-

-

-

-

-

-

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="directive-section"><h2><a name="AsyncRequestWorkerFactor" id="AsyncRequestWorkerFactor">AsyncRequestWorkerFactor</a> <a name="asyncrequestworkerfactor" id="asyncrequestworkerfactor">Directive</a></h2>

-<table class="directive">

-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Limit concurrent connections per process</td></tr>

-<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AsyncRequestWorkerFactor <var>factor</var></code></td></tr>

-<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>2</code></td></tr>

-<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>

-<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>MPM</td></tr>

-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>event</td></tr>

-<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.3.13 and later</td></tr>

-</table>

- <p>The event MPM handles some connections in an asynchronous way, where

- request worker threads are only allocated for short periods of time as

- needed, and other connections with one request worker thread reserved per

- connection. This can lead to situations where all workers are tied up and

- no worker thread is available to handle new work on established async

- connections.</p>

-

- <p>To mitigate this problem, the event MPM does two things: Firstly, it

- limits the number of connections accepted per process, depending on the

- number of idle request workers. Secondly, if all workers are busy, it will

- close connections in keep-alive state even if the keep-alive timeout has

- not expired. This allows the respective clients to reconnect to a

- different process which may still have worker threads available.</p>

-

- <p>This directive can be used to fine-tune the per-process connection

- limit. A process will only accept new connections if the current number of

- connections (not counting connections in the "closing" state) is lower

- than:</p>

-

- <p class="indent"><strong>

- <code class="directive"><a href="../mod/mpm_common.html#threadsperchild">ThreadsPerChild</a></code> +

- (<code class="directive">AsyncRequestWorkerFactor</code> *

- <var>number of idle workers</var>)

- </strong></p>

-

- <p>This means the absolute maximum numbers of concurrent connections is:</p>

-

- <p class="indent"><strong>

- (<code class="directive">AsyncRequestWorkerFactor</code> + 1) *

- <code class="directive"><a href="../mod/mpm_common.html#maxrequestworkers">MaxRequestWorkers</a></code>

- </strong></p>

-

- <p><code class="directive"><a href="../mod/mpm_common.html#maxrequestworkers">MaxRequestWorkers</a></code> was called

- <code class="directive">MaxClients</code> prior to version 2.3.13. The above value

- shows that the old name did not accurately describe its meaning for the event MPM.</p>

-

- <p><code class="directive">AsyncRequestWorkerFactor</code> can take non-integer

- arguments, e.g "1.5".</p>

-

-

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="directive-section"><h2><a name="asyncrequestworkerfactor" id="asyncrequestworkerfactor">Directive</a> <a name="AsyncRequestWorkerFactor" id="AsyncRequestWorkerFactor">AsyncRequestWorkerFactor</a></h2>

-<table class="directive">

-<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Limite le nombre de connexions simultan�es par thread</td></tr>

-<tr><th><a href="directive-dict.html#Syntax">Syntaxe:</a></th><td><code>AsyncRequestWorkerFactor <var>facteur</var></code></td></tr>

-<tr><th><a href="directive-dict.html#Default">D�faut:</a></th><td><code>2</code></td></tr>

-<tr><th><a href="directive-dict.html#Context">Contexte:</a></th><td>configuration du serveur</td></tr>

-<tr><th><a href="directive-dict.html#Status">Statut:</a></th><td>MPM</td></tr>

-<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>event</td></tr>

-<tr><th><a href="directive-dict.html#Compatibility">Compatibilit�:</a></th><td>Disponible depuis la version 2.3.13</td></tr>

-</table>

- <p>Le MPM event g�re certaines connexions de mani�re asynchrone ;

- dans ce cas, les threads traitant la requ�te sont allou�s selon les

- besoins et pour de courtes p�riodes. Dans les autres cas, un

- thread est r�serv� par

- connexion. Ceci peut conduire � des situations o� tous les threads

- sont satur�s et o� aucun thread n'est capable d'effectuer de

- nouvelles t�ches pour les connexions asynchrones �tablies.</p>

-

- <p>Pour minimiser les effets de ce probl�me, le MPM event utilise

- deux m�thodes : tout d'abord, il limite le nombre de connexions

- simultan�es par thread en fonction du nombre de processus

- inactifs. Ensuite, si tous les processus sont occup�s, il ferme des

- connexions permanentes, m�me si la limite de dur�e de la connexion

- n'a pas �t� atteinte. Ceci autorise les clients concern�s � se

- reconnecter � un autre processus poss�dant encore des threads

- disponibles.</p>

-

- <p>Cette directive permet de personnaliser finement la limite du

- nombre de connexions par thread. Un processus n'acceptera de

- nouvelles connexions que si le nombre actuel de connexions (sans

- compter les connexions � l'�tat "closing") est

- inf�rieur � :</p>

-

- <p class="indent"><strong>

- <code class="directive"><a href="../mod/mpm_common.html#threadsperchild">ThreadsPerChild</a></code> +

- (<code class="directive">AsyncRequestWorkerFactor</code> *

- <var>nombre de threads inactifs</var>)

- </strong></p>

-

- <p>En d'autres termes, le nombre maximum de connexions simultan�es

- sera :</p>

-

- <p class="indent"><strong>

- (<code class="directive">AsyncRequestWorkerFactor</code> + 1) *

- <code class="directive"><a href="../mod/mpm_common.html#maxrequestworkers">MaxRequestWorkers</a></code>

- </strong></p>

-

- <p>La directive <code class="directive"><a href="../mod/mpm_common.html#maxrequestworkers">MaxRequestWorkers</a></code> se nommait

- <code class="directive">MaxClients</code> avant la version 2.3.13. La valeur

- ci-dessus montre que cet ancien nom ne correspondait pas � sa

- signification exacte pour le MPM event.</p>

-

- <p>La directive <code class="directive">AsyncRequestWorkerFactor</code>

- accepte des valeurs d'argument de type non entier, comme "1.5".</p>

-

-

-</div>

-

-

-

-

-

-

-

-

-<div class="section">

-<h2><a name="order" id="order">Order of Processing</a></h2>

-

- <p>Aliases and Redirects occurring in different contexts are processed

- like other directives according to standard <a href="../sections.html#mergin">merging rules</a>. But when multiple

- Aliases or Redirects occur in the same context (for example, in the

- same <code class="directive"><a href="../mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>

- section) they are processed in a particular order.</p>

-

- <p>First, all Redirects are processed before Aliases are processed,

- and therefore a request that matches a <code class="directive"><a href="#redirect">Redirect</a></code> or <code class="directive"><a href="#redirectmatch">RedirectMatch</a></code> will never have Aliases

- applied. Second, the Aliases and Redirects are processed in the order

- they appear in the configuration files, with the first match taking

- precedence.</p>

-

- <p>For this reason, when two or more of these directives apply to the

- same sub-path, you must list the most specific path first in order for

- all the directives to have an effect. For example, the following

- configuration will work as expected:</p>

-

- <pre class="prettyprint lang-config">Alias "/foo/bar" "/baz"

-Alias "/foo" "/gaq"</pre>

-

-

- <p>But if the above two directives were reversed in order, the

- <code>/foo</code> <code class="directive"><a href="#alias">Alias</a></code>

- would always match before the <code>/foo/bar</code> <code class="directive"><a href="#alias">Alias</a></code>, so the latter directive would be

- ignored.</p>

-

- <p>When the <code class="directive"><a href="#alias">Alias</a></code>,

- <code class="directive"><a href="#scriptalias">ScriptAlias</a></code> and

- <code class="directive"><a href="#redirect">Redirect</a></code> directives are used

- within a <code class="directive"><a href="../mod/core.html#location">&lt;Location&gt;</a></code>

- or <code class="directive"><a href="../mod/core.html#locationmatch">&lt;LocationMatch&gt;</a></code>

- section, these directives will take precedence over any globally

- defined <code class="directive"><a href="#alias">Alias</a></code>,

- <code class="directive"><a href="#scriptalias">ScriptAlias</a></code> and

- <code class="directive"><a href="#redirect">Redirect</a></code> directives.</p>

-

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="order" id="order">Chronologie du traitement</a></h2>

-

- <p>Les alias et redirections apparaissant dans diff�rents contextes

- sont trait�s comme les autres directives en respectant les <a href="../sections.html#mergin">r�gles de fusion</a> standards. Par

- contre, ils sont trait�s selon une chronologie particuli�re

- lorsqu'ils apparaissent dans le m�me contexte (par exemple, dans la

- m�me section <code class="directive"><a href="../mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>).</p>

-

- <p>Premi�rement, toutes les redirections sont trait�es avant les

- alias, et ainsi, une requ�te qui correspond � une directive

- <code class="directive"><a href="#redirect">Redirect</a></code> ou <code class="directive"><a href="#redirectmatch">RedirectMatch</a></code> ne se verra jamais

- appliquer d'alias. Deuxi�mement, les alias et redirections sont

- trait�s selon l'ordre dans lequel ils apparaissent dans le fichier

- de configuration, seule la premi�re correspondance �tant prise en

- compte.</p>

-

- <p>Ainsi, lorsqu'une ou plusieurs de ces directives s'appliquent au

- m�me sous-r�pertoire, vous devez classer les chemins du plus pr�cis

- au moins pr�cis afin que toutes les directives puissent

- �ventuellement s'appliquer, comme dans l'exemple suivant :</p>

-

- <pre class="prettyprint lang-config">Alias /foo/bar /baz

-Alias /foo /gaq</pre>

-

-

- <p>Si l'ordre des directives �tait invers�, la directive <code class="directive"><a href="#alias">Alias</a></code> ayant pour argument

- <code>/foo</code> serait toujours appliqu�e avant la directive

- <code class="directive"><a href="#alias">Alias</a></code> ayant pour argument

- <code>/foo/bar</code>, et cette derni�re serait toujours

- ignor�e.</p>

-

- <p>La d�finition de directives <code class="directive"><a href="#alias">Alias</a></code>, <code class="directive"><a href="#scriptalias">ScriptAlias</a></code> ou <code class="directive"><a href="#redirect">Redirect</a></code> au sein de sections

- <code class="directive"><a href="../mod/core.html#location">&lt;Location&gt;</a></code> ou

- <code class="directive"><a href="../mod/core.html#locationmatch">&lt;LocationMatch&gt;</a></code>

- l'emporte sur d'autres d�finitions �ventuelles de ces m�mes

- directives au niveau de la configuration g�n�rale du serveur.</p>

-

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="order" id="order">処理の順番</a></h2>

-

-<p>様々なコンテキスト中での Alias や Redirect は他のディレクティブと

-同じように標準の <a href="../sections.html#mergin">マージ規則</a> に

-従って処理されます。ただし、(例えば <code class="directive"><a href="../mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> セクションの中のように) 複数の Alias や Redirect が

-同じコンテキスト中に現れた場合は決まった順番で処理されます。</p>

-

-<p>まず、Alias の前にすべての Redirect が処理されます。ですから、<code class="directive"><a href="#redirect">Redirect</a></code> か <code class="directive"><a href="#redirectmatch">RedirectMatch</a></code> にマッチするリクエストには

-Alias は決して適用されません。次に、Alias と Redirect が設定ファイル中の

-順番に適用され、最初にマッチしたものが優先されます。</p>

-

-<p>ですから、二つ以上のディレクティブが同じパスに適用されるときは、

-すべてのディレクティブの効果を得るためにはより詳しいパスを先に書く

-必要があります。例えば、次の設定は期待通りの動作をします:</p>

-

-<div class="example"><p><code>

-Alias /foo/bar /baz<br />

-Alias /foo /gaq

-</code></p></div>

-

-<p>しかし、上記の二つのディレクティブの順番が逆になると、

-<code>/foo</code> <code class="directive"><a href="#alias">Alias</a></code> が

-常に <code>/foo/bar</code> <code class="directive"><a href="#alias">Alias</a></code> より先にマッチしますので、後者は

-決して適用されることはありません。</p>

-

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="order" id="order">ó�� ����</a></h2>

-

-<p>���� �ٸ� �����ҿ��� Alias�� Redirect�� ����ϸ� �ٸ� ���þ��

-���� ǥ�� <a href="../sections.html#mergin">���� ���</a>��

-���� ó���Ѵ�. �׷��� ���� �����ҿ� (���� ���, ���� <code class="directive"><a href="../mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> ���ǿ�)

-Alias�� Redirect�� ����ϸ� �Ʒ� ������� ó���Ѵ�.</p>

-

-<p>���� ��� Redirect�� ó���� �� Alias�� ó���Ѵ�. �׷���

-<code class="directive"><a href="#redirect">Redirect</a></code>�� <code class="directive"><a href="#redirectmatch">RedirectMatch</a></code>�� �ش��ϴ� ��û��

-����� Alias���� �ʴ´�. �׸��� Alias�� Redirect�� �������Ͽ���

-ù��°�� ������ ���� ����Ѵ�.</p>

-

-<p>�׷��� ���� ���þ ������ ������ο� �ش��ϴ� ��� ���

-���þ �����ϱ����ؼ��� ���� ���� ��θ� ���� ����ؾ� �Ѵ�.

-���� ���, ���� ������ �ǵ��Ѵ�� �����Ѵ�:</p>

-

-<div class="example"><p><code>

-Alias /foo/bar /baz<br />

-Alias /foo /gaq

-</code></p></div>

-

-<p>�׷��� ���� �� ���þ� ������ �ٲٸ� <code>/foo/bar</code>

-<code class="directive"><a href="#alias">Alias</a></code> ������

-<code>/foo</code> <code class="directive"><a href="#alias">Alias</a></code>��

-�����ϹǷ� �׻� �ι�° ���þ �����Ѵ�.</p>

-

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="order" id="order">İşlem Sırası</a></h2>

-

- <p>Farklı bağlamlarda bulunan <code class="directive"><a href="#alias">Alias</a></code> ve <code class="directive"><a href="#redirect">Redirect</a></code>

- yönergeleri standart <a href="../sections.html#mergin">katıştırma

- kuralları</a> ile ilgili diğer yönergeler gibi işleme sokulur. Fakat

- aynı bağlam dahilinde (örneğin, aynı <code class="directive"><a href="../mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> bölümünde) çok fazla <code class="directive"><a href="#alias">Alias</a></code> ve <code class="directive"><a href="#redirect">Redirect</a></code> varsa bunlar belli bir

- sıraya göre işleme sokulurlar.</p>

-

- <p>İlk adımda, <code class="directive"><a href="#alias">Alias</a></code>’lardan önce

- bütün <code class="directive"><a href="#redirect">Redirect</a></code> yönergeleri

- işleme sokulur. Bu bakımdan bir <code class="directive"><a href="#redirect">Redirect</a></code> veya <code class="directive"><a href="#redirectmatch">RedirectMatch</a></code> ile eşleşen bir istek için

- hiçbir <code class="directive"><a href="#alias">Alias</a></code>

- uygulanmayacaktır. İkinci adımda yapılandırma dosyasında yer aldıkları

- sıraya göre <code class="directive"><a href="#redirect">Redirect</a></code> ve

- <code class="directive"><a href="#alias">Alias</a></code> yönergeleri işleme

- sokulurlar, dolayısıyla ilk eşleşme öncelikli olmuş olur.</p>

-

- <p>İlk eşleşmenin öncelikli olması sebebiyle, bu yönergelerin birden

- fazlası aynı alt yola uygulandığı takdirde, tüm yönergelerin etkili

- olabilmesi için en uzun yolu sıralamada en öne almalısınız. Örneğin

- aşağıdaki yapılandırma beklendiği gibi çalışacaktır:</p>

-

- <pre class="prettyprint lang-config">Alias /foo/bar /baz

-Alias /foo /gaq</pre>

-

-

- <p>Ama yukarıdaki iki satır ters sırada yerleştirilmiş olsaydı,

- <code>/foo</code> rumuzu daima <code>/foo/bar</code> rumuzundan önce

- eşleşecek, dolayısıyla ikinci yönerge yok sayılacaktı.</p>

-

- <p><code class="directive"><a href="#alias">Alias</a></code>,

- <code class="directive"><a href="#scriptalias">ScriptAlias</a></code> ve

- <code class="directive"><a href="#redirect">Redirect</a></code>

- yönergeleri bir <code class="directive"><a href="../mod/core.html#location">&lt;Location&gt;</a></code> veya <code class="directive"><a href="../mod/core.html#locationmatch">&lt;LocationMatch&gt;</a></code> bölümü içinde kullanıldığında

- bu yönergeler genel alanda tanımlanmış <code class="directive"><a href="#alias">Alias</a></code>,

- <code class="directive"><a href="#scriptalias">ScriptAlias</a></code> ve

- <code class="directive"><a href="#redirect">Redirect</a></code> yönergelerine göre

- öncelik alırlar.</p>

-

- </div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-

-

-

-

-

-

-<div class="section">

-<h2><a name="using" id="using">Using Digest Authentication</a></h2>

-

- <p>To use MD5 Digest authentication, simply

- change the normal <code>AuthType Basic</code> and

- <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code>

- to <code>AuthType Digest</code> and

- <code class="directive"><a href="#authdigestprovider">AuthDigestProvider</a></code>,

- when setting up authentication, then add a

- <code class="directive"><a href="#authdigestdomain">AuthDigestDomain</a></code> directive containing at least the root

- URI(s) for this protection space.</p>

-

- <p>Appropriate user (text) files can be created using the

- <code class="program"><a href="../programs/htdigest.html">htdigest</a></code> tool.</p>

-

- <div class="example"><h3>Example:</h3><pre class="prettyprint lang-config">&lt;Location "/private/"&gt;

- AuthType Digest

- AuthName "private area"

- AuthDigestDomain "/private/" "http://mirror.my.dom/private2/"

-

- AuthDigestProvider file

- AuthUserFile "/web/auth/.digest_pw"

- Require valid-user

-&lt;/Location&gt;</pre>

-</div>

-

- <div class="note"><h3>Note</h3>

- <p>Digest authentication was intended to be more secure than basic

- authentication, but no longer fulfills that design goal. A

- man-in-the-middle attacker can trivially force the browser to downgrade

- to basic authentication. And even a passive eavesdropper can brute-force

- the password using today's graphics hardware, because the hashing

- algorithm used by digest authentication is too fast. Another problem is

- that the storage of the passwords on the server is insecure. The contents

- of a stolen htdigest file can be used directly for digest authentication.

- Therefore using <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> to encrypt the whole connection is

- strongly recommended.</p>

- <p><code class="module"><a href="../mod/mod_auth_digest.html">mod_auth_digest</a></code> only works properly on platforms

- where APR supports shared memory.</p>

- </div>

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="using" id="using">Utilisation de l'authentification � base de

-condens�s</a></h2>

-

- <p>Pour utiliser l'authentification � base de condens�s MD5, vous

- devez simplement remplacer <code>AuthType Basic</code> et <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code> respectivement

- par <code>AuthType Digest</code> et <code class="directive"><a href="#authdigestprovider">AuthDigestProvider</a></code> lorsque vous

- configurez l'authentification, puis ajouter une directive <code class="directive"><a href="#authdigestdomain">AuthDigestDomain</a></code> contenant au

- moins la(les) URI(s) racine(s) de la zone � prot�ger.</p>

-

- <p>On peut cr�er les fichiers utilisateur appropri�s (au format

- texte) � l'aide de l'outil <code class="program"><a href="../programs/htdigest.html">htdigest</a></code>.</p>

-

- <div class="example"><h3>Exemple :</h3><pre class="prettyprint lang-config">&lt;Location /private/&gt;

- AuthType Digest

- AuthName "private area"

- AuthDigestDomain /private/ http://mirror.my.dom/private2/

-

- AuthDigestProvider file

- AuthUserFile /web/auth/.digest_pw

- Require valid-user

-&lt;/Location&gt;</pre>

-</div>

-

- <div class="note"><h3>Note</h3>

- <p>L'authentification � base de condens� a �t� con�ue pour am�liorer

- la s�curit� par rapport � l'authentification basique, mais il

- s'av�re que ce but n'a pas �t� atteint. Un attaquant de type

- "man-in-the-middle" peut facilement forcer le navigateur � revenir �

- une authentification basique. M�me une oreille indiscr�te passive

- peut retrouver le mot de passe par force brute avec les moyens

- modernes, car l'algorithme de hashage utilis� par l'authentification

- � base de condens� est trop rapide. Autre probl�me, le stockage des

- mots de passe sur le serveur n'est pas s�r. Le contenu d'un fichier

- htdigest vol� peut �tre utilis� directement pour l'authentification

- � base de condens�. Il est donc fortement recommand� d'utiliser

- <code class="module"><a href="../mod/mod_ssl.html">mod_ssl</a></code> pour chiffrer la connexion.</p>

- <p><code class="module"><a href="../mod/mod_auth_digest.html">mod_auth_digest</a></code> ne fonctionne correctement que

- sur les plates-formes o� APR supporte la m�moire partag�e.</p>

- </div>

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="using" id="using">Digest Authentication ����ϱ�</a></h2>

-

- <p>MD5 Digest authentication�� �ſ� ���� ����� �� �ִ�.

- <code>AuthType Basic</code>�� <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code> ���

- <code>AuthType Digest</code>�� <code class="directive"><a href="#authdigestprovider">AuthDigestProvider</a></code>��

- ����Ͽ� ������ ������ ������ �� �ִ�. �׸��� �ּ��� ��ȣ�Ϸ���

- ������ �⺻ URI�� <code class="directive"><a href="#authdigestdomain">AuthDigestDomain</a></code> ���þ ����Ѵ�.</p>

-

- <p><a href="../programs/htdigest.html">htdigest</a> ������

- ����Ͽ� ����� (����)������ ���� �� �ִ�.</p>

-

- <div class="example"><h3>����:</h3><p><code>

- &lt;Location /private/&gt;<br />

- <span class="indent">

- AuthType Digest<br />

- AuthName "private area"<br />

- AuthDigestDomain /private/ http://mirror.my.dom/private2/<br />

- <br />

- AuthDigestProvider file<br />

- AuthUserFile /web/auth/.digest_pw<br />

- Require valid-user<br />

- </span>

- &lt;/Location&gt;

- </code></p></div>

-

- <div class="note"><h3>����</h3>

- <p>Digest authentication�� Basic authentication���� ��

- ����������, �������� �����ؾ� �Ѵ�. 2002�� 11�� ���� digest

- authentication�� �����ϴ� ���������� <a href="http://www.w3.org/Amaya/">Amaya</a>, <a href="http://konqueror.kde.org/">Konqueror</a>, (Windows����

- ���ǹ��ڿ��� �Բ� ����ϸ� �ȵ����� - �ذ����� �Ʒ� "<a href="#msie">MS Internet Explorer ���� �ذ��ϱ�</a>"�� ����)

- Mac OS X�� Windows�� <a href="http://www.microsoft.com/windows/ie/">MS Internet

- Explorer</a>, <a href="http://www.mozilla.org">Mozilla</a>,

- <a href="http://channels.netscape.com/ns/browsers/download.jsp">Netscape</a> ���� 7, <a href="http://www.opera.com/">Opera</a>,

- <a href="http://www.apple.com/safari/">Safari</a> ���� �ִ�.

- <a href="http://lynx.isc.org/">lynx</a>�� digest authentication��

- �������� <strong>�ʴ´�</strong>. digest authentication��

- basic authentication ��ŭ �θ� �������� �ʾұ⶧���� ���

- ����ڰ� �����ϴ� �������� ����ϴ� ��쿡�� ����ؾ�

- �Ѵ�.</p>

- </div>

-</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="msie" id="msie">MS Internet Explorer ���� �ذ��ϱ�</a></h2>

- <p>���� Windows�� Internet Explorer�� Digest authentication

- ���� ���ǹ��ڿ��� �ִ� <code>GET</code> ��û�� RFC�� �ٸ���

- ó���ϴ� ������ �ִ�. ��� ������� �� ������ �ذ��� ��

- �ִ�.</p>

-

- <p>

- ù��°�� ���α׷��� �ڷḦ �Ѱ��ֱ����� <code>GET</code>

- ��� <code>POST</code> ��û�� ����ϴ� ����̴�. �� �����

- �����ϴٸ� ���� ������ �ذ�å�̴�.

- </p>

-

- <p>��, ����ġ 2.0.51���� <code>AuthDigestEnableQueryStringHack</code>

- ȯ�溯���� �����Ͽ� ������ �ذ��Ѵ�. ��û��

- <code>AuthDigestEnableQueryStringHack</code>�� �����ϸ�

- ����ġ�� MSIE ���׸� ���ذ� ��ġ�� ���ϰ� ��û URI�� digest

- �񱳿��� �����Ѵ�. �� ����� ������ ���� ����Ѵ�.</p>

-

- <div class="example"><h3>MSIE���� Digest Authentication ����ϱ�:</h3><p><code>

- BrowserMatch "MSIE" AuthDigestEnableQueryStringHack=On

- </code></p></div>

-

- <p>�������� ȯ�溯�� ������ ���� �ڼ��� ������ <code class="directive"><a href="../mod/mod_setenvif.html#browsermatch">BrowserMatch</a></code> ���þ

- �����϶�.</p>

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="basicconfig" id="basicconfig">Basic Configuration</a></h2>

-

- <p>To protect a particular URL with <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code>, you need to

- decide where you will store your <var>session</var>, and you will need to

- decide what method you will use to authenticate. In this simple example, the

- login details will be stored in a session based on

- <code class="module"><a href="../mod/mod_session_cookie.html">mod_session_cookie</a></code>, and authentication will be attempted against

- a file using <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code>. If authentication is unsuccessful,

- the user will be redirected to the form login page.</p>

-

- <div class="example"><h3>Basic example</h3><pre class="prettyprint lang-config">AuthFormProvider file

-AuthUserFile "conf/passwd"

-AuthType form

-AuthName realm

-AuthFormLoginRequiredLocation "http://example.com/login.html"

-Session On

-SessionCookieName session path=/

-SessionCryptoPassphrase secret</pre>

-</div>

-

- <p>The directive <code class="directive"><a href="../mod/mod_authn_core.html#authtype">AuthType</a></code> will enable

- the <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> authentication when set to the value <var>form</var>.

- The directives <code class="directive"><a href="#authformprovider">AuthFormProvider</a></code> and

- <code class="directive"><a href="../mod/mod_authn_file.html#authuserfile">AuthUserFile</a></code> specify that usernames

- and passwords should be checked against the chosen file.</p>

-

- <p>The directives <code class="directive"><a href="../mod/mod_session.html#session">Session</a></code>,

- <code class="directive"><a href="../mod/mod_session_cookie.html#sessioncookiename">SessionCookieName</a></code> and

- <code class="directive"><a href="../mod/mod_session_crypto.html#sessioncryptopassphrase">SessionCryptoPassphrase</a></code> create an

- encrypted session stored within an HTTP cookie on the browser. For more information

- on the different options for configuring a session, read the documentation for

- <code class="module"><a href="../mod/mod_session.html">mod_session</a></code>.</p>

-

- <p>In the simple example above, a URL has been protected by

- <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code>, but the user has yet to be given an opportunity to

- enter their username and password. Options for doing so include providing a

- dedicated standalone login page for this purpose, or for providing the login

- page inline.</p>

- </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="standalone" id="standalone">Standalone Login</a></h2>

-

- <p>The login form can be hosted as a standalone page, or can be provided inline on

- the same page.</p>

-

- <p>When configuring the login as a standalone page, unsuccessful authentication

- attempts should be redirected to a login form created by the website for this purpose,

- using the <code class="directive"><a href="#authformloginrequiredlocation">AuthFormLoginRequiredLocation</a></code>

- directive. Typically this login page will contain an HTML form, asking the user to

- provide their usename and password.</p>

-

- <div class="example"><h3>Example login form</h3><pre class="prettyprint lang-html">&lt;form method="POST" action="/dologin.html"&gt;

- Username: &lt;input type="text" name="httpd_username" value="" /&gt;

- Password: &lt;input type="password" name="httpd_password" value="" /&gt;

- &lt;input type="submit" name="login" value="Login" /&gt;

-&lt;/form&gt;</pre>

-</div>

-

- <p>The part that does the actual login is handled by the <var>form-login-handler</var>.

- The action of the form should point at this handler, which is configured within

- Apache httpd as follows:</p>

-

- <div class="example"><h3>Form login handler example</h3><pre class="prettyprint lang-config">&lt;Location "/dologin.html"&gt;

- SetHandler form-login-handler

- AuthFormLoginRequiredLocation "http://example.com/login.html"

- AuthFormLoginSuccessLocation "http://example.com/success.html"

- AuthFormProvider file

- AuthUserFile "conf/passwd"

- AuthType form

- AuthName realm

- Session On

- SessionCookieName session path=/

- SessionCryptoPassphrase secret

-&lt;/Location&gt;</pre>

-</div>

-

- <p>The URLs specified by the

- <code class="directive"><a href="#authformloginrequiredlocation">AuthFormLoginRequiredLocation</a></code> directive will typically

- point to a page explaining to the user that their login attempt was unsuccessful, and they

- should try again. The <code class="directive"><a href="#authformloginsuccesslocation">AuthFormLoginSuccessLocation</a></code>

- directive specifies the URL the user should be redirected to upon successful login.</p>

-

- <p>Alternatively, the URL to redirect the user to on success can be embedded within the login

- form, as in the example below. As a result, the same <var>form-login-handler</var> can be

- reused for different areas of a website.</p>

-

- <div class="example"><h3>Example login form with location</h3><pre class="prettyprint lang-html">&lt;form method="POST" action="/dologin.html"&gt;

- Username: &lt;input type="text" name="httpd_username" value="" /&gt;

- Password: &lt;input type="password" name="httpd_password" value="" /&gt;

- &lt;input type="submit" name="login" value="Login" /&gt;

- &lt;input type="hidden" name="httpd_location" value="http://example.com/success.html" /&gt;

-&lt;/form&gt;</pre>

-</div>

-

- </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="inline" id="inline">Inline Login</a></h2>

-

- <div class="warning"><h3>Warning</h3>

- <p>A risk exists that under certain circumstances, the login form configured

- using inline login may be submitted more than once, revealing login credentials to

- the application running underneath. The administrator must ensure that the underlying

- application is properly secured to prevent abuse. If in doubt, use the

- standalone login configuration.</p>

- </div>

-

- <p>As an alternative to having a dedicated login page for a website, it is possible to

- configure <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> to authenticate users inline, without being

- redirected to another page. This allows the state of the current page to be preserved

- during the login attempt. This can be useful in a situation where a time limited

- session is in force, and the session times out in the middle of the user request. The

- user can be re-authenticated in place, and they can continue where they left off.</p>

-

- <p>If a non-authenticated user attempts to access a page protected by

- <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> that isn't configured with a

- <code class="directive"><a href="#authformloginrequiredlocation">AuthFormLoginRequiredLocation</a></code> directive,

- a <var>HTTP_UNAUTHORIZED</var> status code is returned to the browser indicating to the user

- that they are not authorized to view the page.</p>

-

- <p>To configure inline authentication, the administrator overrides the error document

- returned by the <var>HTTP_UNAUTHORIZED</var> status code with a custom error document

- containing the login form, as follows:</p>

-

- <div class="example"><h3>Basic inline example</h3><pre class="prettyprint lang-config">AuthFormProvider file

-ErrorDocument 401 "/login.shtml"

-AuthUserFile "conf/passwd"

-AuthType form

-AuthName realm

-AuthFormLoginRequiredLocation "http://example.com/login.html"

-Session On

-SessionCookieName session path=/

-SessionCryptoPassphrase secret</pre>

-</div>

-

- <p>The error document page should contain a login form with an empty action property,

- as per the example below. This has the effect of submitting the form to

- the original protected URL, without the page having to know what that

- URL is.</p>

-

- <div class="example"><h3>Example inline login form</h3><pre class="prettyprint lang-html">&lt;form method="POST" <strong>action=""</strong>&gt;

- Username: &lt;input type="text" name="httpd_username" value="" /&gt;

- Password: &lt;input type="password" name="httpd_password" value="" /&gt;

- &lt;input type="submit" name="login" value="Login" /&gt;

-&lt;/form&gt;</pre>

-</div>

-

- <p>When the end user has filled in their login details, the form will make

- an HTTP POST request to the original password protected URL.

- <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> will intercept this POST request, and if

- HTML fields are found present for the username and password, the user

- will be logged in, and the original password protected URL will be returned

- to the user as a GET request.</p>

-

- </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="inlinepreservebody" id="inlinepreservebody">Inline Login with Body Preservation</a></h2>

-

- <p>A limitation of the inline login technique described above is that should an

- HTML form POST have resulted in the request to authenticate or

- reauthenticate, the

- contents of the original form posted by the browser will be lost. Depending on

- the function of the website, this could present significant inconvenience for the

- end user.</p>

-

- <p><code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> addresses this by allowing the method and body

- of the original request to be embedded in the login form. If authentication

- is successful, the original method and body will be retried by Apache httpd, preserving

- the state of the original request.</p>

-

- <p>To enable body preservation, add three additional fields to the login form as

- per the example below.</p>

-

- <div class="example"><h3>Example with body preservation</h3><pre class="prettyprint lang-html">&lt;form method="POST" action=""&gt;

- Username: &lt;input type="text" name="httpd_username" value="" /&gt;

- Password: &lt;input type="password" name="httpd_password" value="" /&gt;

- &lt;input type="submit" name="login" value="Login" /&gt;

- <br /> <strong>&lt;input type="hidden" name="httpd_method" value="POST" /&gt;

- &lt;input type="hidden" name="httpd_mimetype" value="application/x-www-form-urlencoded" /&gt;

- &lt;input type="hidden" name="httpd_body" value="name1=value1&amp;name2=value2" /&gt;</strong><br />

-&lt;/form&gt;</pre>

-</div>

-

- <p>How the method, mimetype and body of the original request are embedded within the

- login form will depend on the platform and technology being used within the website.

- </p>

-

- <p>One option is to use the <code class="module"><a href="../mod/mod_include.html">mod_include</a></code> module along with the

- <code class="directive"><a href="../mod/mod_request.html#keptbodysize">KeptBodySize</a></code> directive, along with a suitable

- CGI script to embed the variables in the form.</p>

-

- <p>Another option is to render the login form using a CGI script or other dynamic

- technology.</p>

-

- <div class="example"><h3>CGI example</h3><pre class="prettyprint lang-config"> AuthFormProvider file

- ErrorDocument 401 "/cgi-bin/login.cgi"

- ...</pre>

-</div>

-

- </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="loggingout" id="loggingout">Logging Out</a></h2>

-

- <p>To enable a user to log out of a particular session, configure a page to

- be handled by the <var>form-logout-handler</var>. Any attempt to access this

- URL will cause the username and password to be removed from the current

- session, effectively logging the user out.</p>

-

- <p>By setting the

- <code class="directive"><a href="#authformlogoutlocation">AuthFormLogoutLocation</a></code> directive,

- a URL can be specified that the browser will be redirected to on successful

- logout. This URL might explain to the user that they have been logged out, and

- give the user the option to log in again.</p>

-

- <div class="example"><h3>Basic logout example</h3><pre class="prettyprint lang-config">SetHandler form-logout-handler

-AuthName realm

-AuthFormLogoutLocation "http://example.com/loggedout.html"

-Session On

-SessionCookieName session path=/

-SessionCryptoPassphrase secret</pre>

-</div>

-

- <p>Note that logging a user out does not delete the session; it merely removes

- the username and password from the session. If this results in an empty session,

- the net effect will be the removal of that session, but this is not

- guaranteed. If you want to guarantee the removal of a session, set the

- <code class="directive"><a href="../mod/mod_session.html#sessionmaxage">SessionMaxAge</a></code> directive to a small

- value, like 1 (setting the directive to zero would mean no session age limit).

- </p>

-

- <div class="example"><h3>Basic session expiry example</h3><pre class="prettyprint lang-config">SetHandler form-logout-handler

-AuthFormLogoutLocation "http://example.com/loggedout.html"

-Session On

-SessionMaxAge 1

-SessionCookieName session path=/

-SessionCryptoPassphrase secret</pre>

-</div>

-

- </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="urlencoding" id="urlencoding">Usernames and Passwords</a></h2>

- <p>Note that form submission involves URLEncoding the form data:

- in this case the username and password. You should therefore

- pick usernames and passwords that avoid characters that are

- URLencoded in form submission, or you may get unexpected results.</p>

- </div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="basicconfig" id="basicconfig">Configuration de base</a></h2>

-

- <p>Pour prot�ger une URL particuli�re avec le module

- <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code>, vous devez d�terminer l'endroit o�

- vous allez stocker votre <var>session</var>, ainsi que la m�thode

- d'authentification. Dans cet exemple simple, les informations de

- connexion sont stock�es dans une session � l'aide du module

- <code class="module"><a href="../mod/mod_session_cookie.html">mod_session_cookie</a></code>, et l'authentification utilise

- un fichier en s'appuyant sur le module

- <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code>. Si l'authentification �choue,

- l'utilisateur dera redirig� vers la page du formulaire de

- connexion.</p>

-

- <div class="example"><h3>Exemple simple</h3><pre class="prettyprint lang-config">AuthFormProvider file

-AuthUserFile conf/passwd

-AuthType form

-AuthName realm

-AuthFormLoginRequiredLocation http://example.com/login.html

-Session On

-SessionCookieName session path=/

-SessionCryptoPassphrase secret</pre>

-</div>

-

- <p>L'authentification <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> est activ�e

- en affectant la valeur <var>form</var> � la directive <code class="directive"><a href="../mod/mod_authn_core.html#authtype">AuthType</a></code>. Les directives

- <code class="directive"><a href="#authformprovider">AuthFormProvider</a></code> et

- <code class="directive"><a href="../mod/mod_authn_file.html#authuserfile">AuthUserFile</a></code>

- sp�cifient que les noms d'utilisateurs et mots de passe seront

- v�rifi�s en utilisant le fichier choisi.</p>

-

- <p>Les directives <code class="directive"><a href="../mod/mod_session.html#session">Session</a></code>, <code class="directive"><a href="../mod/mod_session_cookie.html#sessioncookiename">SessionCookieName</a></code> et

- <code class="directive"><a href="../mod/mod_session_crypto.html#sessioncryptopassphrase">SessionCryptoPassphrase</a></code>

- cr�ent une session chiffr�e stock�e dans un cookie HTTP au niveau

- du navigateur. Pour plus d'informations � propos des diff�rentes

- options de configuration des sessions, reportez-vous � la

- documentation du module <code class="module"><a href="../mod/mod_session.html">mod_session</a></code>.</p>

-

- <p>Dans l'exemple simple ci-dessus, une URL a �t� prot�g�e par

- <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code>, mais on doit maintenant fournir

- � l'utilisateur un moyen d'entrer un nom et un mot de passe. � cet

- effet, on peut soit �crire une page de connexion ind�pendante

- d�di�e, soit inclure le formulaire de connexion dans la page

- courante.</p>

- </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="standalone" id="standalone">Page de connexion d�di�e</a></h2>

-

- <p>Le formulaire de connexion peut �tre contenu dans une page

- ind�pendante, ou �tre inclus dans la page courante. </p>

-

- <p>Lorsque la connexion s'effectue � partir d'une page

- ind�pendante et si la tentative d'authentification �choue,

- l'utilisateur doit �tre redirig� vers un formulaire de connexion,

- cr�� � cet effet sur le site web, en utilisant la directive

- <code class="directive"><a href="#authformloginrequiredlocation">AuthFormLoginRequiredLocation</a></code>.

- En g�n�ral, la page de connexion contiendra un formulaire HTML

- demandant � l'utilisateur de fournir un nom et un mot de passe.</p>

-

- <div class="example"><h3>Exemple de formulaire de connexion</h3><pre class="prettyprint lang-html">&lt;form method="POST" action="/dologin.html"&gt;

- Username: &lt;input type="text" name="httpd_username" value="" /&gt;

- Password: &lt;input type="password" name="httpd_password" value="" /&gt;

- &lt;input type="submit" name="login" value="Login" /&gt;

-&lt;/form&gt;</pre>

-</div>

-

- <p>La partie o� s'effectue la connexion proprement dite est

- trait�e par le gestionnaire <var>form-login-handler</var>.

- L'action de ce formulaire doit pointer vers ce gestionnaire, ce

- que l'on configure dans Apache httpd comme suit :</p>

-

- <div class="example"><h3>Exemple de configuration du gestionnaire de

- formulaire de connexion</h3><pre class="prettyprint lang-config">&lt;Location /dologin.html&gt;

- SetHandler form-login-handler

- AuthFormLoginRequiredLocation http://example.com/login.html

- AuthFormLoginSuccessLocation http://example.com/success.html

- AuthFormProvider file

- AuthUserFile conf/passwd

- AuthType form

- AuthName realm

- Session On

- SessionCookieName session path=/

- SessionCryptoPassphrase secret

-&lt;/Location&gt;</pre>

-</div>

-

- <p>L'URL sp�cifi�e par la directive

- <code class="directive"><a href="#authformloginrequiredlocation">AuthFormLoginRequiredLocation</a></code>

- r�f�rencera en g�n�ral une page expliquant � l'utilisateur que sa

- tentative de connexion a �chou�, et qu'il doit la renouveler. La

- directive <code class="directive"><a href="#authformloginsuccesslocation">AuthFormLoginSuccessLocation</a></code>

- sp�cifie l'URL vers laquelle l'utilisateur doit �tre redirig� s'il

- s'est authentifi� avec succ�s.</p>

-

- <p>Alternativement, l'URL vers laquelle doit �tre redirig�

- l'utilisateur s'il s'est authentifi� avec succ�s peut �tre

- int�gr�e dans le formulaire de connexion, comme dans l'exemple

- ci-dessous. Il en d�coule que le m�me gestionnaire

- <var>form-login-handler</var> pourra �tre utilis� pour diff�rentes

- zones du site web.</p>

-

- <div class="example"><h3>Exemple de formulaire d'authentification multizone</h3><pre class="prettyprint lang-html">&lt;form method="POST" action="/dologin.html"&gt;

- Username: &lt;input type="text" name="httpd_username" value="" /&gt;

- Password: &lt;input type="password" name="httpd_password" value="" /&gt;

- &lt;input type="submit" name="login" value="Login" /&gt;

- &lt;input type="hidden" name="httpd_location" value="http://example.com/success.html" /&gt;

-&lt;/form&gt;</pre>

-</div>

-

- </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="inline" id="inline">Connexion � la vol�e</a></h2>

-

- <div class="warning"><h3>Avertissement</h3>

- <p>Il existe un risque, dans certaines circonstances, que le

- formulaire de connexion configur� pour une connexion � la vol�e

- soit soumis plusieurs fois, r�v�lant de ce fait les param�tres

- de connexion � l'application sous-jacente. L'administrateur doit

- s'assurer que cette derni�re est correctement s�curis�e afin

- d'�viter les �ventuels abus. En cas de doute, utilisez une page

- de connexion ind�pendante d�di�e.</p>

- </div>

-

- <p>Comme alternative � la page de connexion d�di�e pour un site

- web, il est possible de configurer <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code>

- pour authentifier les utilisateurs � la vol�e, sans les rediriger

- vers une autre page, ce qui permet de conserver l'�tat de la page

- courante au cours de la tentative de connexion. Ceci peut s'av�rer

- utile dans le cas d'une session limit�e dans le temps, si le d�lai

- de la session a expir� pendant la requ�te de l'utilisateur. Ce

- dernier peut alors se r�authentifier � la m�me place, et

- poursuivre son activit� � partir du point o� il en �tait rest�.</p>

-

- <p>Si un utilisateur non authentifi� tente d'acc�der � une page

- prot�g�e par <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code>, et si ce dernier

- n'est pas configur� avec une directive <code class="directive"><a href="#authformloginrequiredlocation">AuthFormLoginRequiredLocation</a></code>,

- un code de statut <var>HTTP_UNAUTHORIZED</var> est renvoy� vers le

- navigateur, indiquant � l'utilisateur qu'il n'est pas autoris� �

- acc�der � cette page.</p>

-

- <p>Pour configurer l'authentification � la vol�e, l'administrateur

- remplace le message d'erreur renvoy� par le code de statut

- <var>HTTP_UNAUTHORIZED</var> par un message d'erreur personnalis�

- contenant le formulaire de connexion comme suit :</p>

-

- <div class="example"><h3>Exemple simple d'authentification � la vol�e</h3><pre class="prettyprint lang-config">AuthFormProvider file

-ErrorDocument 401 /login.shtml

-AuthUserFile conf/passwd

-AuthType form

-AuthName realm

-AuthFormLoginRequiredLocation http://example.com/login.html

-Session On

-SessionCookieName session path=/

-SessionCryptoPassphrase secret</pre>

-</div>

-

- <p>La page du message d'erreur doit contenir un formulaire de

- connexion dont la propri�t� action est vide, comme dans l'exemple

- ci-dessous. Ceci a pour effet de soumettre le formulaire � l'URL

- prot�g�e originale, cette derni�re n'ayant pas besoin d'�tre

- connue de la page en cours.</p>

-

- <div class="example"><h3>Exemple de formulaire de connexion � la vol�e</h3><pre class="prettyprint lang-html">&lt;form method="POST" <strong>action=""</strong>&gt;

- Username: &lt;input type="text" name="httpd_username" value="" /&gt;

- Password: &lt;input type="password" name="httpd_password" value="" /&gt;

- &lt;input type="submit" name="login" value="Login" /&gt;

-&lt;/form&gt;</pre>

-</div>

-

- <p>Lorsque l'utilisateur final a entr� ses informations de

- connexion, le formulaire effectue une requ�te HTTP POST pour l'URL

- originale prot�g�e par mot de passe.

- <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code> va alors intercepter cette requ�te

- POST, et dans le cas o� des champs HTML Utilisateur et Mot de

- passe corrects sont pr�sents, l'utilisateur sera connect�, et

- l'URL originale prot�g�e par mot de passe lui sera retourn�e en

- tant que requ�te GET.</p>

-

- </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="inlinepreservebody" id="inlinepreservebody">Connexion � la vol�e avec

- conservation du contenu</a></h2>

-

- <p>Il existe une limite � la technique de connexion � la vol�e

- d�crite ci-dessus ; si un formulaire HTML POST entra�ne une

- demande d'authentification ou de r�authentification, le contenu du

- formulaire original envoy� par le navigateur sera perdu. Cela peut

- s'av�rer plus ou moins g�nant pour l'utilisateur final selon la

- fonction du site web.</p>

-

- <p>Comme solution � ce probl�me, <code class="module"><a href="../mod/mod_auth_form.html">mod_auth_form</a></code>

- permet d'int�grer la m�thode et le contenu de la requ�te originale

- dans le formulaire de connexion. Si l'authentification r�ussit,

- Apache httpd pourra refaire une tentative avec la m�thode et le contenu

- originaux, tout en conservant l'�tat de la requ�te originale.</p>

-

- <p>Pour mettre en oeuvre la conservation du contenu, vous devez

- ajouter trois champs suppl�mentaires au formulaire de connexion

- comme dans l'exemple suivant :</p>

-

- <div class="example"><h3>Exemple de formulaire avec conservation du

- contenu</h3><pre class="prettyprint lang-html">&lt;form method="POST" action=""&gt;

- Username: &lt;input type="text" name="httpd_username" value="" /&gt;

- Password: &lt;input type="password" name="httpd_password" value="" /&gt;

- &lt;input type="submit" name="login" value="Login" /&gt;

- <br /> <strong>&lt;input type="hidden" name="httpd_method" value="POST" /&gt;

- &lt;input type="hidden" name="httpd_mimetype" value="application/x-www-form-urlencoded" /&gt;

- &lt;input type="hidden" name="httpd_body" value="name1=value1&amp;name2=value2" /&gt;</strong><br />

-&lt;/form&gt;</pre>

-</div>

-

- <p>La mani�re dont la m�thode, le type MIME et le contenu de la

- requ�te originale seront int�gr�s dans le formulaire de connexion

- vont d�pendre de la plate-forme et de la technologie utilis�es au

- sein du site web.

- </p>

-

- <p>Une option consiste � utiliser le module

- <code class="module"><a href="../mod/mod_include.html">mod_include</a></code> en association avec la directive

- <code class="directive"><a href="../mod/mod_request.html#keptbodysize">KeptBodySize</a></code>, ainsi

- qu'un script CGI adapt� pour int�grer les variables dans le

- formulaire.</p>

-

- <p>Une autre option consiste � pr�senter le formulaire de

- connexion en utilisant un script CGI ou une autre technologie

- dynamique.</p>

-

- <div class="example"><h3>Exemple avec script CGI</h3><pre class="prettyprint lang-config"> AuthFormProvider file

- ErrorDocument 401 /cgi-bin/login.cgi

- ...</pre>

-</div>

-

- </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="loggingout" id="loggingout">D�connexion</a></h2>

-

- <p>Pour permettre � un utilisateur de se d�connecter d'une session

- particuli�re, vous devez configurer une page pour qu'elle soit

- trait�e par le gestionnaire <var>form-logout-handler</var>. Tout

- acc�s � cette URL va entra�ner la suppression de l'Utilisateur et

- du Mot de passe de la session courante, ce qui aura pour effet de

- d�connecter l'utilisateur.</p>

-

- <p>Vous pouvez sp�cifier une URL vers laquelle le navigateur sera

- redirig� en cas de d�connection r�ussie, en d�finissant la

- directive <code class="directive"><a href="#authformlogoutlocation">AuthFormLogoutLocation</a></code>. Cette

- URL devra expliquer � l'utilisateur qu'il a �t� d�connect�, et lui

- donner la possibilit� de se connecter � nouveau.</p>

-

- <div class="example"><h3>Exemple simple de configuration de la

- d�connexion</h3><pre class="prettyprint lang-config">SetHandler form-logout-handler

-AuthName realm

-AuthFormLogoutLocation http://example.com/loggedout.html

-Session On

-SessionCookieName session path=/

-SessionCryptoPassphrase secret</pre>

-</div>

-

- <p>Notez que la d�connexion d'un utilisateur ne supprime pas la

- session ; elle supprime seulement l'utilisateur et le mot de passe

- de la session. Si la session qui en r�sulte est vide, elle sera

- probablement supprim�e, mais ce n'est pas garanti. Si vous voulez

- �tre s�r que la session sera supprim�e, affectez une valeur faible

- � la directive <code class="directive"><a href="../mod/mod_session.html#sessionmaxage">SessionMaxAge</a></code>, par exemple 1

- (affecter � cette directive la valeur z�ro signifie une session

- sans limite d'�ge).

- </p>

-

- <div class="example"><h3>Exemple simple avec dur�e de validit� de session

- limit�e</h3><pre class="prettyprint lang-config">SetHandler form-logout-handler

-AuthFormLogoutLocation http://example.com/loggedout.html

-Session On

-SessionMaxAge 1

-SessionCookieName session path=/

-SessionCryptoPassphrase secret</pre>

-</div>

-

- </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="urlencoding" id="urlencoding">Noms d'utilisateurs et mots de

- passe</a></h2>

- <p>Notez que la soumission d'un formulaire implique l'encodage URL

- (URLEncoding) des donn�es du formulaire, ici le nom d'utilisateur et

- le mot de passe. Vous devez donc choisir des noms d'utilisateurs et

- mots de passe qui ne contiennent pas de caract�res susceptibles

- d'�tre encod�s URL lors de la soumission du formulaire, sous peine

- d'obtenir des r�sultats inattendus.</p>

- </div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="example" id="example">Example</a></h2>

- <p>The example below is combined with "normal" htpasswd-file based

- authentication and allows users in additionally as 'guests' with the

- following properties:</p>

-

- <ul>

- <li>It insists that the user enters a userID.

- (<code class="directive"><a href="#anonymous_nouserid">Anonymous_NoUserID</a></code>)</li>

-

- <li>It insists that the user enters a password.

- (<code class="directive"><a href="#anonymous_mustgiveemail">Anonymous_MustGiveEmail</a></code>)</li>

-

- <li>The password entered must be a valid email address, <em>i.e.</em>

- contain at least one '@' and a '.'.

- (<code class="directive"><a href="#anonymous_verifyemail">Anonymous_VerifyEmail</a></code>)</li>

-

- <li>The userID must be one of <code>anonymous guest www test

- welcome</code> and comparison is <strong>not</strong> case

- sensitive. (<code class="directive"><a href="#anonymous">Anonymous</a></code>)</li>

-

- <li>And the Email addresses entered in the passwd field are

- logged to the error log file.

- (<code class="directive"><a href="#anonymous_logemail">Anonymous_LogEmail</a></code>)</li>

- </ul>

-

- <div class="example"><h3>Example</h3><pre class="prettyprint lang-config">&lt;Directory "/var/www/html/private"&gt;

- AuthName "Use 'anonymous' &amp; Email address for guest entry"

- AuthType Basic

- AuthBasicProvider file anon

- AuthUserFile "/path/to/your/.htpasswd"

-

- Anonymous_NoUserID off

- Anonymous_MustGiveEmail on

- Anonymous_VerifyEmail on

- Anonymous_LogEmail on

- Anonymous anonymous guest www test welcome

-

- Require valid-user

-&lt;/Directory&gt;</pre>

-</div>

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="example" id="example">Exemple</a></h2>

- <p>L'exemple ci-dessous pr�sente un exemple de combinaison avec

- l'authentification � base de fichier htpasswd "normale", et permet

- la connexion d'utilisateurs en tant qu'invit�s avec les propri�t�s

- suivantes :</p>

-

- <ul>

- <li>Il incite l'utilisateur � fournir un identifiant.

- (<code class="directive"><a href="#anonymous_nouserid">Anonymous_NoUserID</a></code>)</li>

-

- <li>Il incite l'utilisateur � fournir un mot de passe.

- (<code class="directive"><a href="#anonymous_mustgiveemail">Anonymous_MustGiveEmail</a></code>)</li>

-

- <li>Le mot de passe fourni doit �tre une adresse email valide,

- c'est � dire contenant au moins un '@' et un '.'.

- (<code class="directive"><a href="#anonymous_verifyemail">Anonymous_VerifyEmail</a></code>)</li>

-

- <li>Les valeurs possibles pour l'identifiant utilisateur sont

- <code>anonymous, guest, www, test ou welcome</code>, et la

- v�rification n'est <strong>pas</strong> sensible � la casse.

- (<code class="directive"><a href="#anonymous">Anonymous</a></code>)</li>

-

- <li>Les adresses email entr�es dans le champ passwd sont

- enregistr�es dans le fichier journal des erreurs.

- (<code class="directive"><a href="#anonymous_logemail">Anonymous_LogEmail</a></code>)</li>

- </ul>

-

- <div class="example"><h3>Exemple</h3><pre class="prettyprint lang-config">&lt;Directory /var/www/html/private&gt;

- AuthName "Use 'anonymous' &amp; Email address for guest entry"

- AuthType Basic

- AuthBasicProvider file anon

- AuthUserFile /path/to/your/.htpasswd

-

- Anonymous_NoUserID off

- Anonymous_MustGiveEmail on

- Anonymous_VerifyEmail on

- Anonymous_LogEmail on

- Anonymous anonymous guest www test welcome

-

- Require valid-user

-&lt;/Directory&gt;</pre>

-</div>

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="example" id="example">例</a></h2>

- <p>以下の例は「普通」の htpasswd ファイルに基づいた認証と組み合わされて

- おり、以下の要件を見たすユーザを「ゲスト」として許可します:</p>

-

- <ul>

- <li>ユーザは userID を入力しなければなりません。

- (<code class="directive"><a href="#anonymous_nouserid">Anonymous_NoUserID</a></code>)</li>

-

- <li>ユーザはパスワードを入力しなければなりません。

- (<code class="directive"><a href="#anonymous_mustgiveemail">Anonymous_MustGiveEmail</a></code>)</li>

-

- <li>入力されたパスワードは有効な電子メールアドレスでなければ

- なりません。<em>すなわち</em>、少くとも一つの '@' と '.' が

- 含まれている必要があります。

- (<code class="directive"><a href="#anonymous_verifyemail">Anonymous_VerifyEmail</a></code>)</li>

-

- <li>userID は <code>anonymous guest www test

- welcome</code> のどれかでなければなりません。

- ユーザ名の比較は大文字小文字を区別<strong>しません。</strong></li>

-

- <li>パスワード欄に入力された電子メールアドレスはエラーログファイルに

- ロギングされます。

- (<code class="directive"><a href="#anonymous_logemail">Anonymous_LogEmail</a></code>)</li>

- </ul>

-

- <div class="example"><h3>例</h3><pre class="prettyprint lang-config">&lt;Directory /var/www/html/private&gt;

- AuthName "Use 'anonymous' &amp; Email address for guest entry"

- AuthType Basic

- AuthBasicProvider file anon

- AuthUserFile /path/to/your/.htpasswd

-

- Anonymous_NoUserID off

- Anonymous_MustGiveEmail on

- Anonymous_VerifyEmail on

- Anonymous_LogEmail on

- Anonymous anonymous guest www test welcome

-

- Require valid-user

-&lt;/Directory&gt;</pre>

-</div>

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="example" id="example">����</a></h2>

- <p>���� ���� "�Ϲ�����" htpasswd-���ϱ�� ������ �߰���

- ����ڰ� ���� ������ �����Ѵٸ� '�մ�(guest)'���� ������

- �� �ֵ��� �Ѵ�:</p>

-

- <ul>

- <li>����ڴ� ����� ���̵� �Է��ؾ� �Ѵ�. (<code class="directive"><a href="#anonymous_nouserid">Anonymous_NoUserID</a></code>)</li>

-

- <li>����ڴ� ��ȣ�� �Է��ؾ� �Ѵ�. (<code class="directive"><a href="#anonymous_mustgiveemail">Anonymous_MustGiveEmail</a></code>)</li>

-

- <li>��ȣ�� ��ȿ�� ���ڿ��� �ּҸ� �Է��ؾ� �Ѵ�. <em>����

- ���</em> �ּ��� '@'�� '.' �Ѱ��� �����ؾ� �Ѵ�. (<code class="directive"><a href="#anonymous_verifyemail">Anonymous_VerifyEmail</a></code>)</li>

-

- <li>����� ���̵�� <code>anonymous guest www test

- welcome</code> �� �ϳ��̸�, ��ҹ��ڸ� ��������

- <strong>�ʴ´�</strong>. (<code class="directive"><a href="#anonymous">Anonymous</a></code>)</li>

-

- <li>�׸��� ��ȣ�� �Է��� ���ڿ��� �ּҸ� �����α����Ͽ�

- ����Ѵ�. (<code class="directive"><a href="#anonymous_logemail">Anonymous_LogEmail</a></code>)</li>

- </ul>

-

- <div class="example"><h3>����</h3><p><code>

- &lt;Directory /foo&gt;

- <span class="indent">

- AuthName "�մ����� �湮�Ϸ��� 'anonymous'�� ���ڿ��� �ּҸ� ����϶�"<br />

- AuthType Basic<br />

- AuthBasicProvider file anon<br />

- AuthUserFile /path/to/your/.htpasswd<br />

- <br />

- Anonymous_NoUserID off<br />

- Anonymous_MustGiveEmail on<br />

- Anonymous_VerifyEmail on<br />

- Anonymous_LogEmail on<br />

- Anonymous anonymous guest www test welcome<br />

- <br />

- Order Deny,Allow<br />

- Allow from all<br />

- <br />

- Require valid-user<br />

- </span>

- &lt;/Directory&gt;

- </code></p></div>

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="authnalias" id="authnalias">Creating Authentication Provider Aliases</a></h2>

-

- <p>Extended authentication providers can be created

- within the configuration file and assigned an alias name. The alias

- providers can then be referenced through the directives

- <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code> or

- <code class="directive"><a href="../mod/mod_auth_digest.html#authdigestprovider">AuthDigestProvider</a></code> in

- the same way as a base authentication provider. Besides the ability

- to create and alias an extended provider, it also allows the same

- extended authentication provider to be reference by multiple

- locations.</p>

-

- <h3><a name="example" id="example">Examples</a></h3>

-

- <p>This example checks for passwords in two different text

- files.</p>

-

- <div class="example"><h3>Checking multiple text password files</h3><pre class="prettyprint lang-config"># Check here first

-&lt;AuthnProviderAlias file file1&gt;

- AuthUserFile "/www/conf/passwords1"

-&lt;/AuthnProviderAlias&gt;

-

-# Then check here

-&lt;AuthnProviderAlias file file2&gt;

- AuthUserFile "/www/conf/passwords2"

-&lt;/AuthnProviderAlias&gt;

-

-&lt;Directory "/var/web/pages/secure"&gt;

- AuthBasicProvider file1 file2

-

- AuthType Basic

- AuthName "Protected Area"

- Require valid-user

-&lt;/Directory&gt;</pre>

-</div>

-

- <p>The example below creates two different ldap authentication

- provider aliases based on the ldap provider. This allows

- a single authenticated location to be serviced by multiple ldap

- hosts:</p>

-

- <div class="example"><h3>Checking multiple LDAP servers</h3><pre class="prettyprint lang-config">&lt;AuthnProviderAlias ldap ldap-alias1&gt;

- AuthLDAPBindDN cn=youruser,o=ctx

- AuthLDAPBindPassword yourpassword

- AuthLDAPURL ldap://ldap.host/o=ctx

-&lt;/AuthnProviderAlias&gt;

-&lt;AuthnProviderAlias ldap ldap-other-alias&gt;

- AuthLDAPBindDN cn=yourotheruser,o=dev

- AuthLDAPBindPassword yourotherpassword

- AuthLDAPURL ldap://other.ldap.host/o=dev?cn

-&lt;/AuthnProviderAlias&gt;

-

-Alias "/secure" "/webpages/secure"

-&lt;Directory "/webpages/secure"&gt;

- Order deny,allow

- Allow from all

-

- AuthBasicProvider ldap-other-alias ldap-alias1

-

- AuthType Basic

- AuthName "LDAP Protected Place"

- Require valid-user

- # Note that Require ldap-* would not work here, since the

- # AuthnProviderAlias does not provide the config to authorization providers

- # that are implemented in the same module as the authentication provider.

-&lt;/Directory&gt;</pre>

-</div>

-

-

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="authnalias" id="authnalias">Cr�ation d'alias de fournisseurs

-d'authentification</a></h2>

-

- <p>Il est possible de cr�er des fournisseurs d'authentification

- �tendus dans le fichier de configuration et de leur assigner un

- alias. Le fournisseur ainsi nomm� peut alors �tre r�f�renc� � l'aide

- des directives <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code> ou <code class="directive"><a href="../mod/mod_auth_digest.html#authdigestprovider">AuthDigestProvider</a></code> tout comme

- un fournisseur d'authentification de base. Outre la possibilit� de

- cr�er et attribuer un alias � un fournisseur �tendu, le m�me

- fournisseur d'authentification peut aussi �tre r�f�renc� par

- plusieurs sections relatives � une zone du site web.</p>

-

- <h3><a name="example" id="example">Exemples</a></h3>

-

- <p>Cet exemple v�rifie les mots de passe dans deux fichiers

- textes diff�rents.</p>

-

- <div class="example"><h3>V�rification dans plusieurs fichiers de mots de

- passe au format texte</h3><pre class="prettyprint lang-config"># Premi�re v�rification

-&lt;AuthnProviderAlias file file1&gt;

- AuthUserFile /www/conf/passwords1

-&lt;/AuthnProviderAlias&gt;

-

-# V�rification suivante

-&lt;AuthnProviderAlias file file2&gt;

- AuthUserFile /www/conf/passwords2

-&lt;/AuthnProviderAlias&gt;

-

-&lt;Directory /var/web/pages/secure&gt;

- AuthBasicProvider file1 file2

-

- AuthType Basic

- AuthName "Protected Area"

- Require valid-user

-&lt;/Directory&gt;</pre>

-</div>

-

-

-

- <p>Dans l'exemple ci-dessous, deux fournisseurs

- d'authentification ldap sont cr��s � partir du fournisseur ldap

- de base, et se voient attribuer un alias. L'authentification

- d'une m�me zone peut alors �tre trait�e par plusieurs serveurs

- ldap :</p>

-

- <div class="example"><h3>V�rification aupr�s de plusieurs serveurs

- LDAP</h3><pre class="prettyprint lang-config">&lt;AuthnProviderAlias ldap ldap-alias1&gt;

- AuthLDAPBindDN cn=youruser,o=ctx

- AuthLDAPBindPassword yourpassword

- AuthLDAPURL ldap://ldap.host/o=ctx

- &lt;/AuthnProviderAlias&gt;

- &lt;AuthnProviderAlias ldap ldap-other-alias&gt;

- AuthLDAPBindDN cn=yourotheruser,o=dev

- AuthLDAPBindPassword yourotherpassword

- AuthLDAPURL ldap://other.ldap.host/o=dev?cn

-&lt;/AuthnProviderAlias&gt;

-

-Alias /secure /webpages/secure

-&lt;Directory /webpages/secure&gt;

- Order deny,allow

- Allow from all

-

- AuthBasicProvider ldap-other-alias ldap-alias1

-

- AuthType Basic

- AuthName LDAP_Protected Place

- Require valid-user

- # Notez que Require ldap-* ne fonctionnerait pas ici, car

- # AuthnProviderAlias ne fournit pas de configuration pour les

- # fournisseurs d'autorisation impl�ment�s dans le m�me module que le

- # fournisseur d'authentification.

-&lt;/Directory&gt;</pre>

-</div>

-

-

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="socache" id="socache">Performance and Cacheing</a></h2>

-

-<p>Some users of DBD authentication in HTTPD 2.2/2.4 have reported that it

-imposes a problematic load on the database. This is most likely where

-an HTML page contains hundreds of objects (e.g. images, scripts, etc)

-each of which requires authentication. Users affected (or concerned)

-by this kind of problem should use <code class="module"><a href="../mod/mod_authn_socache.html">mod_authn_socache</a></code>

-to cache credentials and take most of the load off the database.</p>

-</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="example" id="example">Configuration Example</a></h2>

-

-<p>This simple example shows use of this module in the context of

-the Authentication and DBD frameworks.</p>

-<pre class="prettyprint lang-config"># mod_dbd configuration

-# UPDATED to include authentication cacheing

-DBDriver pgsql

-DBDParams "dbname=apacheauth user=apache password=xxxxxx"

-

-DBDMin 4

-DBDKeep 8

-DBDMax 20

-DBDExptime 300

-

-&lt;Directory "/usr/www/myhost/private"&gt;

- # mod_authn_core and mod_auth_basic configuration

- # for mod_authn_dbd

- AuthType Basic

- AuthName "My Server"

-

- # To cache credentials, put socache ahead of dbd here

- AuthBasicProvider socache dbd

-

- # Also required for caching: tell the cache to cache dbd lookups!

- AuthnCacheProvideFor dbd

- AuthnCacheContext my-server

-

- # mod_authz_core configuration

- Require valid-user

-

- # mod_authn_dbd SQL query to authenticate a user

- AuthDBDUserPWQuery "SELECT password FROM authn WHERE user = %s"

-&lt;/Directory&gt;</pre>

-

-</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="exposed" id="exposed">Exposing Login Information</a></h2>

-

-<p>

-If httpd was built against <a class="glossarylink" href="../glossary.html#apr" title="see glossary">APR</a> version 1.3.0

-or higher, then whenever a query is made to the database server, all

-column values in the first row returned by the query are placed in the

-environment, using environment variables with the prefix "AUTHENTICATE_".

-</p>

-<p>If a database query for example returned the username, full name

-and telephone number of a user, a CGI program will have access to

-this information without the need to make a second independent database

-query to gather this additional information.</p>

-<p>This has the potential to dramatically simplify the coding and

-configuration required in some web applications.

-</p>

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="socache" id="socache">Performances et mise en cache</a></h2>

-

-<p>Certains utilisateurs de l'authentification DBD sous HTTPD 2.2/2.4 ont

-signal� une charge probl�matique au niveau de la base de donn�es. Cela

-se produit en g�n�ral lorsqu'une page HTML contient des centaines d'objets

-(comme des images, des scripts, etc...), chacun d'entre eux n�cessitant

-une authentification. Les utilisateurs qui rencontrent ce genre de

-probl�me peuvent utiliser le module <code class="module"><a href="../mod/mod_authn_socache.html">mod_authn_socache</a></code>

-qui permet de mettre les donn�es d'authentification en cache, et

-soulager ainsi la base de donn�es de la plus grande partie de la charge.</p>

-</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="example" id="example">Exemple de configuration</a></h2>

-

-<p>Voici un exemple simple d'utilisation de ce module dans un contexte

-d'authentification et de bases de donn�es.</p>

-<pre class="prettyprint lang-config"># configuration de mod_dbd

-# MISE � JOUR pour inclure la mise en cache de l'authentification

-DBDriver pgsql

-DBDParams "dbname=apacheauth user=apache password=xxxxxx"

-

-DBDMin 4

-DBDKeep 8

-DBDMax 20

-DBDExptime 300

-

-&lt;Directory /usr/www/mon-serveur/private&gt;

- # configuration de mod_authn_core et mod_auth_basic

- # pour mod_authn_dbd

- AuthType Basic

- AuthName "Mon serveur"

-

- # Pour mettre en cache les donn�es d'authentification, placez socache

- # avant dbd

- AuthBasicProvider socache dbd

-

- # Aussi n�cessaire � la mise en cache : dire au cache de mettre en

- # cache les recherches dbd !

- AuthnCacheProvideFor dbd

- AuthnCacheContext mon-serveur

-

- # configuration de mod_authz_core

- Require valid-user

-

- # la requ�te SQL de mod_authn_dbd pour authentifier un utilisateur

- AuthDBDUserPWQuery "SELECT password FROM authn WHERE user = %s"

-&lt;/Directory&gt;</pre>

-

-</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="exposed" id="exposed">Mise � disposition des informations de connexion</a></h2>

-

-<p>

-Si httpd a �t� compil� avec la version 1.3.0 ou sup�rieure de

-l'<a class="glossarylink" href="../glossary.html#apr" title="voir glossaire">APR</a>, pour chaque requ�te envoy�e au serveur de

-base de donn�es, toutes les valeurs de colonnes du premier

-enregistrement renvoy� par la requ�te sont affect�es � des variables

-d'environnement avec le pr�fixe "AUTHENTICATE_".

-</p>

-<p>Par exemple, si une requ�te renvoie un nom d'utilisateur, un nom

-complet et un num�ro de t�l�phone, un programme CGI pourra acc�der � ces

-informations sans avoir besoin d'effectuer une deuxi�me requ�te vers la

-base de donn�es.</p>

-<p>Ceci va entra�ner une simplification consid�rable du code et de la

-configuration n�cessaire de certaines applications web.

-</p>

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-

-

-

-

-

-

-

-

-<div class="section">

-<h2><a name="intro" id="intro">Authentication Cacheing</a></h2>

- <p>Some users of more heavyweight authentication such as SQL database

- lookups (<code class="module"><a href="../mod/mod_authn_dbd.html">mod_authn_dbd</a></code>) have reported it putting an

- unacceptable load on their authentication provider. A typical case

- in point is where an HTML page contains hundreds of objects

- (images, scripts, stylesheets, media, etc), and a request to the page

- generates hundreds of effectively-immediate requests for authenticated

- additional contents.</p>

- <p>mod_authn_socache provides a solution to this problem by

- maintaining a cache of authentication credentials.</p>

-</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="usage" id="usage">Usage</a></h2>

- <p>The authentication cache should be used where authentication

- lookups impose a significant load on the server, or a backend or

- network. Authentication by file (<code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code>)

- or dbm (<code class="module"><a href="../mod/mod_authn_dbm.html">mod_authn_dbm</a></code>) are unlikely to benefit,

- as these are fast and lightweight in their own right (though in some

- cases, such as a network-mounted file, cacheing may be worthwhile).

- Other providers such as SQL or LDAP based authentication are more

- likely to benefit, particularly where there is an observed

- performance issue. Amongst the standard modules, <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> manages its own cache, so only

- <code class="module"><a href="../mod/mod_authn_dbd.html">mod_authn_dbd</a></code> will usually benefit from this cache.</p>

- <p>The basic rules to cache for a provider are:</p>

- <ol><li>Include the provider you're cacheing for in an

- <code class="directive">AuthnCacheProvideFor</code> directive.</li>

- <li>List <var>socache</var> ahead of the provider you're

- cacheing for in your <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code> or <code class="directive"><a href="../mod/mod_auth_digest.html#authdigestprovider">AuthDigestProvider</a></code> directive.</li>

- </ol>

- <p>A simple usage example to accelerate <code class="module"><a href="../mod/mod_authn_dbd.html">mod_authn_dbd</a></code>

- using dbm as a cache engine:</p>

- <pre class="prettyprint lang-config">#AuthnCacheSOCache is optional. If specified, it is server-wide

-AuthnCacheSOCache dbm

-&lt;Directory "/usr/www/myhost/private"&gt;

- AuthType Basic

- AuthName "Cached Authentication Example"

- AuthBasicProvider socache dbd

- AuthDBDUserPWQuery "SELECT password FROM authn WHERE user = %s"

- AuthnCacheProvideFor dbd

- Require valid-user

- #Optional

- AuthnCacheContext dbd-authn-example

-&lt;/Directory&gt;</pre>

-

-</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="dev" id="dev">Cacheing with custom modules</a></h2>

- <p>Module developers should note that their modules must be enabled

- for cacheing with mod_authn_socache. A single optional API function

- <var>ap_authn_cache_store</var> is provided to cache credentials

- a provider has just looked up or generated. Usage examples are

- available in <a href="http://svn.eu.apache.org/viewvc?view=revision&amp;revision=957072">r957072</a>, in which three authn providers are enabled for cacheing.</p>

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="intro" id="intro">Mise en cache des donn�es d'authentification</a></h2>

- <p>Certains utilisateurs qui mettent oeuvre une authentification

- lourde s'appuyant par exemple sur des requ�tes SQL

- (<code class="module"><a href="../mod/mod_authn_dbd.html">mod_authn_dbd</a></code>) ont signal� une charge induite

- inacceptable sur leur fournisseur d'authentification. Cela se

- produit typiquement dans le cas o� une page HTML contient des

- centaines d'objets (images, scripts, pages de styles, media,

- etc...), et o� une requ�te pour cette page g�n�re des centaines de

- sous-requ�tes � effet imm�diat pour des contenus suppl�mentaires

- authentifi�s.</p>

- <p>Pour r�soudre ce probl�me, mod_authn_socache fournit une solution

- qui permet de maintenir un cache des donn�es d'authentification.</p>

-</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="usage" id="usage">Utilisation</a></h2>

- <p>Le cache d'authentification doit �tre utilis� lorsque les

- requ�tes d'authentification induisent une charge significative sur le

- serveur, le serveur d'arri�re-plan ou le r�seau. Cette mise en cache

- n'apportera probablement aucune am�lioration dans le cas d'une

- authentification � base de fichier (<code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code>)

- ou de base de donn�es dbm (<code class="module"><a href="../mod/mod_authn_dbm.html">mod_authn_dbm</a></code>) car ces

- m�thodes sont de par leur conception rapides et l�g�res (la mise en

- cache peut cependant s'av�rer utile dans le cas o� le fichier est

- situ� sur un montage r�seau). Les fournisseurs d'authentification

- bas�s sur SQL ou LDAP ont plus de chances de tirer parti de cette

- mise en cache, en particulier lorsqu'un probl�me de performances est

- d�tect�. <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> g�rant son propre cache,

- seul <code class="module"><a href="../mod/mod_authn_dbd.html">mod_authn_dbd</a></code> est concern� par notre sujet.</p>

- <p>Les principales r�gles � appliquer pour la mise en cache sont :</p>

- <ol><li>Inclure le fournisseur pour lequel vous voulez effectuer une

- mise en cache dans une directive

- <code class="directive">AuthnCacheProvideFor</code>.</li>

- <li>Mettre <var>socache</var> avant le fournisseur pour lequel

- vous voulez effectuer une mise en cache dans votre directive

- <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code>

- ou <code class="directive"><a href="../mod/mod_auth_digest.html#authdigestprovider">AuthDigestProvider</a></code>.</li>

- </ol>

- <p>Voici un exemple simple permettant d'acc�l�rer

- <code class="module"><a href="../mod/mod_authn_dbd.html">mod_authn_dbd</a></code> et utilisant dbm comme moteur de la

- mise en cache :</p>

- <pre class="prettyprint lang-config"> #AuthnCacheSOCache est optionnel. S'il est d�fini, il l'est pour

- #l'ensemble du serveur

-AuthnCacheSOCache dbm

-&lt;Directory /usr/www/myhost/private&gt;

- AuthType Basic

- AuthName "Cached Authentication Example"

- AuthBasicProvider socache dbd

- AuthDBDUserPWQuery "SELECT password FROM authn WHERE user = %s"

- AuthnCacheProvideFor dbd

- Require valid-user

- #Optionnel

- AuthnCacheContext dbd-authn-example

-&lt;/Directory&gt;</pre>

-

-</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>

-<div class="section">

-<h2><a name="dev" id="dev">La mise en cache avec les modules tiers</a></h2>

- <p>Les d�veloppeurs de modules doivent savoir que la mise en cache

- avec mod_authn_socache doit �tre activ�e dans leurs modules. La

- fonction de l'API <var>ap_authn_cache_store</var> permet de

- mettre en cache les donn�es d'authentification qu'un fournisseur

- vient de rechercher ou de g�n�rer. Vous trouverez des exemples

- d'utilisation � <a href="http://svn.eu.apache.org/viewvc?view=revision&amp;revision=957072">r957072</a>, o� trois fournisseurs authn sont activ�s pour la mise

- en cache.</p>

-</div>

-<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>