/ 
Apache-MultiAuth-0.06
River stage zero No dependents
/ Apache::MultiAuth

NAME

Apache::MultiAuth - Choose from a number of authentication modules at runtime

SYNOPSIS

Put lines like this in your httpd.conf. In this example authorization is requested for accessing the directory /test. First the credentials (username, password) are checked against the module Apache::AuthSybase and then against the module Apache::AuthenSmb. If any of them succeeds, access to /test is granted.

 # in httpd.conf
 # Important : if not set apachectl configtest will complain about syntax errors

 PerlModule  Apache::MultiAuth

 <Location /test>
   AuthName Test 
   AuthType Basic

   # PerlSetVars for various Apache::Auth* modules
   # These here are example values for Apache::AuthenSmb
   PerlSetVar myPDC SAMBA
   PerlSetVar myDOMAIN ARBEITSGRUPPE

   # Define order and class of Auth modules to try
   AuthModule Apache::AuthSybase Apache::AuthenSmb

   PerlAuthenHandler Apache::MultiAuth
   require valid-user
 </Location>

DESCRIPTION

Apache::MultiAuth allows you to specify multiple authentication modules, to be tried in order. If any module in the list returns OK, then the user is considered authenticated; if none return OK, then the MultiAuth module returns AUTH_REQUIRED and the user is reprompted for credentials. This, depending on the browser, results in a 401 authorization required message.

This is useful for cases where, for example, you have several authentication schemes: for example, NIS, SMB, and htpasswd, and some of your users are only registered in some of the auth databases. Using Apache::MultiAuth, they can be queried in order until the right one is found.

In the event that one of these modules returns OK, a note named "AuthenticatedBy" will be set, which contains the name of the module that returned OK, like so:

$r->notes("AuthenticatedBy" => "Module::Name");

This can be retrieved by any handler that runs after the authentication phase, and can be very useful in logging:

CustomLog "%h %l %u %t \"%r\" %>s %b %{AuthenticatedBy}n" common_auth

The last field in the common_auth log format will be the name of the module that handled the authentication.

CONFIGURATION DIRECTIVES

Apache::MultiAuth allows you to name a number of authentication modules, using the AuthModule directive. These modules are queried, in the order they are provided, until one of them returns OK. Apache::MultiAuth then condiders authentication to be successful, and processing continues. If none of the provided authentication modules returns OK, Apache::MultiAuth passes AUTH_REQUIRED to apache, which results in a 401 Authorization required error.

AUTHORS

Stathy G. Touloumis
Marcel M. Weber
Darren Chamberlain