Apache Module mod_authnz_fcgi

This authorizer assumes that the RequireBasicAuth option of

AuthnzFcgiCheckAuthnProvider is On: die if !$ENV{'REMOTE_PASSWD'}; die if !$ENV{'REMOTE_USER'}; print STDERR "This text is written to the web server error log.\n"; if ( ($ENV{'REMO

If a response body is written here, it will be returned to

the client. } }Example configuration:

This module allows FastCGI authorizer applications to authenticate users and authorize access to resources. It supports generic FastCGI authorizers which participate in a single phase for authentication and authorization as well as Apache httpd-specific authenticators and authorizors which participate in one or both phases.

FastCGI authorizers can authenticate using user id and password, such as for Basic authentication, or can authenticate using arbitrary mechanisms.

Type is simply authn

. The first two of these correspond to the directives used to enable participation in the appropriate processing phase.

Descriptions of each mode:

is set to AUTHENTICATOR

. The application must be defined as provider type AuthnzFcgiDefineProvider

and enabled with AuthBasicProvider

. When invoked, the application is expected to authenticate the client using the provided user id and password. Example application: #!/usr/bin/perl use FCGI; while (FCGI::accept >= 0) { die if $ENV{'FCGIAPACHEROLE'} ne "AUTHENTICATOR"; die if $ENV{'FCGIROLE'} ne "AUTHORIZER"; die if !$ENV{'REMOTEPASSWD'}; die if !$ENV{'REMOTEUSER'}; print STDERR "This text is written to the web server error log.\n"; if ( ($ENV{'REMOTEUSER' } eq "foo" || $ENV{'REMOTEUSER'} eq "foo1") && $ENV{'REMOTEPASSWD'} eq "bar" ) { print "Status: 200\n"; print "Variable-AUTHN1: authn01\n"; print "Variable-AUTHN2: authn02\n"; print "\n"; } else { print "Status: 401\n\n"; } }Example configuration:

AuthnzFcgiDefineProvider authn FooAuthn fcgi://localhost:10102/ AuthType Basic AuthName "Restricted" AuthBasicProvider FooAuthn Require ...

. When invoked, the application is expected to authorize the client using the provided user id and other request data. Example application: #!/usr/bin/perl use FCGI; while (FCGI::accept >= 0) { die if $ENV{'FCGIAPACHEROLE'} ne "AUTHORIZER"; die if $ENV{'FCGIROLE'} ne "AUTHORIZER"; die if $ENV{'REMOTEPASSWD'}; print STDERR "This text is written to the web server error log.\n"; if ($ENV{'REMOTEUSER'} eq "foo1") { print "Status: 200\n"; print "Variable-AUTHZ1: authz01\n"; print "Variable-AUTHZ2: authz_02\n"; print "\n"; } else { print "Status: 403\n\n"; } }Example configuration:

AuthnzFcgiDefineProvider authz FooAuthz fcgi://localhost:10103/ AuthType ... AuthName ... AuthBasicProvider ... Require FooAuthz

. The application is expected to handle both authentication and authorization in the same invocation using the user id, password, and other request data. The invocation occurs during the Apache httpd API authentication phase. If the application returns 200 and the same provider is invoked during the authorization phase (via Require

), modauthnzfcgi will return success for the authorization phase without invoking the application. Example application: #!/usr/bin/perl use FCGI; while (FCGI::accept >= 0) { die if $ENV{'FCGIAPACHEROLE'}; die if $ENV{'FCGIROLE'} ne "AUTHORIZER"; die if !$ENV{'REMOTEPASSWD'}; die if !$ENV{'REMOTEUSER'}; print STDERR "This text is written to the web server error log.\n"; if ( ($ENV{'REMOTEUSER' } eq "foo" || $ENV{'REMOTEUSER'} eq "foo1") && $ENV{'REMOTEPASSWD'} eq "bar" && $ENV{'REQUESTURI'} =~ m%/bar/.*%) { print "Status: 200\n"; print "Variable-AUTHNZ1: authnz01\n"; print "Variable-AUTHNZ2: authnz_02\n"; print "\n"; } else { print "Status: 401\n\n"; } }Example configuration:

AuthnzFcgiDefineProvider authnz FooAuthnz fcgi://localhost:10103/ AuthType Basic AuthName "Restricted" AuthBasicProvider FooAuthnz Require FooAuthnz

specifies when it is called. Example application: #!/usr/bin/perl use FCGI; while (FCGI::accept >= 0) { die if $ENV{'FCGIAPACHEROLE'} ne "AUTHENTICATOR"; die if $ENV{'FCGIROLE'} ne "AUTHORIZER"; # This authorizer assumes that the RequireBasicAuth option of # AuthnzFcgiCheckAuthnProvider is On: die if !$ENV{'REMOTEPASSWD'}; die if !$ENV{'REMOTEUSER'}; print STDERR "This text is written to the web server error log.\n"; if ( ($ENV{'REMOTEUSER' } eq "foo" || $ENV{'REMOTEUSER'} eq "foo1") && $ENV{'REMOTEPASSWD'} eq "bar" ) { print "Status: 200\n"; print "Variable-AUTHNZ1: authnz01\n"; print "Variable-AUTHNZ2: authnz02\n"; print "\n"; } else { print "Status: 401\n\n"; # If a response body is written here, it will be returned to # the client. } }Example configuration:

AuthnzFcgiDefineProvider authn FooAuthn fcgi://localhost:10103/ AuthType ... AuthName ... AuthnzFcgiCheckAuthnProvider FooAuthn \ Authoritative On \ RequireBasicAuth Off \ UserExpr "%{reqenv:REMOTE_USER}" Require ...

), define separate providers as follows, even if they map to the same application: AuthnzFcgiDefineProvider authn FooAuthn fcgi://localhost:10102/ AuthnzFcgiDefineProvider authz FooAuthz fcgi://localhost:10102/Specify the authn provider on

can be used to start them. ProxyPass

variable will be obscured, but trace5

LogLevel info authnz_fcgi:trace8

AuthnzFcgiCheckAuthnProvider provider-name|None

Some capabilities of FastCGI authorizers require enablement using this directive instead of AuthBasicProvider

to disable a provider enabled with this directive in an outer scope, such as in a parent directory.UserExpr

is configured and evaluates to an empty string (e.g., authorizer didn't return a variable), this value will be used as the user id. This is typically used when the authorizer has a concept of guest, or unauthenticated, users and guest users are mapped to some specific user id for logging and other purposes.Variable-XXX

setting returned by the authorizer using an option like UserExpr "%{reqenv:XXX}"

. If this option is specified and the user id can't be retrieved using the expression after a successful authentication, the request will be rejected with a 500 error. | |---|

AuthnzFcgiDefineProvider type provider-name backend-address

Modules | Directives | FAQ | Glossary | Sitemap

Apache HTTP Server Version 2.4