Re: DB Changes

[Aaron Turner <aturner@linuxkb.org>]

Well let's see if I can give a little refresher course.

Basically, there are two Perl modules:

Apache::AuthenDBI  - does user authentication (who are you?)
Apache::AuthzDBI   - does user authorization (can you look here?)

What makes this special is that it uses an SQL DB to ask these two
questions instead of a htpasswd file or whatever.

These .htaccess files work just like regular .htaccess files in terms of
how they restrict access.  Everything you already know about inheritance
applies.  The only thing that is different is that we're using a DB to do
the authentication and authorization.  Both modules utilize .htaccess
files to tell Apache how to query the DB to get the necessary info:
usernames
passwords
group_ids



Here's an example DB enabled .htaccess file with comments:

# here well tell Apache how to connect to the DB
PerlSetVar Auth_DBI_authoritative on
PerlSetVar Auth_DBI_data_source dbi:mysql:database=linuxkb;host=localhost
PerlSetVar Auth_DBI_username nobody
PerlSetVar Auth_DBI_password nobody

# yes we want the passwords to be checked.
PerlSetVar Auth_DBI_nopasswd off

# cache passwds for 1 hour in RAM so we don't have to hit the DB each time
PerlSetVar Auth_DBI_cache_time 3600

# The passwords are encrypted in the DB rather than plain-text
PerlSetVar Auth_DBI_encrypted on

# We need to tell Apache which table the info is in and what fields

# Users table
PerlSetVar Auth_DBI_pwd_table Users

# Username are in "handle"
PerlSetVar Auth_DBI_uid_field Handle

# Password in "Passwd"
PerlSetVar Auth_DBI_pwd_field Passwd

# Authorization group is in (one group/user)
PerlSetVar Auth_DBI_grp_field RoleID

# so what groups (RoleID in this example) are OK?
require group 1 3 19 superusers


So, basically Apache does a lookup in the Users table for the Handle and
finds the password and group.  It then checks the password vs. the one the
user typed in.  After that it checks the group (not groups) listed in the
table vs. the group(s) listed in the .htaccess file.  If the passwords
match and the group the user is in is listed, then access is given.

If you have any further questions, let me konw.


On Mon, 19 Jul 1999, Jason Pincin wrote:

> Yes.  We will need to revisit security a little bit so that I'm more clear
> on certain things as far as PHP goes... but I do understand that the
> strings will need to be in the htaccess file.  Completly :)
> 
> So... it's a go right?
> 
> Jason
> 
> 
> On Mon, Jul 19, 1999 at 01:58:48PM -0700, Aaron Turner wrote:
> > 
> > So you understand that these strings need to be listed in the .htaccess
> > file for the directories you wish to "protect".
> > 
> > On Mon, 19 Jul 1999, Jason Pincin wrote:
> > 
> > > Well... thats all you'll need to do, is match a string.  
> > > 
> > > On Mon, Jul 19, 1999 at 09:40:34AM -0700, Aaron Turner wrote:
> > > > 
> > > > I believe a string is ok.
> > > > 
> > > > On Mon, 19 Jul 1999, Jason Pincin wrote:
> > > > 
> > > > > Must the "group" be an integer, or can it be a tring comparison?
> > > > > 
> > > > > Jason
> > > > > 
> > > 
> > 
> > --
> > Aaron Turner, Core Developer       http://vodka.linuxkb.org/~aturner/
> > Linux Knowledge Base Organization  http://linuxkb.org/
> > Because world domination requires quality open documentation.
> 

--
Aaron Turner, Core Developer       http://vodka.linuxkb.org/~aturner/
Linux Knowledge Base Organization  http://linuxkb.org/
Because world domination requires quality open documentation.