Note: I've attempted to work through the Windows and Netware build files,
but if those with such systems could repair any damage, that would be
appreciated.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@709839 13f79535-47bb-0310-9956-ffa450edef68
2.2.x authz logic and support existing configurations (including .htaccess
files), and replace <Satisfy*>, Reject, and AuthzMergeRules directives
with Match, <Match*>, and AuthzMerge directives.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@709838 13f79535-47bb-0310-9956-ffa450edef68
Prevent crash when provider alias created to provider which is not
yet registered.
Migrate remaining functionality of mod_authn_default to mod_authn_core.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@709553 13f79535-47bb-0310-9956-ffa450edef68
directives had no matching AuthType and associated authentication
directives, requests would generally fall through in the
check_user_id hook to mod_authn_default.c's authentication_no_user()
handler, which returned DECLINED if ap_auth_type() was not set.
The ap_process_request_internal() function in request.c would handle
this case by logging an "AuthType not set!" error and returning
HTTP_INTERNAL_SERVER_ERROR.
The refactoring removes this error handling in request.c, so
individual modules will need to test for a lack of authentication,
as necessary. Since some modules such as mod_authz_host.c support
Require directives that do not need any authentication, the
mod_authn_default.c handler no longer returns DECLINED if ap_auth_type()
is not set. (Also, mod_authn_default can be compiled out with
--disable-authn-default, so it can't be relied upon to exist.)
Since r->user may now be NULL, individual handlers must test for that
case when necessary. Otherwise, most Require directives in the
absence of AuthType directives cause handlers to crash while performing
strcmp() and friends on a NULL r->user value.
NOTE: I can't test mod_authnz_ldap.c myself, so I'm not sure if it
needs similar fixes. On the one hand, a NULL r->user in the authz
handlers always generates a log message. However, it appears that
authn_ldap_build_filter() will sometimes then be called, perform no
action, which may result in a possibly uninitialized filtbuf buffer
being passed to util_ldap_cache_getuserdn(). I don't know if that
could cause problems in the LDAP cache code. If someone familiar with
LDAP authz could take a look, that would be much appreciated.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@705361 13f79535-47bb-0310-9956-ffa450edef68
which allows optional functions that just wrapped ap_list_provider_names()
to be removed from authn/z modules.
This change requires modules/aaa/mod_auth.h to be included into
server/request.c, which necessitates a minor change to configure.in for
Unix platforms.
I'm unable to tell whether a similar change is necessary for Windows and
NetWare builds or not. Could developers with access to those platforms
please test and make any needed configuration or build alterations? Thanks!
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@659160 13f79535-47bb-0310-9956-ffa450edef68
up before reading the login form. Make sure the kept body filter
is correctly inserted to ensure the body can be read a second
time safely should the authn be successful. [Graham Leggett,
Ruediger Pluem]
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@654958 13f79535-47bb-0310-9956-ffa450edef68
ap_parse_request_body function out of the http module and into a
new module called mod_request, reducing the size of the core.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@647263 13f79535-47bb-0310-9956-ffa450edef68
configurations which match those of the initial request. Revert to
the original behaviour (call access control hooks for internal requests
with URIs different from the initial request) if any access control hooks
or providers are not registered as permitting this optimization.
Introduce wrappers for access control hook and provider registration
which can accept additional mode and flag data.
The configuration walk optimizations were originally proposed a while
ago (see http://marc.info/?l=apache-httpd-dev&m=116536713506234&w=2);
they have been used since then in production systems and appear to be
stable and effective. They permit certain combinations of modules
and clients to function efficiently, especially when a deeply recursive
series of internal requests, such as those generated by certain WebDAV
requests, are all subject to the identical authentication and authorization
directives.
The major change from the original proposal is a cleaner mechanism for
detecting modules which may expect the old behaviour. This has been
tested successfully with Subversion's mod_authz_svn, which specifically
requires the old behaviour when performing path-based authorization based
against its own private access control configuration files.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@644525 13f79535-47bb-0310-9956-ffa450edef68
successful login/logout. Use redirection URL from first row returned
by DB query, in the same manner as that used by mod_authn_dbd when
querying for a single record.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@640932 13f79535-47bb-0310-9956-ffa450edef68
return code of LDAP_UNAVAILABLE as if it were LDAP_SERVER_DOWN.
With this SDK, LDAP_UNAVAIALBLE is returned when the socket had been closed
between LDAP API calls.
PR 39095
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@607766 13f79535-47bb-0310-9956-ffa450edef68
