On Tuesday 09 April 2002 20:51, Tom Jackson wrote: > I still don't see why you can't write a module in tcl or in C to replace > ns_perm (maybe using it as a starting point). Why does this require hacking > the core. We have an authentication scheme in OpenACS that authorizes > requests by a different method right now. No C code is involved here. Just > load the pre-auth filter first and if auth fails decide what to do. > You do not even need to run ns_perm directly, as you can just call > ns_requestauthorize in tcl with your own chosen arguments if you want that > instead of the digest method.
You are correct. There are many ways to achieve the functionality. The pre-auth filter can be triggered and it can do whatever magic necessary to grant and/or forbid access to a particular resource. In the current server implementation, however, the Basic authorization is *always* attempted if the pre-auth filter *succeeds*, unless you unload the ns_perm module. This is bad since by unloading the nsperm you lose the functionality which you may need elsewhere on the server. I'd like to have the Basic authorization in addition to some other authorization means, needed (and dictated) by the DAV RFC (or others). Also, I would not like to authenticate user with Digest and then have the Basic reject this same user again. So what should I do ? I may split on the URL method and Digest-authorize only DAV methods (MKCOL, PROPFIND, etc) leaving GET/POST to Basic. This is not very elegant, IMHO. Are there any other possibilities? Or have I completely missed the point ? Might happen... Oh yes. I'd also like to re-use as much of the functionality of the nsperm module and have Digest only parse headers and validate password (stored in some different passwd file, of course). Other stuff should be left as-is (host/ip/domain-based checking, group checking and alike). That would be really cool. Zoran
