg));
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    ret->redirect = -1;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    return ret;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic void *authz_dbd_merge_cfg(apr_pool_t *pool, void *BASE, void *ADD)
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    authz_dbd_cfg *base = BASE;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    authz_dbd_cfg *add = ADD;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    authz_dbd_cfg *ret = apr_palloc(pool, sizeof(authz_dbd_cfg));
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    ret->query = (add->query == NULL) ? base->query : add->query;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    ret->redir_query = (add->redir_query == NULL)
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                            ? base->redir_query : add->redir_query;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    ret->redirect = (add->redirect == -1) ? base->redirect : add->redirect;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    return ret;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic const char *authz_dbd_prepare(cmd_parms *cmd, void *cfg,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                                     const char *query)
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    static unsigned int label_num = 0;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    char *label;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    if (dbd_prepare == NULL) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        dbd_prepare = APR_RETRIEVE_OPTIONAL_FN(ap_dbd_prepare);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        if (dbd_prepare == NULL) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding            return "You must load mod_dbd to enable AuthzDBD functions";
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        dbd_handle = APR_RETRIEVE_OPTIONAL_FN(ap_dbd_acquire);
2d71630471d1c23f0137309e3c3957c633ecbfd6rbb    }
ab5581cc78e9d865b0a6ab1404c53347b3276968rbb    label = apr_psprintf(cmd->pool, "authz_dbd_%d", ++label_num);
b6055b7832a0e4d0818416252fff5925aaebae4brbb
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    dbd_prepare(cmd->server, query, label);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
2eaf6dbe7ea643b3a2b8e1973d9684fac6372c46trawick    /* save the label here for our own use */
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    return ap_set_string_slot(cmd, cfg, label);
3d96ee83babeec32482c9082c9426340cee8c44dwrowe}
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic const command_rec authz_dbd_cmds[] = {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    AP_INIT_FLAG("AuthzDBDLoginToReferer", ap_set_flag_slot,
10a4cdd68ef1ca0e54af296fe1d08ac00150c90bwrowe                 (void*)APR_OFFSETOF(authz_dbd_cfg, redirect), ACCESS_CONF,
b8dd12594991e5c275d82fca865d13c5f9775f4efielding                 "Whether to redirect to referer on successful login"),
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    AP_INIT_TAKE1("AuthzDBDQuery", authz_dbd_prepare,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                  (void*)APR_OFFSETOF(authz_dbd_cfg, query), ACCESS_CONF,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                  "SQL query for DBD Authz or login"),
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    AP_INIT_TAKE1("AuthzDBDRedirectQuery", authz_dbd_prepare,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                  (void*)APR_OFFSETOF(authz_dbd_cfg, redir_query), ACCESS_CONF,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                  "SQL query to get per-user redirect URL after login"),
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    {NULL}
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm};
db3fa7db7c7910f2f23c3e3ffe0cf9f41a1899b9trawick
333d217f9ee70eb89cb5d5a30bf08a0032f571fftrawickstatic int authz_dbd_login(request_rec *r, authz_dbd_cfg *cfg,
2eaf6dbe7ea643b3a2b8e1973d9684fac6372c46trawick                           const char *action)
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm{
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm    int rv;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    const char *newuri = NULL;
b8dd12594991e5c275d82fca865d13c5f9775f4efielding    int nrows;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    const char *message;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    ap_dbd_t *dbd = dbd_handle(r);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    apr_dbd_prepared_t *query;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    apr_dbd_results_t *res = NULL;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    apr_dbd_row_t *row = NULL;
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    if (cfg->query == NULL) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
3d96ee83babeec32482c9082c9426340cee8c44dwrowe                      "No query configured for %s!", action);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        return HTTP_INTERNAL_SERVER_ERROR;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    query = apr_hash_get(dbd->prepared, cfg->query, APR_HASH_KEY_STRING);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    if (query == NULL) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                      "Error retrieving Query for %s!", action);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        return HTTP_INTERNAL_SERVER_ERROR;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    rv = apr_dbd_pvquery(dbd->driver, r->pool, dbd->handle, &nrows,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                         query, r->user, NULL);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    if (rv == 0) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        if (nrows != 1) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding            ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                          "authz_dbd: %s of user %s updated %d rows",
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                          action, r->user, nrows);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    else {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        message = apr_dbd_error(dbd->driver, dbd->handle, rv);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                      "authz_dbd: query for %s failed; user %s [%s]",
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                      action, r->user, message?message:noerror);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        return HTTP_INTERNAL_SERVER_ERROR;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    if (cfg->redirect == 1) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        newuri = apr_table_get(r->headers_in, "Referer");
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    if (!newuri && cfg->redir_query) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        query = apr_hash_get(dbd->prepared, cfg->redir_query,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                             APR_HASH_KEY_STRING);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        if (query == NULL) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                          "authz_dbd: no redirect query!");
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding            /* OK, this is non-critical; we can just not-redirect */
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        else if (apr_dbd_pvselect(dbd->driver, r->pool, dbd->handle, &res,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                                  query, 0, r->user, NULL) == 0) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding            for (rv = apr_dbd_get_row(dbd->driver, r->pool, res, &row, -1);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                 rv != -1;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                 rv = apr_dbd_get_row(dbd->driver, r->pool, res, &row, -1)) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                if (rv != 0) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                    message = apr_dbd_error(dbd->driver, dbd->handle, rv);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                          "authz_dbd in get_row; action=%s user=%s [%s]",
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                          action, r->user, message?message:noerror);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                }
3d96ee83babeec32482c9082c9426340cee8c44dwrowe                else if (newuri == NULL) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                    newuri = apr_dbd_get_entry(dbd->driver, row, 0);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                /* we can't break out here or row won't get cleaned up */
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding            }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        else {
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm            message = apr_dbd_error(dbd->driver, dbd->handle, rv);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm                          "authz_dbd/redirect for %s of %s [%s]",
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                          action, r->user, message?message:noerror);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    if (newuri != NULL) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        r->status = HTTP_MOVED_TEMPORARILY;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        apr_table_set(r->err_headers_out, "Location", newuri);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    authz_dbd_run_client_login(r, OK, action);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    return OK;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic int authz_dbd_group_query(request_rec *r, authz_dbd_cfg *cfg,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                                 apr_array_header_t *groups)
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    /* SELECT group FROM authz WHERE user = %s */
3d96ee83babeec32482c9082c9426340cee8c44dwrowe    int rv;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    const char *message;
10a4cdd68ef1ca0e54af296fe1d08ac00150c90bwrowe    ap_dbd_t *dbd = dbd_handle(r);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    apr_dbd_prepared_t *query;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    apr_dbd_results_t *res = NULL;
f92e51e1951be0ef34da086bdff019d8ddc71c63rbb    apr_dbd_row_t *row = NULL;
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm    const char **group;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm    if (cfg->query == NULL) {
7431131ef5bf15f103cf5f338407ccabb716c0c0rbb        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm                      "No query configured for dbd-group!");
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        return HTTP_INTERNAL_SERVER_ERROR;
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm    }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    query = apr_hash_get(dbd->prepared, cfg->query, APR_HASH_KEY_STRING);
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm    if (query == NULL) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                      "Error retrieving query for dbd-group!");
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding        return HTTP_INTERNAL_SERVER_ERROR;
    }
    rv = apr_dbd_pvselect(dbd->driver, r->pool, dbd->handle, &res,
                          query, 0, r->user, NULL);
    if (rv == 0) {
        for (rv = apr_dbd_get_row(dbd->driver, r->pool, res, &row, -1);
             rv != -1;
             rv = apr_dbd_get_row(dbd->driver, r->pool, res, &row, -1)) {
            if (rv == 0) {
                group = apr_array_push(groups);
                *group = apr_dbd_get_entry(dbd->driver, row, 0);
            }
            else {
                message = apr_dbd_error(dbd->driver, dbd->handle, rv);
                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
                        "authz_dbd in get_row; group query for user=%s [%s]",
                        r->user, message?message:noerror);
                return HTTP_INTERNAL_SERVER_ERROR;
            }
        }
    }
    else {
        message = apr_dbd_error(dbd->driver, dbd->handle, rv);
        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
                      "authz_dbd, in groups query for %s [%s]",
                      r->user, message?message:noerror);
        return HTTP_INTERNAL_SERVER_ERROR;
    }
    return OK;
}

static authz_status dbdgroup_check_authorization(request_rec *r,
                                              const char *require_args)
{
    int i, rv;
    const char *w;
    apr_array_header_t *groups = NULL;
    const char *t;
    authz_dbd_cfg *cfg = ap_get_module_config(r->per_dir_config,
                                              &authz_dbd_module);

    if (groups == NULL) {
        groups = apr_array_make(r->pool, 4, sizeof(const char*));
        rv = authz_dbd_group_query(r, cfg, groups);
        if (rv != OK) {
            return AUTHZ_GENERAL_ERROR;
        }
    }

    t = require_args;
    while (t[0]) {
        w = ap_getword_white(r->pool, &t);
        for (i=0; i < groups->nelts; ++i) {
            if (!strcmp(w, ((const char**)groups->elts)[i])) {
                return AUTHZ_GRANTED;
            }
        }
    }

    return AUTHZ_DENIED;
}

static authz_status dbdlogin_check_authorization(request_rec *r,
                                              const char *require_args)
{
    authz_dbd_cfg *cfg = ap_get_module_config(r->per_dir_config,
                                              &authz_dbd_module);

    return (authz_dbd_login(r, cfg, "login") == OK ? AUTHZ_GRANTED : AUTHZ_DENIED);
}

static authz_status dbdlogout_check_authorization(request_rec *r,
                                              const char *require_args)
{
    authz_dbd_cfg *cfg = ap_get_module_config(r->per_dir_config,
                                              &authz_dbd_module);

    return (authz_dbd_login(r, cfg, "logout") == OK ? AUTHZ_GRANTED : AUTHZ_DENIED);
}

static const authz_provider authz_dbdgroup_provider =
{
    &dbdgroup_check_authorization,
};

static const authz_provider authz_dbdlogin_provider =
{
    &dbdlogin_check_authorization,
};


static const authz_provider authz_dbdlogout_provider =
{
    &dbdlogout_check_authorization,
};

static void authz_dbd_hooks(apr_pool_t *p)
{
    ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "dbd-group",
                              AUTHZ_PROVIDER_VERSION,
                              &authz_dbdgroup_provider,
                              AP_AUTH_INTERNAL_PER_CONF);
    ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "dbd-login",
                              AUTHZ_PROVIDER_VERSION,
                              &authz_dbdlogin_provider,
                              AP_AUTH_INTERNAL_PER_CONF);
    ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "dbd-logout",
                              AUTHZ_PROVIDER_VERSION,
                              &authz_dbdlogout_provider,
                              AP_AUTH_INTERNAL_PER_CONF);
}

module AP_MODULE_DECLARE_DATA authz_dbd_module =
{
    STANDARD20_MODULE_STUFF,
    authz_dbd_cr_cfg,
    authz_dbd_merge_cfg,
    NULL,
    NULL,
    authz_dbd_cmds,
    authz_dbd_hooks
};