From: Justin Erenkrantz Date: Fri, 20 Sep 2002 05:15:23 +0000 (+0000) Subject: Remove mention of AuthDBMAuthoritative and AuthUserFileAuthoritative X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d37aa0c7d82aecd5ab8ceb24f84b33ada145597d;p=apache Remove mention of AuthDBMAuthoritative and AuthUserFileAuthoritative directives. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@96923 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/mod_authn_dbm.html.en b/docs/manual/mod/mod_authn_dbm.html.en index b547d825e1..0ef60d652a 100644 --- a/docs/manual/mod/mod_authn_dbm.html.en +++ b/docs/manual/mod/mod_authn_dbm.html.en @@ -20,53 +20,11 @@ AuthBasicProvider or AuthDigestProvider with the 'dbm' value.

-

Directives

See also

Directives

See also

top

AuthDBMAuthoritative Directive

Description: - Sets whether authentication and authorization will be -passwed on to lower level modules
Syntax: - AuthDBMAuthoritative on|off
Default: - AuthDBMAuthoritative on
Context: - directory, .htaccess
Override: - AuthConfig
Status: - Extension
Module: - mod_authn_dbm
- -

Setting the AuthDBMAuthoritative - directive explicitly to 'off' allows for both - authentication and authorization to be passed on to lower level - modules (as defined in the Configuration and - modules.c file if there is no userID - or rule matching the supplied userID. If there is - a userID and/or rule specified; the usual password and access - checks will be applied and a failure will give an Authorization - Required reply.

- -

So if a userID appears in the database of more than one module; - or if a valid Require - directive applies to more than one module; then the first module - will verify the credentials; and no access is passed on; - regardless of the AuthAuthoritative setting.

- -

A common use for this is in conjunction with one of the - auth providers; such as mod_authn_file. Whereas this - DBM module supplies the bulk of the user credential checking; a - few (administrator) related accesses fall through to a lower - level with a well protected .htpasswd file.

- -

By default, control is not passed on and an unknown userID - or rule will result in an Authorization Required reply. Not - setting it thus keeps the system secure and forces an NCSA - compliant behaviour.

- -

Security: Do consider the implications of allowing a user to - allow fall-through in his .htaccess file; and verify that this - is really what you want; Generally it is easier to just secure - a single .htpasswd file, than it is to secure a database which - might have more access interfaces.

-
top

AuthDBMType Directive

Description: +
top

AuthDBMType Directive

Description: Sets the type of database file that is used to store passwords
Syntax: AuthDBMType default|SDBM|GDBM|NDBM|DB
Default: diff --git a/docs/manual/mod/mod_authn_dbm.xml b/docs/manual/mod/mod_authn_dbm.xml index 57b4479d27..85307b225a 100644 --- a/docs/manual/mod/mod_authn_dbm.xml +++ b/docs/manual/mod/mod_authn_dbm.xml @@ -101,51 +101,4 @@ files is configured to use the same type of database.

- -AuthDBMAuthoritative -Sets whether authentication and authorization will be -passwed on to lower level modules -AuthDBMAuthoritative on|off -AuthDBMAuthoritative on -directory.htaccess - -AuthConfig - - - -

Setting the AuthDBMAuthoritative - directive explicitly to 'off' allows for both - authentication and authorization to be passed on to lower level - modules (as defined in the Configuration and - modules.c file if there is no userID - or rule matching the supplied userID. If there is - a userID and/or rule specified; the usual password and access - checks will be applied and a failure will give an Authorization - Required reply.

- -

So if a userID appears in the database of more than one module; - or if a valid Require - directive applies to more than one module; then the first module - will verify the credentials; and no access is passed on; - regardless of the AuthAuthoritative setting.

- -

A common use for this is in conjunction with one of the - auth providers; such as mod_authn_file. Whereas this - DBM module supplies the bulk of the user credential checking; a - few (administrator) related accesses fall through to a lower - level with a well protected .htpasswd file.

- -

By default, control is not passed on and an unknown userID - or rule will result in an Authorization Required reply. Not - setting it thus keeps the system secure and forces an NCSA - compliant behaviour.

- -

Security: Do consider the implications of allowing a user to - allow fall-through in his .htaccess file; and verify that this - is really what you want; Generally it is easier to just secure - a single .htpasswd file, than it is to secure a database which - might have more access interfaces.

- - - diff --git a/docs/manual/mod/mod_authn_file.html.en b/docs/manual/mod/mod_authn_file.html.en index 7def1468b7..1e49444ba0 100644 --- a/docs/manual/mod/mod_authn_file.html.en +++ b/docs/manual/mod/mod_authn_file.html.en @@ -22,7 +22,7 @@ AuthDigestProvider with the 'file' value.

-

Directives

See also

AuthUserFile.

-
top

AuthUserFileAuthoritative Directive

Description: - Sets whether authorization and authentication are -passed to lower level modules
Syntax: - AuthUserFileAuthoritative on|off
Default: - AuthUserFileAuthoritative on
Context: - directory, .htaccess
Override: - AuthConfig
Status: - Base
Module: - mod_authn_file
-
This information has not been updated for Apache 2.0, which - uses a different system for module ordering.
- -

Setting the AuthAuthoritative directive - explicitly to 'off' allows for both - authentication and authorization to be passed on to lower level - modules (as defined in the Configuration and - modules.c files) if there is no - userID or rule matching the supplied - userID. If there is a userID and/or rule specified; the usual - password and access checks will be applied and a failure will give - an Authorization Required reply.

- -

So if a userID appears in the database of more than one module; - or if a valid Require - directive applies to more than one module; then the first module - will verify the credentials; and no access is passed on; - regardless of the AuthAuthoritative setting.

- -

By default; control is not passed on; and an unknown userID or - rule will result in an Authorization Required reply. Not setting - it thus keeps the system secure; and forces an NCSA compliant - behaviour.

- -

Security

Do consider the implications of - allowing a user to allow fall-through in his .htaccess file; and - verify that this is really what you want; Generally it is easier - to just secure a single .htpasswd file, than it is to secure a - database such as mSQL. Make sure that the AuthUserFile and the AuthGroupFile are stored outside - the document tree of the web-server; do not put them in the - directory that they protect. Otherwise, clients will be able to - download the AuthUserFile - and the AuthGroupFile. -
\ No newline at end of file diff --git a/docs/manual/mod/mod_authn_file.xml b/docs/manual/mod/mod_authn_file.xml index fe4ed95396..d3b534ea8c 100644 --- a/docs/manual/mod/mod_authn_file.xml +++ b/docs/manual/mod/mod_authn_file.xml @@ -84,56 +84,4 @@ passwords for authentication - -AuthUserFileAuthoritative -Sets whether authorization and authentication are -passed to lower level modules -AuthUserFileAuthoritative on|off -AuthUserFileAuthoritative on - - directory - .htaccess - -AuthConfig - - - This information has not been updated for Apache 2.0, which - uses a different system for module ordering. - -

Setting the AuthAuthoritative directive - explicitly to 'off' allows for both - authentication and authorization to be passed on to lower level - modules (as defined in the Configuration and - modules.c files) if there is no - userID or rule matching the supplied - userID. If there is a userID and/or rule specified; the usual - password and access checks will be applied and a failure will give - an Authorization Required reply.

- -

So if a userID appears in the database of more than one module; - or if a valid Require - directive applies to more than one module; then the first module - will verify the credentials; and no access is passed on; - regardless of the AuthAuthoritative setting.

- -

By default; control is not passed on; and an unknown userID or - rule will result in an Authorization Required reply. Not setting - it thus keeps the system secure; and forces an NCSA compliant - behaviour.

- - Security Do consider the implications of - allowing a user to allow fall-through in his .htaccess file; and - verify that this is really what you want; Generally it is easier - to just secure a single .htpasswd file, than it is to secure a - database such as mSQL. Make sure that the AuthUserFile and the AuthGroupFile are stored outside - the document tree of the web-server; do not put them in the - directory that they protect. Otherwise, clients will be able to - download the AuthUserFile - and the AuthGroupFile. - - - -