From 07050bb5be522bbf66bb8f053b53beefa295ee68 Mon Sep 17 00:00:00 2001 From: Ken Coar Date: Mon, 26 Jan 1998 16:54:35 +0000 Subject: A truly mighty mod normalising HTML tags to uppercase, and 'i' and 'b' to 'EM' and 'STRONG' respectively. Been threatening to do this for months.. no-one need try to maintain this when writing/modifiying the docs. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@80021 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/mod/mod_auth.html | 110 +++++++++++++++++++++--------------------- 1 file changed, 55 insertions(+), 55 deletions(-) (limited to 'docs/manual/mod/mod_auth.html') diff --git a/docs/manual/mod/mod_auth.html b/docs/manual/mod/mod_auth.html index c0286fe395..eb006f4837 100644 --- a/docs/manual/mod/mod_auth.html +++ b/docs/manual/mod/mod_auth.html @@ -14,136 +14,136 @@ > -

Module mod_auth

+

Module mod_auth

-This module is contained in the mod_auth.c file, and +This module is contained in the mod_auth.c file, and is compiled in by default. It provides for user authentication using textual files. - -
  • AuthGroupFile -
  • AuthUserFile -
  • AuthAuthoritative -
    •  -
    + +
  • AuthGroupFile +
  • AuthUserFile +
  • AuthAuthoritative +
    •  +

    AuthGroupFile

     -Syntax: AuthGroupFile filename
    -Context: directory, .htaccess
    -Override: AuthConfig
    -Status: Base
    -Module: mod_auth

    +Syntax: AuthGroupFile filename
    +Context: directory, .htaccess
    +Override: AuthConfig
    +Status: Base
    +Module: mod_auth

    The AuthGroupFile directive sets the name of a textual file containing the list -of user groups for user authentication. Filename is the path +of user groups for user authentication. Filename is the path to the group file. If it is not absolute (i.e., if it doesn't begin with a slash), it is treated as relative to the ServerRoot.

    Each line of the group file contains a groupname followed by a colon, followed by the member usernames separated by spaces. Example: -

    mygroup: bob joe anne
    -Note that searching large text files is very inefficient; +
    mygroup: bob joe anne
    +Note that searching large text files is very inefficient; AuthDBMGroupFile should -be used instead.

    +be used instead.

    Security: make sure that the AuthGroupFile is stored outside the -document tree of the web-server; do not put it in the directory that -it protects. Otherwise, clients will be able to download the AuthGroupFile.

    +document tree of the web-server; do not put it in the directory that +it protects. Otherwise, clients will be able to download the AuthGroupFile.

    See also AuthName, AuthType and -AuthUserFile.

    +AuthUserFile.

    AuthUserFile

     -Syntax: AuthUserFile filename
    -Context: directory, .htaccess
    -Override: AuthConfig
    -Status: Base
    -Module: mod_auth

    +Syntax: AuthUserFile filename
    +Context: directory, .htaccess
    +Override: AuthConfig
    +Status: Base
    +Module: mod_auth

    The AuthUserFile directive sets the name of a textual file containing the list of users and passwords for user -authentication. Filename is the path to the user +authentication. Filename is the path to the user file. If it is not absolute (i.e., if it doesn't begin with a slash), it is treated as relative to the ServerRoot. -

    Each line of the user file file contains a username followed +

    Each line of the user file file contains a username followed by a colon, followed by the crypt() encrypted password. The behavior of multiple occurrences of the same user is undefined. -

    Note that +

    Note that searching large text files is very inefficient; AuthDBMUserFile should be used instead. -

    +

    Security: make sure that the AuthUserFile is stored outside the -document tree of the web-server; do not put it in the directory that -it protects. Otherwise, clients will be able to download the AuthUserFile.

    +document tree of the web-server; do not put it in the directory that +it protects. Otherwise, clients will be able to download the AuthUserFile.

    See also AuthName, AuthType and -AuthGroupFile.

    -

    +AuthGroupFile.

    +

    AuthAuthoritative

     -Syntax: AuthAuthoritative < on(default) | off >
    -Context: directory, .htaccess
    -Override: AuthConfig
    -Status: Base
    -Module: mod_auth

    +Syntax: AuthAuthoritative < on(default) | off >
    +Context: directory, .htaccess
    +Override: AuthConfig
    +Status: Base
    +Module: mod_auth

    -Setting the AuthAuthoritative directive explicitly to 'off' +Setting the AuthAuthoritative directive explicitly to 'off' allows for both authentication and authorization to be passed on to -lower level modules (as defined in the Configuration and -modules.c files) if there is no userID or -rule matching the supplied userID. If there is a userID and/or +lower level modules (as defined in the Configuration and +modules.c files) if there is no userID or +rule matching the supplied userID. If there is a userID and/or rule specified; the usual password and access checks will be applied and a failure will give an Authorization Required reply. -

    +

    So if a userID appears in the database of more than one module; or if a valid require directive applies to more than one module; then the first module will verify the credentials; and no access is passed on; regardless of the AuthAuthoritative setting. -

    +

    A common use for this is in conjunction with one of the database -modules; such as mod_auth_db.c, mod_auth_dbm.c, -mod_auth_msql.c, and mod_auth_anon.c. These modules +modules; such as mod_auth_db.c, mod_auth_dbm.c, +mod_auth_msql.c, and mod_auth_anon.c. These modules supply the bulk of the user credential checking; but a few (administrator) related accesses fall through to a lower level with a well protected AuthUserFile. -

    +

    -Default: By default; control is not passed on; and an unknown +Default: By default; control is not passed on; and an unknown userID or rule will result in an Authorization Required reply. Not setting it thus keeps the system secure; and forces an NSCA compliant behaviour. -

    +

    Security: Do consider the implications of allowing a user to allow fall-through in his .htaccess file; and verify that this is really what you want; Generally it is easier to just secure a single .htpasswd file, than it is to secure a database such as mSQL. Make sure that the AuthUserFile is stored outside the document tree of the -web-server; do not put it in the directory that it +web-server; do not put it in the directory that it protects. Otherwise, clients will be able to download the AuthUserFile. -

    +

    See also AuthName, AuthType and -AuthGroupFile.

    +AuthGroupFile.

    -- cgit v1.2.1