NAME
Apache::AuthzPasswd - mod_perl /etc/group Group
Authorization module
SYNOPSIS
<Directory /foo/bar>
# This is the standard authentication stuff
AuthName "Foo Bar Authentication"
AuthType Basic
# The following is needed when you will authenticate
# via /etc/passwd as well as authorize via /etc/group.
# Apache::AuthenPasswd is a separate module.
PerlAuthenHandler Apache::AuthenPasswd
# Standard require stuff, users, groups and
# "valid-user" all work OK
require user username1 username2 ...
require group groupname1 groupname2 ...
require valid-user
PerlAuthzHandler Apache::AuthzPasswd
</Directory>
These directives can also be used in the <Location> directive or in
an .htaccess file.
DESCRIPTION
For starters, this module could just as well be named
Apache::AuthzGroup, since it has nothing to do with
/etc/passwd, but rather works with /etc/group. However, I
prefer this name in order to maintain the association with
Apache::AuthenPasswd, since chances are they will be used
together.
(SPEEVES NOTE: This module does not seem to work without
some sort of Authentication module used in conjunction with
it... I haven't looked extensively, but my testing always
failed with a:
couldn't check user. No user file?
error in the apache logs when I didn't have a module working
at the authentication level.)
This perl module is designed to work with mod_perl and the
Apache::AuthenPasswd module by Demetrios E. Paneras
(dep@media.mit.edu). It is a direct adaptation (i.e. I
modified the code) of Michael Parker's
(parker@austx.tandem.com) Apache::AuthenSmb module (which
also included an authorization routine).
The module calls getgrnam using each of the require group
elements as keys, until a match with the (already
authenticated) user is found.
For completeness, the module also handles require user and
require valid-user directives.
PerlSetVar SetRemoteGroup
This allows us to modify the REMOTE_GROUP CGI env variable.
When set to "yes" it sets REMOTE_GROUP to the group of the
authorized user. Defaults to "no".
Apache::AuthenPasswd vs. Apache::AuthzPasswd
I've taken "authentication" to be meaningful only in terms
of a user and password combination, not group membership.
This means that you can use Apache::AuthenPasswd with the
require user and require valid-user directives. In the
/etc/passwd and /etc/group context I consider require group
to be an "authorization" concern. I.e., group authorization
consists of establishing whether the already authenticated
user is a member of one of the indicated groups in the
require group directive. This process may be handled by
Apache::AuthzPasswd. Admittedly, AuthzPasswd is a misnomer,
but I wanted to keep AuthenPasswd and AuthzPasswd related,
if only by name.
I welcome any feedback on this module, esp. code
improvements, given that it was written hastily, to say the
least.
AUTHOR
Demetrios E. Paneras <dep@media.mit.edu>
COPYRIGHT
Copyright (c) 1998 Demetrios E. Paneras, MIT Media
Laboratory.
This library is free software; you can redistribute it
and/or modify it under the same terms as Perl itself.