Re: DB Changes

[Jason Pincin <jpincin@ashtech.net>]

Thanks.  I have some PHP -> AuthenDBI questions, but that can wait.  

I just want to know if we can make the change.  Can I change RoleID to Location and
impliment the String checking along with you?

Jason




On Mon, Jul 19, 1999 at 08:41:19PM -0700, Aaron Turner wrote:
> 
> Well let's see if I can give a little refresher course.
> 
> Basically, there are two Perl modules:
> 
> Apache::AuthenDBI  - does user authentication (who are you?)
> Apache::AuthzDBI   - does user authorization (can you look here?)
> 
> What makes this special is that it uses an SQL DB to ask these two
> questions instead of a htpasswd file or whatever.
> 
> These .htaccess files work just like regular .htaccess files in terms of
> how they restrict access.  Everything you already know about inheritance
> applies.  The only thing that is different is that we're using a DB to do
> the authentication and authorization.  Both modules utilize .htaccess
> files to tell Apache how to query the DB to get the necessary info:
> usernames
> passwords
> group_ids
> 
> 
> 
> Here's an example DB enabled .htaccess file with comments:
> 
> # here well tell Apache how to connect to the DB
> PerlSetVar Auth_DBI_authoritative on
> PerlSetVar Auth_DBI_data_source dbi:mysql:database=linuxkb;host=localhost
> PerlSetVar Auth_DBI_username nobody
> PerlSetVar Auth_DBI_password nobody
> 
> # yes we want the passwords to be checked.
> PerlSetVar Auth_DBI_nopasswd off
> 
> # cache passwds for 1 hour in RAM so we don't have to hit the DB each time
> PerlSetVar Auth_DBI_cache_time 3600
> 
> # The passwords are encrypted in the DB rather than plain-text
> PerlSetVar Auth_DBI_encrypted on
> 
> # We need to tell Apache which table the info is in and what fields
> 
> # Users table
> PerlSetVar Auth_DBI_pwd_table Users
> 
> # Username are in "handle"
> PerlSetVar Auth_DBI_uid_field Handle
> 
> # Password in "Passwd"
> PerlSetVar Auth_DBI_pwd_field Passwd
> 
> # Authorization group is in (one group/user)
> PerlSetVar Auth_DBI_grp_field RoleID
> 
> # so what groups (RoleID in this example) are OK?
> require group 1 3 19 superusers
> 
> 
> So, basically Apache does a lookup in the Users table for the Handle and
> finds the password and group.  It then checks the password vs. the one the
> user typed in.  After that it checks the group (not groups) listed in the
> table vs. the group(s) listed in the .htaccess file.  If the passwords
> match and the group the user is in is listed, then access is given.
> 
> If you have any further questions, let me konw.
> 
> 
> On Mon, 19 Jul 1999, Jason Pincin wrote:
> 
> > Yes.  We will need to revisit security a little bit so that I'm more clear
> > on certain things as far as PHP goes... but I do understand that the
> > strings will need to be in the htaccess file.  Completly :)
> > 
> > So... it's a go right?
> > 
> > Jason
> > 
> > 
> > On Mon, Jul 19, 1999 at 01:58:48PM -0700, Aaron Turner wrote:
> > > 
> > > So you understand that these strings need to be listed in the .htaccess
> > > file for the directories you wish to "protect".
> > > 
> > > On Mon, 19 Jul 1999, Jason Pincin wrote:
> > > 
> > > > Well... thats all you'll need to do, is match a string.  
> > > > 
> > > > On Mon, Jul 19, 1999 at 09:40:34AM -0700, Aaron Turner wrote:
> > > > > 
> > > > > I believe a string is ok.
> > > > > 
> > > > > On Mon, 19 Jul 1999, Jason Pincin wrote:
> > > > > 
> > > > > > Must the "group" be an integer, or can it be a tring comparison?
> > > > > > 
> > > > > > Jason
> > > > > > 
> > > > 
> > > 
> > > --
> > > Aaron Turner, Core Developer       http://vodka.linuxkb.org/~aturner/
> > > Linux Knowledge Base Organization  http://linuxkb.org/
> > > Because world domination requires quality open documentation.
> > 
> 
> --
> Aaron Turner, Core Developer       http://vodka.linuxkb.org/~aturner/
> Linux Knowledge Base Organization  http://linuxkb.org/
> Because world domination requires quality open documentation.