From 9e23c7dc8b48a01aef8f7a93d50975e2bd3d97ff Mon Sep 17 00:00:00 2001 From: Chris Darroch Date: Fri, 19 Dec 2008 20:01:21 +0000 Subject: [PATCH] update transformation git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@728127 13f79535-47bb-0310-9956-ffa450edef68 --- docs/manual/howto/auth.html.en | 84 ++- docs/manual/howto/auth.xml.ja | 2 +- docs/manual/howto/auth.xml.ko | 2 +- docs/manual/mod/allmodules.xml | 3 + docs/manual/mod/allmodules.xml.de | 3 + docs/manual/mod/allmodules.xml.es | 3 + docs/manual/mod/allmodules.xml.ja | 3 + docs/manual/mod/allmodules.xml.ko | 3 + docs/manual/mod/allmodules.xml.tr | 3 + docs/manual/mod/core.html.en | 4 +- docs/manual/mod/core.xml.de | 2 +- docs/manual/mod/core.xml.ja | 2 +- docs/manual/mod/core.xml.meta | 2 +- docs/manual/mod/core.xml.tr | 2 +- docs/manual/mod/directives.html.en | 16 +- docs/manual/mod/index.html.en | 3 + docs/manual/mod/mod_authnz_ldap.html.en | 2 +- docs/manual/mod/mod_authz_core.html.en | 494 +++++++-------- .../mod/mod_lbmethod_bybusyness.html.en | 1 + .../mod/mod_lbmethod_byrequests.html.en | 1 + .../manual/mod/mod_lbmethod_bytraffic.html.en | 1 + docs/manual/mod/mod_negotiation.xml.meta | 2 +- docs/manual/mod/mod_privileges.html.en | 92 ++- docs/manual/mod/quickreference.html.en | 581 +++++++++--------- docs/manual/new_features_2_4.html.en | 4 +- docs/manual/sitemap.html.en | 3 + 26 files changed, 675 insertions(+), 643 deletions(-) diff --git a/docs/manual/howto/auth.html.en b/docs/manual/howto/auth.html.en index 8adaacf7b4..2f9b710530 100644 --- a/docs/manual/howto/auth.html.en +++ b/docs/manual/howto/auth.html.en @@ -399,7 +399,7 @@ person in AuthBasicProvider file ldap
AuthUserFile /usr/local/apache/passwd/passwords
AuthLDAPURL ldap://ldaphost/o=yourorg
- Require valid-user + Require valid-user
</Directory>

@@ -425,14 +425,15 @@ person in AuthLDAPURL ldap://ldaphost/o=yourorg AuthGroupFile /usr/local/apache/passwd/groups
Require group GroupName
- Require ldap-group cn=mygroup,o=yourorg + Require ldap-group cn=mygroup,o=yourorg
</Directory>

To take authorization a little further, authorization container directives such as - <MatchAll> and - <MatchAny> + <RequireAll> + and + <RequireAny> allow logic to be applied so that the order in which authorization is handled can be completely controled through the configuration. See Authorization @@ -455,20 +456,18 @@ person in configured and called in a specific order which didn't depend on the load order of the auth module itself. This same provider based mechanism has been brought forward into authorization as well. What this means is - that the Require and - Match directives - not only specify which authorization methods should be used, they also + that the Require directive + not only specifies which authorization methods should be used, it also specifies the order in which they are called. Multiple authorization - methods are called in the same order in which the - Require - or Match directives + methods are called in the same order in which the + Require directives appear in the configuration.

With the introduction of authorization container directives such as - <MatchAll> + <RequireAll> and - <MatchAny>, + <RequireAny>, the configuration also has control over when the authorization methods are called and what criteria determines when access is granted. See @@ -479,25 +478,11 @@ person in

By default all Require directives are handled as though contained within a - <MatchAny> + <RequireAny> container directive. In other words, if any of the specified authorization methods succeed, then authorization is granted.

-

In contrast, by default all - Match directives - are handled as though contained within a - <MatchAll> - container directive (unless they are explicitly contained within - a different authorization container directive). - This permits - Match directives - to be usefully mixed with negated - Match not directives. To authorize the request, - none of the negated directives can match their parameters, - while all of the positive directives must match their - parameters (or else return a neutral result).

-

Using authorization providers for access control

@@ -515,9 +500,8 @@ person in a document.

The usage of these providers is specified through the - Require and - Match directives. - These directives register the authorization providers + Require directive. + This directive registers the authorization providers that will be called during the authorization stage of the request processing. For example:

@@ -541,7 +525,12 @@ person in following:

- Match not ip 10.252.46.165 + <RequireAll> + + Require all granted
+ Require not ip 10.252.46.165 + + </RequireAll>

Visitors coming from that address will not be able to see @@ -549,30 +538,37 @@ person in machine name, rather than an IP address, you can use that.

- Match not host host.example.com + <RequireAll> + + Require all granted
+ Require not host host.example.com + + </RequireAll>

And, if you'd like to block access from an entire domain, you can specify just part of an address or domain name:

- Match all granted
- <MatchNotAny> + <RequireAll> - Match ip 192.168.205
- Match host phishers.example.com moreidiots.example
- Match host ke + Require all granted
+ <RequireNone> + + Require ip 192.168.205
+ Require host phishers.example.com moreidiots.example
+ Require host ke + + </RequireNone> - </MatchNotAny> + </RequireAll>

-

The above example uses the <MatchNotAny> container directive +

The above example uses the <RequireNone> directive to make sure that none of the - Match directives - match their parameters before granting access. Note that - the Match all granted directive and the - <MatchNotAny> are implicitly contained - within a <MatchAll> directive.

+ Require directives + contained within it + match their parameters before granting access.

diff --git a/docs/manual/howto/auth.xml.ja b/docs/manual/howto/auth.xml.ja index 21928bbad5..ec73d21a7c 100644 --- a/docs/manual/howto/auth.xml.ja +++ b/docs/manual/howto/auth.xml.ja @@ -1,7 +1,7 @@ - + + + + +