mirror of
https://github.com/apache/httpd.git
synced 2026-01-06 09:01:14 +03:00
w3c tidy to convert to xhtml. Please verify that foreign language files
in here have not been screwed up. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@91115 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Rich Bowen
@@ -1,20 +1,21 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
||||
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
|
||||
<html>
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
<meta name="generator" content="HTML Tidy, see www.w3.org">
|
||||
<meta name="generator" content="HTML Tidy, see www.w3.org" />
|
||||
|
||||
<title>Authentication</title>
|
||||
<link rev="made" href="mailto:rbowen@rcbowen.com">
|
||||
<link rev="made" href="mailto:rbowen@rcbowen.com" />
|
||||
</head>
|
||||
<!-- Background white, links blue (unvisited), navy (visited), red (active) -->
|
||||
|
||||
<body bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink=
|
||||
"#000080" alink="#FF0000">
|
||||
<body bgcolor="#FFFFFF" text="#000000" link="#0000FF"
|
||||
vlink="#000080" alink="#FF0000">
|
||||
<!--#include virtual="header.html" -->
|
||||
|
||||
<h1 align="CENTER">Authentication</h1>
|
||||
<a name="__index__"></a> <!-- INDEX BEGIN -->
|
||||
<a id="__index__" name="__index__"></a> <!-- INDEX BEGIN -->
|
||||
|
||||
|
||||
<ul>
|
||||
@@ -22,8 +23,7 @@
|
||||
|
||||
<li><a href="#the prerequisites">The prerequisites</a></li>
|
||||
|
||||
<li><a href="#getting it working">Getting it
|
||||
working</a></li>
|
||||
<li><a href="#getting it working">Getting it working</a></li>
|
||||
|
||||
<li><a href="#letting more than one person in">Letting more
|
||||
than one person in</a></li>
|
||||
@@ -36,94 +36,99 @@
|
||||
<li><a href="#more information">More information</a></li>
|
||||
</ul>
|
||||
<!-- INDEX END -->
|
||||
<hr>
|
||||
<hr />
|
||||
|
||||
<table border="1">
|
||||
<tr>
|
||||
<td valign="top"><strong>Related Modules</strong><br>
|
||||
<br>
|
||||
<a href="../mod/mod_auth.html">mod_auth</a><br>
|
||||
<a href="../mod/mod_access.html">mod_access</a><br>
|
||||
</td>
|
||||
<td valign="top"><strong>Related Directives</strong><br>
|
||||
<br>
|
||||
<a href="../mod/mod_access.html#allow">Allow</a><br>
|
||||
<a href="../mod/mod_auth.html#authgroupfile">AuthGroupFile</a><br>
|
||||
<a href="../mod/core.html#authname">AuthName</a><br>
|
||||
<a href="../mod/core.html#authtype">AuthType</a><br>
|
||||
<a href="../mod/mod_auth.html#authuserfile">AuthUserFile</a><br>
|
||||
<a href="../mod/mod_access.html#deny">Deny</a><br>
|
||||
<a href="../mod/core.html#options">Options</a><br>
|
||||
<a href="../mod/core.html#require">Require</a><br>
|
||||
<table border="1">
|
||||
<tr>
|
||||
<td valign="top"><strong>Related Modules</strong><br />
|
||||
<br />
|
||||
<a href="../mod/mod_auth.html">mod_auth</a><br />
|
||||
<a href="../mod/mod_access.html">mod_access</a><br />
|
||||
</td>
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<td valign="top"><strong>Related Directives</strong><br />
|
||||
<br />
|
||||
<a href="../mod/mod_access.html#allow">Allow</a><br />
|
||||
<a
|
||||
href="../mod/mod_auth.html#authgroupfile">AuthGroupFile</a><br />
|
||||
<a href="../mod/core.html#authname">AuthName</a><br />
|
||||
<a href="../mod/core.html#authtype">AuthType</a><br />
|
||||
<a
|
||||
href="../mod/mod_auth.html#authuserfile">AuthUserFile</a><br />
|
||||
<a href="../mod/mod_access.html#deny">Deny</a><br />
|
||||
<a href="../mod/core.html#options">Options</a><br />
|
||||
<a href="../mod/core.html#require">Require</a><br />
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<h1><a name="authentication">Authentication</a></h1>
|
||||
<h1><a id="authentication"
|
||||
name="authentication">Authentication</a></h1>
|
||||
|
||||
<p>Authentication is any process by which you verify that
|
||||
someone is who they claim they are. Authorization is any
|
||||
process by which someone is allowed to be where they want to
|
||||
go, or to have information that they want to have.</p>
|
||||
|
||||
<h2><a name="introduction">Introduction</a></h2>
|
||||
<h2><a id="introduction"
|
||||
name="introduction">Introduction</a></h2>
|
||||
|
||||
<p>If you have information on your web site that is sensitive
|
||||
or intended for only a small group of people, the techniques in
|
||||
this article will help you make sure that the people that see
|
||||
those pages are the people that you wanted to see them.</p>
|
||||
|
||||
<p>This article covers the "standard" way of protecting parts of your
|
||||
web site that most of you are going to use.</p>
|
||||
<p>This article covers the "standard" way of protecting parts
|
||||
of your web site that most of you are going to use.</p>
|
||||
|
||||
<h2><a name="the prerequisites">The prerequisites</a></h2>
|
||||
<h2><a id="the prerequisites" name="the prerequisites">The
|
||||
prerequisites</a></h2>
|
||||
|
||||
<p>The directives discussed in this article will need to go either
|
||||
in your main server configuration file (typically in a
|
||||
<p>The directives discussed in this article will need to go
|
||||
either in your main server configuration file (typically in a
|
||||
<Directory> section), or in per-directory configuration
|
||||
files (<code>.htaccess</code> files).</p>
|
||||
|
||||
<p>If you plan to use <code>.htaccess</code> files, you will need to
|
||||
have a server configuration that permits putting authentication
|
||||
directives in these files. This is done with the
|
||||
<code><a href="../mod/core.html#allowoverride">AllowOverride</a></code>
|
||||
directive, which specifies which directives, if any, may be put in
|
||||
per-directory configuration files.</p>
|
||||
|
||||
<p>Since we're talking here about authentication, you will need an
|
||||
<code>AllowOverride</code> directive like the following:</p>
|
||||
<p>If you plan to use <code>.htaccess</code> files, you will
|
||||
need to have a server configuration that permits putting
|
||||
authentication directives in these files. This is done with the
|
||||
<code><a
|
||||
href="../mod/core.html#allowoverride">AllowOverride</a></code>
|
||||
directive, which specifies which directives, if any, may be put
|
||||
in per-directory configuration files.</p>
|
||||
|
||||
<p>Since we're talking here about authentication, you will need
|
||||
an <code>AllowOverride</code> directive like the following:</p>
|
||||
<pre>
|
||||
AllowOverride AuthConfig
|
||||
</pre>
|
||||
|
||||
<p>Or, if you are just going to put the directives directly in your
|
||||
main server configuration file, you will of course need to have
|
||||
write permission to that file.</p>
|
||||
<p>Or, if you are just going to put the directives directly in
|
||||
your main server configuration file, you will of course need to
|
||||
have write permission to that file.</p>
|
||||
|
||||
<p>And you'll need to know a little bit about the directory
|
||||
structure of your server, in order to know where some files are
|
||||
kept. This should not be terribly difficult, and I'll try to
|
||||
make this clear when we come to that point.</p>
|
||||
|
||||
<h2><a name="getting it working">Getting it working</a></h2>
|
||||
<h2><a id="getting it working"
|
||||
name="getting it working">Getting it working</a></h2>
|
||||
|
||||
<p>Here's the basics of password protecting a directory on your
|
||||
server.</p>
|
||||
|
||||
<p>You'll need to create a password file. This file should be
|
||||
placed somewhere not accessible from the web. This is so
|
||||
that folks cannot download the password file. For example, if
|
||||
your documents are served out of
|
||||
placed somewhere not accessible from the web. This is so that
|
||||
folks cannot download the password file. For example, if your
|
||||
documents are served out of
|
||||
<code>/usr/local/apache/htdocs</code> you might want to put the
|
||||
password file(s) in <code>/usr/local/apache/passwd</code>.</p>
|
||||
|
||||
<p>To create the file, use the <a
|
||||
href="../programs/htpasswd.html">htpasswd</a> utility that came
|
||||
with Apache. This be located in the <code>bin</code> directory of
|
||||
wherever you installed Apache. To create the file, type:</p>
|
||||
with Apache. This be located in the <code>bin</code> directory
|
||||
of wherever you installed Apache. To create the file, type:</p>
|
||||
<pre>
|
||||
htpasswd -c /usr/local/apache/passwd/password rbowen
|
||||
</pre>
|
||||
@@ -142,15 +147,15 @@
|
||||
On my server, it's located at
|
||||
<code>/usr/local/apache/bin/htpasswd</code></p>
|
||||
|
||||
<p>Next, you'll need to configure the server to request a password
|
||||
and tell the server which users are allowed access. You can do
|
||||
this either by editing the <code>httpd.conf</code> file or using
|
||||
an <code>.htaccess</code> file. For example, if you wish to
|
||||
protect the directory
|
||||
<p>Next, you'll need to configure the server to request a
|
||||
password and tell the server which users are allowed access.
|
||||
You can do this either by editing the <code>httpd.conf</code>
|
||||
file or using an <code>.htaccess</code> file. For example, if
|
||||
you wish to protect the directory
|
||||
<code>/usr/local/apache/htdocs/secret</code>, you can use the
|
||||
following directives, either placed in the file
|
||||
<code>/usr/local/apache/htdocs/secret/.htaccess</code>, or placed
|
||||
in httpd.conf inside a <Directory
|
||||
<code>/usr/local/apache/htdocs/secret/.htaccess</code>, or
|
||||
placed in httpd.conf inside a <Directory
|
||||
/usr/local/apache/apache/htdocs/secret> section.</p>
|
||||
<pre>
|
||||
AuthType Basic
|
||||
@@ -159,70 +164,73 @@
|
||||
require user rbowen
|
||||
</pre>
|
||||
|
||||
<p>Let's examine each of those directives individually. The <a
|
||||
<p>Let's examine each of those directives individually. The <a
|
||||
href="../mod/core.html#authtype">AuthType</a> directive selects
|
||||
that method that is used to authenticate the user. The most
|
||||
that method that is used to authenticate the user. The most
|
||||
common method is <code>Basic</code>, and this is the method
|
||||
implemented by <a href="../mod/mod_auth.html">mod_auth</a>. It is
|
||||
important to be aware, however, that Basic authentication sends
|
||||
the password from the client to the browser unencrypted. This
|
||||
method should therefore not be used for highly sensitive data.
|
||||
Apache supports one other authentication method: <code>AuthType
|
||||
Digest</code>. This method is implemented by <a
|
||||
href="../mod/mod_auth_digest.html">mod_auth_digest</a> and is much
|
||||
more secure. Only the most recent versions of clients are known
|
||||
to support Digest authentication.</p>
|
||||
implemented by <a href="../mod/mod_auth.html">mod_auth</a>. It
|
||||
is important to be aware, however, that Basic authentication
|
||||
sends the password from the client to the browser unencrypted.
|
||||
This method should therefore not be used for highly sensitive
|
||||
data. Apache supports one other authentication method:
|
||||
<code>AuthType Digest</code>. This method is implemented by <a
|
||||
href="../mod/mod_auth_digest.html">mod_auth_digest</a> and is
|
||||
much more secure. Only the most recent versions of clients are
|
||||
known to support Digest authentication.</p>
|
||||
|
||||
<p>The <a href="../mod/core.html#authname">AuthName</a> directive
|
||||
sets the <em>Realm</em> to be used in the authentication. The
|
||||
realm serves two major functions. First, the client often
|
||||
presents this information to the user as part of the password
|
||||
dialog box. Second, it is used by the client to determine what
|
||||
password to send for a given authenticated area. So, for example,
|
||||
once a client has authenticated in the <code>"Restricted
|
||||
Files"</code> area, it will automatically retry the same password
|
||||
for any area on the same server that is marked with the
|
||||
<code>"Restricted Files"</code> Realm. Therefore, you can prevent
|
||||
a user from being prompted more than once for a password by
|
||||
letting multiple restricted areas share the same realm. Of
|
||||
course, for security reasons, the client will always need to ask
|
||||
again for the password whenever the hostname of the server
|
||||
changes.</p>
|
||||
<p>The <a href="../mod/core.html#authname">AuthName</a>
|
||||
directive sets the <em>Realm</em> to be used in the
|
||||
authentication. The realm serves two major functions. First,
|
||||
the client often presents this information to the user as part
|
||||
of the password dialog box. Second, it is used by the client to
|
||||
determine what password to send for a given authenticated area.
|
||||
So, for example, once a client has authenticated in the
|
||||
<code>"Restricted Files"</code> area, it will automatically
|
||||
retry the same password for any area on the same server that is
|
||||
marked with the <code>"Restricted Files"</code> Realm.
|
||||
Therefore, you can prevent a user from being prompted more than
|
||||
once for a password by letting multiple restricted areas share
|
||||
the same realm. Of course, for security reasons, the client
|
||||
will always need to ask again for the password whenever the
|
||||
hostname of the server changes.</p>
|
||||
|
||||
<p>The <a
|
||||
href="../mod/mod_auth.html#authuserfile">AuthUserFile</a>
|
||||
directive sets the path to the password file that we just created
|
||||
with <code>htpasswd</code>. If you have a large number of users,
|
||||
it can be quite slow to search through a plain text file to
|
||||
authenticate the user on each request. Apache also has the
|
||||
ability to store user information in fast database files. The
|
||||
modules <a href="../mod/mod_auth_db.html">mod_auth_db</a> and <a
|
||||
href="../mod/mod_auth_dbm.html">mod_auth_dbm</a> provide the <a
|
||||
directive sets the path to the password file that we just
|
||||
created with <code>htpasswd</code>. If you have a large number
|
||||
of users, it can be quite slow to search through a plain text
|
||||
file to authenticate the user on each request. Apache also has
|
||||
the ability to store user information in fast database files.
|
||||
The modules <a href="../mod/mod_auth_db.html">mod_auth_db</a>
|
||||
and <a href="../mod/mod_auth_dbm.html">mod_auth_dbm</a> provide
|
||||
the <a
|
||||
href="../mod/mod_auth_db.html#authdbuserfile">AuthDBUserFile</a>
|
||||
and <a
|
||||
href="../mod/mod_auth_dbm.html#authdbmuserfile">AuthDBMUserFile</a>
|
||||
directives respectively. These files can be created and
|
||||
directives respectively. These files can be created and
|
||||
manipulated with the <a
|
||||
href="../programs/dbmmanage.html">dbmmanage</a> program. Many
|
||||
href="../programs/dbmmanage.html">dbmmanage</a> program. Many
|
||||
other types of authentication options are available from third
|
||||
party modules in the <a href="http://modules.apache.org/">Apache
|
||||
Modules Database</a>.</p>
|
||||
party modules in the <a
|
||||
href="http://modules.apache.org/">Apache Modules
|
||||
Database</a>.</p>
|
||||
|
||||
<p>Finally, the <a href="../mod/core.html#require">require</a>
|
||||
directive provides the authorization part of the process by
|
||||
setting the user that is allowed to access this region of the
|
||||
server. In the next section, we discuss various ways to
|
||||
use the <code>require</code> directive.</p>
|
||||
server. In the next section, we discuss various ways to use the
|
||||
<code>require</code> directive.</p>
|
||||
|
||||
<h2><a name="letting more than one person in">Letting more than
|
||||
one person in</a></h2>
|
||||
<h2><a id="letting more than one person in"
|
||||
name="letting more than one person in">Letting more than one
|
||||
person in</a></h2>
|
||||
|
||||
<p>The directives above only let one person (specifically someone
|
||||
with a username of <code>rbowen</code>) into the directory. In
|
||||
most cases, you'll want to let more than one person in. This is
|
||||
where the <a
|
||||
href="../mod/mod_auth.html#authgroupfile">AuthGroupFile</a> comes
|
||||
in.</p>
|
||||
<p>The directives above only let one person (specifically
|
||||
someone with a username of <code>rbowen</code>) into the
|
||||
directory. In most cases, you'll want to let more than one
|
||||
person in. This is where the <a
|
||||
href="../mod/mod_auth.html#authgroupfile">AuthGroupFile</a>
|
||||
comes in.</p>
|
||||
|
||||
<p>If you want to let more than one person in, you'll need to
|
||||
create a group file that associates group names with a list of
|
||||
@@ -279,7 +287,8 @@
|
||||
files, and remember to reference th right one in the
|
||||
<code>AuthUserFile</code> directive.</p>
|
||||
|
||||
<h2><a name="possible problems">Possible problems</a></h2>
|
||||
<h2><a id="possible problems" name="possible problems">Possible
|
||||
problems</a></h2>
|
||||
|
||||
<p>Because of the way that Basic authentication is specified,
|
||||
your username and password must be verified every time you
|
||||
@@ -292,15 +301,16 @@
|
||||
until it gets to your name. And it has to do this every time a
|
||||
page is loaded.</p>
|
||||
|
||||
<p>A consequence of this is that there's a practical limit to how many
|
||||
users you can put in one password file. This limit will vary
|
||||
depending on the performance of your particular server machine, but
|
||||
you can expect to see slowdowns once you get above a few hundred
|
||||
entries, and may wish to consider a different authentication method
|
||||
at that time.</p>
|
||||
<p>A consequence of this is that there's a practical limit to
|
||||
how many users you can put in one password file. This limit
|
||||
will vary depending on the performance of your particular
|
||||
server machine, but you can expect to see slowdowns once you
|
||||
get above a few hundred entries, and may wish to consider a
|
||||
different authentication method at that time.</p>
|
||||
|
||||
<h2><a name="what other neat stuff can i do">What other neat
|
||||
stuff can I do?</a></h2>
|
||||
<h2><a id="what other neat stuff can i do"
|
||||
name="what other neat stuff can i do">What other neat stuff can
|
||||
I do?</a></h2>
|
||||
|
||||
<p>Authentication by username and password is only part of the
|
||||
story. Frequently you want to let people in based on something
|
||||
@@ -360,12 +370,13 @@
|
||||
addition to letting everyone in. What you want is to let
|
||||
<em>only</em> those folks in.</p>
|
||||
|
||||
<h2><a name="more information">More information</a></h2>
|
||||
<h2><a id="more information" name="more information">More
|
||||
information</a></h2>
|
||||
|
||||
<p>You should also read the documentation for
|
||||
<code><a href="../mod/mod_auth.html">mod_auth</a></code> and
|
||||
<code><a href="../mod/mod_access.html">mod_access</a></code>
|
||||
which contain some more information about how this all works.</p>
|
||||
<p>You should also read the documentation for <code><a
|
||||
href="../mod/mod_auth.html">mod_auth</a></code> and <code><a
|
||||
href="../mod/mod_access.html">mod_access</a></code> which
|
||||
contain some more information about how this all works.</p>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user