On Monday 08 April 2002 22:04, Dossy wrote:
>
> Could auth schemes not be implemented via trace filters?
>
Well, almost...
Here is the excerpt from ConnRun() located in nsd/serv.c
/*
* Run the pre-authorization filters and, if ok,
* authorize and run the request procedure.
*/
status = NsRunFilters(conn, NS_FILTER_PRE_AUTH);
if (status != NS_OK) {
goto done;
}
status = Ns_AuthorizeRequest(connPtr->server,
connPtr->request->method, connPtr->request->url,
connPtr->authUser, connPtr->authPasswd,
Ns_ConnPeer(conn));
The problem is in Ns_AuthorizeRequest() which does authorize
(or not) the request based on whats in connPtr; the method,
url, username, password and peer address. This data is parsed
couple of lines above in ParseAuth(). All of this is trimmed
to Basic authorization only (parsing of authUser/authPasswd
in particular).
One should be able to hook into processing of the Ns_AuthorizeRequest,
do the parsing of "Authenticate:" header according to some other
(possibly registered) authorization scheme possibly using some
registered callbacks.
Interestingly, the Ns_AuthorizeRequest does rely on one registered
user function, but this is already used by the nsperm module.
One would need to make this function dependent on the method/url
combination.
This is what I was talkng about when I said that core server
would need to be changed.
So, IMHO, not very many changes are needed in order to get alternate
schemes possible. But... since this one requires the core change
*and* having my previous experiences in this direction, I doubt that
it can be done in a timely fashion.
Zoran
