1 /* Licensed to the Apache Software Foundation (ASF) under one or more
2 * contributor license agreements. See the NOTICE file distributed with
3 * this work for additional information regarding copyright ownership.
4 * The ASF licenses this file to You under the Apache License, Version 2.0
5 * (the "License"); you may not use this file except in compliance with
6 * the License. You may obtain a copy of the License at
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 * http_auth: authentication
22 * Adapted to Apache by rst.
24 * dirkx - Added Authoritative control to allow passing on to lower
25 * modules if and only if the userid is not known to this
26 * module. A known user with a faulty or absent password still
27 * causes an AuthRequired. The default is 'Authoritative', i.e.
28 * no control is passed along.
31 #include "apr_strings.h"
32 #include "apr_md5.h" /* for apr_password_validate */
34 #include "ap_config.h"
36 #include "http_config.h"
37 #include "http_core.h"
39 #include "http_protocol.h"
40 #include "http_request.h"
46 int auth_authoritative;
49 static void *create_auth_dir_config(apr_pool_t *p, char *d)
51 auth_config_rec *conf = apr_palloc(p, sizeof(*conf));
53 conf->auth_pwfile = NULL; /* just to illustrate the default really */
54 conf->auth_grpfile = NULL; /* unless you have a broken HP cc */
55 conf->auth_authoritative = 1; /* keep the fortress secure by default */
59 static const char *set_auth_slot(cmd_parms *cmd, void *offset, const char *f,
62 if (t && strcmp(t, "standard")) {
63 return apr_pstrcat(cmd->pool, "Invalid auth file type: ", t, NULL);
66 return ap_set_file_slot(cmd, offset, f);
69 static const command_rec auth_cmds[] =
71 AP_INIT_TAKE12("AuthUserFile", set_auth_slot,
72 (void *)APR_OFFSETOF(auth_config_rec, auth_pwfile),
73 OR_AUTHCFG, "text file containing user IDs and passwords"),
74 AP_INIT_TAKE12("AuthGroupFile", set_auth_slot,
75 (void *)APR_OFFSETOF(auth_config_rec, auth_grpfile),
77 "text file containing group names and member user IDs"),
78 AP_INIT_FLAG("AuthAuthoritative", ap_set_flag_slot,
79 (void *)APR_OFFSETOF(auth_config_rec, auth_authoritative),
81 "Set to 'no' to allow access control to be passed along to "
82 "lower modules if the UserID is not known to this module"),
86 module AP_MODULE_DECLARE_DATA auth_module;
88 static char *get_pw(request_rec *r, char *user, char *auth_pwfile)
91 char l[MAX_STRING_LEN];
95 if ((status = ap_pcfg_openfile(&f, r->pool, auth_pwfile)) != APR_SUCCESS) {
96 ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
97 "Could not open password file: %s", auth_pwfile);
100 while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
101 if ((l[0] == '#') || (!l[0])) {
105 w = ap_getword(r->pool, &rpw, ':');
107 if (!strcmp(user, w)) {
109 return ap_getword(r->pool, &rpw, ':');
116 static apr_table_t *groups_for_user(request_rec *r, char *user, char *grpfile)
118 apr_pool_t *p = r->pool;
120 apr_table_t *grps = apr_table_make(p, 15);
122 char l[MAX_STRING_LEN];
123 const char *group_name, *ll, *w;
126 if ((status = ap_pcfg_openfile(&f, p, grpfile)) != APR_SUCCESS) {
127 ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
128 "Could not open group file: %s", grpfile);
132 apr_pool_create(&sp, p);
134 while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
135 if ((l[0] == '#') || (!l[0])) {
141 group_name = ap_getword(sp, &ll, ':');
144 w = ap_getword_conf(sp, &ll);
145 if (!strcmp(w, user)) {
146 apr_table_setn(grps, apr_pstrdup(p, group_name), "in");
152 apr_pool_destroy(sp);
156 /* These functions return 0 if client is OK, and proper error status
157 * if not... either HTTP_UNAUTHORIZED, if we made a check, and it failed, or
158 * HTTP_INTERNAL_SERVER_ERROR, if things are so totally confused that we
159 * couldn't figure out how to tell if the client is authorized or not.
161 * If they return DECLINED, and all other modules also decline, that's
162 * treated by the server core as a configuration error, logged and
166 /* Determine user ID, and check if it really is that user, for HTTP
167 * basic authentication...
170 static int authenticate_basic_user(request_rec *r)
172 auth_config_rec *conf = ap_get_module_config(r->per_dir_config,
176 apr_status_t invalid_pw;
179 if ((res = ap_get_basic_auth_pw(r, &sent_pw))) {
183 if (!conf->auth_pwfile) {
187 if (!(real_pw = get_pw(r, r->user, conf->auth_pwfile))) {
188 if (!(conf->auth_authoritative)) {
191 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
192 "user %s not found: %s", r->user, r->uri);
193 ap_note_basic_auth_failure(r);
194 return HTTP_UNAUTHORIZED;
196 invalid_pw = apr_password_validate(sent_pw, real_pw);
197 if (invalid_pw != APR_SUCCESS) {
198 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
199 "user %s: authentication failure for \"%s\": "
202 ap_note_basic_auth_failure(r);
203 return HTTP_UNAUTHORIZED;
210 static int check_user_access(request_rec *r)
212 auth_config_rec *conf = ap_get_module_config(r->per_dir_config,
214 char *user = r->user;
215 int m = r->method_number;
216 int method_restricted = 0;
219 apr_table_t *grpstatus;
220 const apr_array_header_t *reqs_arr = ap_requires(r);
223 /* BUG FIX: tadc, 11-Nov-1995. If there is no "requires" directive,
224 * then any user will do.
229 reqs = (require_line *)reqs_arr->elts;
231 if (conf->auth_grpfile) {
232 grpstatus = groups_for_user(r, user, conf->auth_grpfile);
238 for (x = 0; x < reqs_arr->nelts; x++) {
240 if (!(reqs[x].method_mask & (AP_METHOD_BIT << m))) {
244 method_restricted = 1;
246 t = reqs[x].requirement;
247 w = ap_getword_white(r->pool, &t);
248 if (!strcmp(w, "valid-user")) {
251 if (!strcmp(w, "user")) {
253 w = ap_getword_conf(r->pool, &t);
254 if (!strcmp(user, w)) {
259 else if (!strcmp(w, "group")) {
261 return DECLINED; /* DBM group? Something else? */
265 w = ap_getword_conf(r->pool, &t);
266 if (apr_table_get(grpstatus, w)) {
271 else if (conf->auth_authoritative) {
272 /* if we aren't authoritative, any require directive could be
273 * valid even if we don't grok it. However, if we are
274 * authoritative, we can warn the user they did something wrong.
275 * That something could be a missing "AuthAuthoritative off", but
276 * more likely is a typo in the require directive.
278 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
279 "access to %s failed, reason: unknown require "
280 "directive:\"%s\"", r->uri, reqs[x].requirement);
284 if (!method_restricted) {
288 if (!(conf->auth_authoritative)) {
292 ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
293 "access to %s failed, reason: user %s not allowed access",
296 ap_note_basic_auth_failure(r);
297 return HTTP_UNAUTHORIZED;
300 static void register_hooks(apr_pool_t *p)
302 ap_hook_check_user_id(authenticate_basic_user,NULL,NULL,APR_HOOK_MIDDLE);
303 ap_hook_auth_checker(check_user_access,NULL,NULL,APR_HOOK_MIDDLE);
306 module AP_MODULE_DECLARE_DATA auth_module =
308 STANDARD20_MODULE_STUFF,
309 create_auth_dir_config, /* dir config creater */
310 NULL, /* dir merger --- default is to override */
311 NULL, /* server config */
312 NULL, /* merge server config */
313 auth_cmds, /* command apr_table_t */
314 register_hooks /* register hooks */