granicus.if.org Git - apache/blob - docs/manual/mod/mod_auth_basic.html.en

   1 <?xml version="1.0" encoding="ISO-8859-1"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
   4 <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
   5 <!--
   6         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
   7               This file is generated from xml source: DO NOT EDIT
   8         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
   9       -->
  10 <title>mod_auth_basic - Apache HTTP Server Version 2.5</title>
  11 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
  12 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
  13 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" />
  14 <script src="../style/scripts/prettify.min.js" type="text/javascript">
  15 </script>
  16
  17 <link href="../images/favicon.ico" rel="shortcut icon" /></head>
  18 <body>
  19 <div id="page-header">
  20 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
  21 <p class="apache">Apache HTTP Server Version 2.5</p>
  22 <img alt="" src="../images/feather.png" /></div>
  23 <div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
  24 <div id="path">
  25 <a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.5</a> &gt; <a href="./">Modules</a></div>
  26 <div id="page-content">
  27 <div id="preamble"><h1>Apache Module mod_auth_basic</h1>
  28 <div class="toplang">
  29 <p><span>Available Languages: </span><a href="../en/mod/mod_auth_basic.html" title="English">&nbsp;en&nbsp;</a> |
  30 <a href="../es/mod/mod_auth_basic.html" hreflang="es" rel="alternate" title="Español">&nbsp;es&nbsp;</a> |
  31 <a href="../fr/mod/mod_auth_basic.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a> |
  32 <a href="../ja/mod/mod_auth_basic.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
  33 <a href="../ko/mod/mod_auth_basic.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a></p>
  34 </div>
  35 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Basic HTTP authentication</td></tr>
  36 <tr><th><a href="module-dict.html#Status">Status:</a></th><td>Base</td></tr>
  37 <tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>auth_basic_module</td></tr>
  38 <tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_auth_basic.c</td></tr></table>
  39 <h3>Summary</h3>
  40
  41     <p>This module allows the use of HTTP Basic Authentication to
  42     restrict access by looking up users in the given providers.
  43     HTTP Digest Authentication is provided by
  44     <code class="module"><a href="../mod/mod_auth_digest.html">mod_auth_digest</a></code>.  This module should
  45     usually be combined with at least one authentication module
  46     such as <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code> and one authorization
  47     module such as <code class="module"><a href="../mod/mod_authz_user.html">mod_authz_user</a></code>.</p>
  48 </div>
  49 <div id="quickview"><h3 class="directives">Directives</h3>
  50 <ul id="toc">
  51 <li><img alt="" src="../images/down.gif" /> <a href="#authbasicauthoritative">AuthBasicAuthoritative</a></li>
  52 <li><img alt="" src="../images/down.gif" /> <a href="#authbasicfake">AuthBasicFake</a></li>
  53 <li><img alt="" src="../images/down.gif" /> <a href="#authbasicprovider">AuthBasicProvider</a></li>
  54 <li><img alt="" src="../images/down.gif" /> <a href="#authbasicusedigestalgorithm">AuthBasicUseDigestAlgorithm</a></li>
  55 </ul>
  56 <h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&amp;list_id=144532&amp;product=Apache%20httpd-2&amp;query_format=specific&amp;order=changeddate%20DESC%2Cpriority%2Cbug_severity&amp;component=mod_auth_basic">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&amp;component=mod_auth_basic">Report a bug</a></li></ul><h3>See also</h3>
  57 <ul class="seealso">
  58 <li><code class="directive"><a href="../mod/mod_authn_core.html#authname">AuthName</a></code></li>
  59 <li><code class="directive"><a href="../mod/mod_authn_core.html#authtype">AuthType</a></code></li>
  60 <li><code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code></li>
  61 <li><a href="../howto/auth.html">Authentication howto</a></li>
  62 <li><a href="#comments_section">Comments</a></li></ul></div>
  63
  64 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
  65 <div class="directive-section"><h2><a name="AuthBasicAuthoritative" id="AuthBasicAuthoritative">AuthBasicAuthoritative</a> <a name="authbasicauthoritative" id="authbasicauthoritative">Directive</a><a title="Permanent link" href="#authbasicauthoritative" class="permalink">&para;</a></h2>
  66 <table class="directive">
  67 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets whether authorization and authentication are passed to
  68 lower level modules</td></tr>
  69 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicAuthoritative On|Off</code></td></tr>
  70 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicAuthoritative On</code></td></tr>
  71 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
  72 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
  73 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
  74 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
  75 </table>
  76     <p>Normally, each authorization module listed in <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code> will attempt
  77     to verify the user, and if the user is not found in any provider,
  78     access will be denied. Setting the
  79     <code class="directive">AuthBasicAuthoritative</code> directive explicitly
  80     to <code>Off</code> allows for both authentication and
  81     authorization to be passed on to other non-provider-based modules
  82     if there is <strong>no userID</strong> or <strong>rule</strong>
  83     matching the supplied userID.  This should only be necessary when
  84     combining <code class="module"><a href="../mod/mod_auth_basic.html">mod_auth_basic</a></code> with third-party modules
  85     that are not configured with the <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code>
  86     directive.  When using such modules, the order of processing
  87     is determined in the modules' source code and is not configurable.</p>
  88
  89 </div>
  90 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
  91 <div class="directive-section"><h2><a name="AuthBasicFake" id="AuthBasicFake">AuthBasicFake</a> <a name="authbasicfake" id="authbasicfake">Directive</a><a title="Permanent link" href="#authbasicfake" class="permalink">&para;</a></h2>
  92 <table class="directive">
  93 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Fake basic authentication using the given expressions for
  94 username and password</td></tr>
  95 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicFake off|<var>username</var> [<var>password</var>]</code></td></tr>
  96 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
  97 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
  98 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
  99 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 100 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
 101 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.4.5 and later</td></tr>
 102 </table>
 103     <p>The username and password specified are combined into an
 104     Authorization header, which is passed to the server or service
 105     behind the webserver. Both the username and password fields are
 106     interpreted using the <a href="../expr.html">expression parser</a>,
 107     which allows both the username and password to be set based on
 108     request parameters.</p>
 109
 110     <p>If the password is not specified, the default value "password"
 111     will be used. To disable fake basic authentication for an URL
 112     space, specify "AuthBasicFake off".</p>
 113
 114     <p>In this example, we pass a fixed username and password to a
 115     backend server.</p>
 116
 117     <div class="example"><h3>Fixed Example</h3><pre class="prettyprint lang-config">&lt;Location "/demo"&gt;
 118     AuthBasicFake demo demopass
 119 &lt;/Location&gt;</pre>
 120 </div>
 121
 122     <p>In this example, we pass the email address extracted from a client
 123     certificate, extending the functionality of the FakeBasicAuth option
 124     within the <code class="directive"><a href="../mod/mod_ssl.html#ssloptions">SSLOptions</a></code>
 125     directive. Like the FakeBasicAuth option, the password is set to the
 126     fixed string "password".</p>
 127
 128     <div class="example"><h3>Certificate Example</h3><pre class="prettyprint lang-config">&lt;Location "/secure"&gt;
 129     AuthBasicFake "%{SSL_CLIENT_S_DN_Email}"
 130 &lt;/Location&gt;</pre>
 131 </div>
 132
 133     <p>Extending the above example, we generate a password by hashing the
 134     email address with a fixed passphrase, and passing the hash to the
 135     backend server. This can be used to gate into legacy systems that do
 136     not support client certificates.</p>
 137
 138     <div class="example"><h3>Password Example</h3><pre class="prettyprint lang-config">&lt;Location "/secure"&gt;
 139     AuthBasicFake "%{SSL_CLIENT_S_DN_Email}" "%{sha1:passphrase-%{SSL_CLIENT_S_DN_Email}}"
 140 &lt;/Location&gt;</pre>
 141 </div>
 142
 143     <div class="example"><h3>Exclusion Example</h3><pre class="prettyprint lang-config">&lt;Location "/public"&gt;
 144     AuthBasicFake off
 145 &lt;/Location&gt;</pre>
 146 </div>
 147
 148
 149 </div>
 150 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 151 <div class="directive-section"><h2><a name="AuthBasicProvider" id="AuthBasicProvider">AuthBasicProvider</a> <a name="authbasicprovider" id="authbasicprovider">Directive</a><a title="Permanent link" href="#authbasicprovider" class="permalink">&para;</a></h2>
 152 <table class="directive">
 153 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the authentication provider(s) for this location</td></tr>
 154 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicProvider <var>provider-name</var>
 155 [<var>provider-name</var>] ...</code></td></tr>
 156 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicProvider file</code></td></tr>
 157 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 158 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 159 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 160 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
 161 </table>
 162     <p>The <code class="directive">AuthBasicProvider</code> directive sets
 163     which provider is used to authenticate the users for this location.
 164     The default <code>file</code> provider is implemented
 165     by the <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code> module.  Make sure
 166     that the chosen provider module is present in the server.</p>
 167     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config">&lt;Location "/secure"&gt;
 168     AuthType basic
 169     AuthName "private area"
 170     AuthBasicProvider  dbm
 171     AuthDBMType        SDBM
 172     AuthDBMUserFile    "/www/etc/dbmpasswd"
 173     Require            valid-user
 174 &lt;/Location&gt;</pre>
 175 </div>
 176     <p> Providers are queried in order until a provider finds a match
 177     for the requested username, at which point this sole provider will
 178     attempt to check the password.  A failure to verify the password does
 179     not result in control being passed on to subsequent providers.</p>
 180
 181     <p>Providers are implemented by <code class="module"><a href="../mod/mod_authn_dbm.html">mod_authn_dbm</a></code>,
 182     <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code>, <code class="module"><a href="../mod/mod_authn_dbd.html">mod_authn_dbd</a></code>,
 183     <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> and <code class="module"><a href="../mod/mod_authn_socache.html">mod_authn_socache</a></code>.</p>
 184
 185 </div>
 186 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 187 <div class="directive-section"><h2><a name="AuthBasicUseDigestAlgorithm" id="AuthBasicUseDigestAlgorithm">AuthBasicUseDigestAlgorithm</a> <a name="authbasicusedigestalgorithm" id="authbasicusedigestalgorithm">Directive</a><a title="Permanent link" href="#authbasicusedigestalgorithm" class="permalink">&para;</a></h2>
 188 <table class="directive">
 189 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Check passwords against the authentication providers as if
 190 Digest Authentication was in force instead of Basic Authentication.
 191 </td></tr>
 192 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicUseDigestAlgorithm MD5|Off</code></td></tr>
 193 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicUseDigestAlgorithm Off</code></td></tr>
 194 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 195 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 196 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 197 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
 198 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.4.7 and later</td></tr>
 199 </table>
 200     <p>Normally, when using Basic Authentication, the providers listed in
 201     <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code>
 202     attempt to verify a user by checking their data stores for
 203     a matching username and associated password.  The stored passwords
 204     are usually encrypted, but not necessarily so; each provider may
 205     choose its own storage scheme for passwords.</p>
 206
 207     <p>When using <code class="directive"><a href="../mod/mod_auth_digest.html#authdigestprovider">AuthDigestProvider</a></code> and Digest
 208     Authentication, providers perform a similar check to find a matching
 209     username in their data stores.  However, unlike in the Basic
 210     Authentication case, the value associated with each stored username
 211     must be an encrypted string composed from the username, realm name,
 212     and password.  (See
 213     <a href="http://tools.ietf.org/html/rfc2617#section-3.2.2.2">
 214     RFC 2617, Section 3.2.2.2</a> for more details on the format used
 215     for this encrypted string.)</p>
 216
 217     <p>As a consequence of the difference in the stored values between
 218     Basic and Digest Authentication, converting from Digest
 219     Authentication to Basic Authentication generally requires that all
 220     users be assigned new passwords, as their existing passwords cannot
 221     be recovered from the password storage scheme imposed on those
 222     providers which support Digest Authentication.</p>
 223
 224     <p>Setting the <code class="directive">AuthBasicUseDigestAlgorithm</code> directive
 225     to <code>MD5</code> will cause the user's Basic Authentication password
 226     to be checked using the same encrypted format as for Digest
 227     Authentication.  First a string composed from the username, realm name,
 228     and password is hashed with MD5; then the username and this encrypted
 229     string are passed to the providers listed in
 230     <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code>
 231     as if
 232     <code class="directive"><a href="../mod/mod_authn_core.html#authtype">AuthType</a></code>
 233     was set to <code>Digest</code> and Digest Authentication was in force.
 234     </p>
 235
 236     <p>Through the use of <code class="directive">AuthBasicUseDigestAlgorithm</code>
 237     a site may switch from Digest to Basic Authentication without
 238     requiring users to be assigned new passwords.</p>
 239
 240     <div class="note">
 241       The inverse process of switching from Basic to Digest
 242       Authentication without assigning new passwords is generally
 243       not possible.  Only if the Basic Authentication passwords
 244       have been stored in plain text or with a reversable encryption
 245       scheme will it be possible to recover them and generate a
 246       new data store following the Digest Authentication password
 247       storage scheme.
 248     </div>
 249
 250     <div class="note">
 251       Only providers which support Digest Authentication will be able
 252       to authenticate users when <code class="directive">AuthBasicUseDigestAlgorithm</code>
 253       is set to <code>MD5</code>.  Use of other providers will result
 254       in an error response and the client will be denied access.
 255     </div>
 256
 257 </div>
 258 </div>
 259 <div class="bottomlang">
 260 <p><span>Available Languages: </span><a href="../en/mod/mod_auth_basic.html" title="English">&nbsp;en&nbsp;</a> |
 261 <a href="../es/mod/mod_auth_basic.html" hreflang="es" rel="alternate" title="Español">&nbsp;es&nbsp;</a> |
 262 <a href="../fr/mod/mod_auth_basic.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a> |
 263 <a href="../ja/mod/mod_auth_basic.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
 264 <a href="../ko/mod/mod_auth_basic.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a></p>
 265 </div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
 266 <script type="text/javascript"><!--//--><![CDATA[//><!--
 267 var comments_shortname = 'httpd';
 268 var comments_identifier = 'http://httpd.apache.org/docs/trunk/mod/mod_auth_basic.html';
 269 (function(w, d) {
 270     if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
 271         d.write('<div id="comments_thread"><\/div>');
 272         var s = d.createElement('script');
 273         s.type = 'text/javascript';
 274         s.async = true;
 275         s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
 276         (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
 277     }
 278     else {
 279         d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
 280     }
 281 })(window, document);
 282 //--><!]]></script></div><div id="footer">
 283 <p class="apache">Copyright 2018 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
 284 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
 285 if (typeof(prettyPrint) !== 'undefined') {
 286     prettyPrint();
 287 }
 288 //--><!]]></script>
 289 </body></html>