mod_auth_msql.c
file and
is compiled in by default. It allows access control using the public
domain mSQL database ftp://ftp.bond.edu.au/pub/Minerva/msql
,
a fast but limited SQL engine which can be contacted over an internal
Unix domain protocol as well as over normal tcp/ip socket
communication. It is only available in Apache 1.1 and later. Full description / Example / Compile time options / RevisionHistory / Person to blame / Sourcecode
-
Auth_MSQLhost < FQHN | IP Address | localhost >
localhost
, it is passed to the mSQL library as a null
pointer. This effectively forces it to use /dev/msql rather than the
(slower) socket communication.
-
Auth_MSQLdatabase < mSQL database name >
relshow [<hostname> dbase]
to verify the spelling of the
database name).
-
Auth_MSQLpwd_table < mSQL table name >
Auth_MSQL_Authorative
directive below.
-
Auth_MSQLgrp_table < mSQL table name in the above database >
-
Auth_MSQLuid_field < mSQL field name >
Auth_MSQLpwd_table
and optionally in the
Auth_MSQLgrp_table
tables.
-
Auth_MSQLpwd_field < mSQL field name >
Auth_MSQLpwd_table
table.
-
Auth_MSQLgrp_field < mSQL field name >
BACKWARD_VITEK
option then
the uid and pwd field names default to 'user' and 'password'.
However you are strongly encouraged to always specify these values
explicitly given the security issues involved.
-
Auth_MSQL_nopasswd < on | off >
-
Auth_MSQL_Authorative < on | off >
-
Auth_MSQL_EncryptedPasswords < on | off >
% msqladmin create www
% msql www
-> create table user_records (
-> User_id char(32) primary key,
-> Cpasswd char(32),
-> Xgroup char(32)
-> ) \g
query OK
-> \q
%
User_id
can be as long as desired. However some of the
popular web browsers truncate names at or stop the user from entering
names longer than 32 characters. Furthermore the 'crypt' function
on your platform might impose further limits. Also use of
the require users uid [uid..]
directive in the
access.conf
file where the uid's are separated by
spaces can possibly prohibit the use of spaces in your usernames.
Also, please note the MAX_FIELD_LEN
directive somewhere below.
To use the above, the following example could be in your
access.conf
file. Also there is a more elaborate description
below this example.
<directory /web/docs/private>
Auth_MSQLhost localhost
or
Auth_MSQLhost datab.machine.your.org
localhost
,
it is assumed that Apache and the mSQL
database run on the same (physical) machine and the faster
/dev/msql communication channel will be used. Otherwise,
it is the machine to contact by tcp/ip. Consult the mSQL
documentation for more information.
Auth_MSQLdatabase www
msql.acl
(access control file) of
mSQL does indeed allow the effective uid of the
web server read access to this database. Check the
httpd.conf file for this uid.
-
Auth_MSQLpwd_table user_records
-
Auth_MSQLuid_field User_id
Auth_MSQLpwd_field Cpasswd
user_record
table. If this module is compiled with the BACKWARD_VITEK
compatibility switch, the defaults user
and password
are
assumed if you do not specify them. Currently the user_id field
*MUST* be a primary key or one must ensure that each user only
occurs once in the table. If a uid occurs twice access is
denied by default; but see the ONLY_ONCE
compiler directive for more information.
Auth_MSQLgrp_table user_records
Auth_MSQLgrp_field Xgroup
-
Auth_MSQL_nopasswd off
Auth_MSQL_Authorative on
Auth_MSQL_EncryptedPasswords on
-
AuthName example mSQL realm
AuthType basic
<limit get post head>
order deny,allow
allow from all
require valid-user
valid-user
; allow in any user which has a valid uid/passwd
pair in the above pwd_table.
require user smith jones
require group has_paid
<limit>
#define ONLY_ONCE 1
ONLY_ONCE
directive set, access is denied if the uid occurs more than once in the
uid/passwd table. If you choose not to set it, the software takes
the first pair returned and ignores any further pairs. The SQL
statement used for this is"select password form pwd_table where user='uid'"
this might lead to unpredictable results. For this reason as well as for performance reasons you are strongly advised to make the uid field a primary key. Use at your own peril :-)
#define KEEP_MSQL_CONNECTION_OPEN
msqlClose()
.
If an error occurs an attempt is made to reopen the connection for
the next http request.
This has a number of very serious drawbacks
In short, use this at your own peril and only in a highly controlled and monitored environment.
#define BACKWARD_VITEK
#define VITEK_uid_name "user"
#define VITEK_gid_name "passwd"
khera@kciLink.com
>
and was subsequently distributed with some early versions of Apache. It
can be obtained from
ftp://ftp.kcilink.com/pub/mod_auth_msql.c*
.
Older 'vitek' versions had the field/table names compiled in. Newer
versions, v.1.11 have more access.conf
configuration
options. However these where chosen not to be in line the 'ewse'
version of this module. Also, the 'vitek' module does not give group
control or 'empty' password control.
To get things slightly more in line this version (0.9) should be backward compatible with the 'vitek' module by:
Auth_MSQL_EncryptedPasswords
on/off functionality
If this troubles you, remove the 'BACKWARD_VITEK' define.
#define MAX_FIELD_LEN (64)
#define MAX_QUERY_LEN (32+24+MAX_FIELD_LEN*2+3*MSQL_FIELD_NAME_LEN+1*MSQL_TABLE_NAME_LEN)
HUGE_STRING_LENGTH
, the above two compile
time directives are supplies. The MAX_FIELD_LEN
contains the maximum number of
characters in your user, password and group fields. The maximum query length is derived
from those values.
We only do the following two queries:
"select PWDFIELD from PWDTABEL where USERFIELD='UID'"
"select GROUPFIELD from GROUPTABLE where USERFIELD='UID' and GROUPFIELD='GID'"
This leads to the above limit for the query string. We are ignoring escaping a wee bit here assuming not more than 24 escapes.)
Auth_MSQL_nopasswd
' option
Auth_MSQLgrp_field
'
as indicated above.
*host
to host
fixed. Credits
go to Rob Stout, palloc
return code check(s), should be
backward compatible with 1.11 version of Vivek Khera
Auth_MSQL_EncryptedPasswords
on/off functionality.
msqlClose() statements added upon error. Support for
persistent connections with the mSQL database (riscy).
Escaping of ' and \. Replaced some
MAX_STRING_LENGTH
claims.
Dirk.vanGulik@jrc.it
>.
Feel free to contact me if you have any problems, ice-creams or bugs. This
documentation, courtesy of Nick Himba,
<himba@cs.utwente.nl>
.
http://www.apache.org
. A snapshot of a development version
usually resides at
http://me-www.jrc.it/~dirkx/mod_auth_msql.c
. Please make sure
that you always quote the version you use when filing a bug report.
Furthermore a test/demonstration suite (which assumes that you have
both mSQL and Apache compiled and installed) is avaible at the contrib
section of
ftp://ftp.apache.org/apache/dist/contrib
or
http://me-www.jrc.it/~dirkx/apache-msql-demo.tar.gz
and
its
README
file.