Chapter 5. Authentication
Contents:
Authentication Protocol
Authentication Directives
Passwords Under Unix
Passwords Under Win32
New Order Form
Order, Allow, and Deny
Digest Authentication
Anonymous Access
Experiments
Automatic User Information
Using .htaccess Files
Overrides
5.1. Authentication Protocol
Authentication is simple in principle. The client sends its name and password to Apache. Apache looks up its file of names and encrypted passwords to see whether the client is entitled to access. The webmaster can store a number of clients in a list -- either as a simple text file or as a database -- and thereby control access person by person.
It is also possible to group a number of people into named groups and to give or deny access to these groups as a whole. So, throughout this chapter, bill and ben are in the group directors, and daphne and sonia are in the group cleaners. The webmaster can require user so and so or require group such and such. If you have to deal with large numbers of people, it is obviously easier to group them in this way.
Each username/password pair is valid for a particular realm, named when the passwords are created. The browser asks for a URL; the server sends back "Authentication Required" (code 401) and the realm. If the browser already has a username/password for that realm, it sends the request again with the username/password. If not, it prompts the user, usually including the realm's name in the prompt, and sends that.
Of course, all this is worryingly insecure since the password is sent unencrypted over the Web and any malign observer simply has to watch the traffic to get the password -- which is as good in his hands as in the legitimate client's. Digest authentication improves on this by using a challenge/handshake protocol to avoid revealing the actual password. Well, it would, if any browsers supported the technique, which at the moment they don't. However, we include information concerning this procedure later in this chapter, in the hope that a miracle may occur during the lifetime of this edition.
5.1.1. site.authent
Examples are found in site.authent. The Config file looks like this:
User webuser Group webgroup ServerName www.butterthlies.com NameVirtualHost 192.168.123.2 <VirtualHost www.butterthlies.com> ServerAdmin sales@butterthlies.com DocumentRoot /usr/www/site.authent/htdocs/customers ServerName www.butterthlies.com ErrorLog /usr/www/site.authent/logs/error_log TransferLog /usr/www/site.authent/logs/customers/access_log ScriptAlias /cgi-bin /usr/www/cgi-bin </VirtualHost> <VirtualHost sales.butterthlies.com> ServerAdmin sales_mgr@butterthlies.com DocumentRoot /usr/www/site.authent/htdocs/salesmen ServerName sales.butterthlies.com ErrorLog /usr/www/site.authent/logs/error_log TransferLog /usr/www/site.authent/logs/salesmen/access_log ScriptAlias /cgi-bin /usr/www/cgi-bin <Directory /usr/www/site.authent/htdocs/salesmen> AuthType Basic AuthName darkness AuthUserFile /usr/www/ok_users/sales AuthGroupFile /usr/www/ok_users/groups #AuthDBMUserFile /usr/www/ok_dbm/sales #AuthDBMGroupFile /usr/www/ok_dbm/groups require valid-user #require user daphne bill #require group cleaners #require group directors </Directory> <Directory /usr/www/cgi-bin> AuthType Basic AuthName darkness AuthUserFile /usr/www/ok_users/sales AuthGroupFile /usr/www/ok_users/groups #AuthDBMUserFile /usr/www/ok_dbm/sales #AuthDBMGroupFile /usr/www/ok_dbm/groups require valid-user </Directory> </VirtualHost>
What is going on here? Read on.
 |  |  |
| 4.9. Actions |  | 5.2. Authentication Directives |
Copyright © 2001 O'Reilly & Associates. All rights reserved.