Apache::AuthzPasswd - mod_perl /etc/group Group Authorization module
<Directory /foo/bar> # This is the standard authentication stuff AuthName "Foo Bar Authentication" AuthType Basic # The following is needed when you will authenticate # via /etc/passwd as well as authorize via /etc/group. # Apache::AuthenPasswd is a separate module. PerlAuthenHandler Apache::AuthenPasswd # Set REMOTE_GROUP CGI env variable to authorized # group. Defaults to no. PerlSetVar SetRemoteGroup yes || no # Standard require stuff, users, groups and # "valid-user" all work OK require user username1 username2 ... require group groupname1 groupname2 ... require valid-user PerlAuthzHandler Apache::AuthzPasswd </Directory> These directives can also be used in the <Location> directive or in an .htaccess file.
= head1 DESCRIPTION
For starters, this module could just as well be named Apache::AuthzGroup, since it has nothing to do with /etc/passwd, but rather works with /etc/group. However, I prefer this name in order to maintain the association with Apache::AuthenPasswd, since chances are they will be used together.
(SPEEVES NOTE: This module does not seem to work without some sort of Authentication module used in conjunction with it... I haven't looked extensively, but my testing always failed with a:
couldn't check user. No user file?
error in the apache logs when I didn't have a module working at the authentication level.)
This perl module is designed to work with mod_perl and the Apache::AuthenPasswd module by Demetrios E. Paneras (email@example.com). It is a direct adaptation (i.e. I modified the code) of Michael Parker's (firstname.lastname@example.org) Apache::AuthenSmb module (which also included an authorization routine).
The module calls getgrnam using each of the require group elements as keys, until a match with the (already authenticated) user is found.
For completeness, the module also handles require user and require valid-user directives.
= head2 PerlSetVar SetRemoteGroup
Set to "yes" to set the CGI env variable REMOTE_GROUP to the group of the authorized user. Defaults to "no".
= head2 Apache::AuthenPasswd vs. Apache::AuthzPasswd
I've taken "authentication" to be meaningful only in terms of a user and password combination, not group membership. This means that you can use Apache::AuthenPasswd with the require user and require valid-user directives. In the /etc/passwd and /etc/group context I consider require group to be an "authorization" concern. I.e., group authorization consists of establishing whether the already authenticated user is a member of one of the indicated groups in the require group directive. This process may be handled by Apache::AuthzPasswd. Admittedly, AuthzPasswd is a misnomer, but I wanted to keep AuthenPasswd and AuthzPasswd related, if only by name.
I welcome any feedback on this module, esp. code improvements, given that it was written hastily, to say the least.
Demetrios E. Paneras <email@example.com> and Shannon Eric Peevey <firstname.lastname@example.org>
Copyright (c) 1998,2003 Demetrios E. Paneras, MIT Media Laboratory.
This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.