I am having problem getting Apache::AuthDBI working. It seems like its
allowing user access anyways....ie I have tried it with valid user
and invalid username,
valid password and invalid password and in all cases it lets you in....here
is some supporting data
I have the following Apache and mod_perl version...
[Sun Aug 26 19:56:44 2001] [notice] Apache/1.3.12 (Unix) (Red
Hat/Linux) mod_ssl/2.6.6 OpenSSL/0.9.5a mod_perl/1.24 configured -- resuming
normal operations
I also have the following virtual host definition in my httpd.conf.
Note I'm simply requiring a
startup.pl file.
<VirtualHost xx.xx.xx.xx>
ServerName www.joe.com
ServerAdmin [EMAIL PROTECTED]
DocumentRoot /web/joe
ErrorLog /etc/httpd/logs/joe/error_log
TransferLog /etc/httpd/logs/joe/access_log
<Directory /web/joe >
PerlRequire /web/joe/mod_perl/startup.pl
Options Indexes Includes FollowSymLinks ExecCGI
AddHandler cgi-script .cgi
AllowOverride All
</Directory>
ScriptAlias /cgi-bin/ "/web/joe/cgi-bin/"
</VirtualHost>
I also have a statup.pl file that reads
#!/usr/bin/perl
use Apache::DBI;
use Apache::AuthDBI;
use Carp;
warn("in startup");
$Apache::DBI::DEBUG = 2;
$Apache::AuthDBI::DEBUG = 2;
And finally I have a .htaccess that reads
AuthName DBI
AuthType Basic
PerlAuthenHandler Apache::AuthDBI::authen
PerlAuthzHandler Apache::AuthDBI::authz
PerlSetVar Auth_DBI_data_source "dbi:informix:joe@docware"
PerlSetVar Auth_DBI_username xxxx
PerlSetVar Auth_DBI_password yyyyyyyy
PerlSetVar Auth_DBI_pwd_table users
PerlSetVar Auth_DBI_uid_field user_name
PerlSetVar Auth_DBI_grp_whereclause "and user_passwd = $ENV{REMOTE_PASSWD}"
PerlSetVar Auth_DBI_pwd_field user_passwd
PerlSetVar Auth_DBI_grp_field user_name
PerlSetVar Auth_DBI_encrypted off
PerlSetVar Auth_DBI_uidcasesensitive
off
PerlSetVar Auth_DBI_authoritative
on
require valid-user
And the error log shows
31496 Apache::AuthDBI::authen passwd not found in cache
==========
31496 Apache::AuthDBI::authz request type = >initial main<
31496 Apache::AuthDBI::authz user sent = >medi<
31496 Apache::AuthDBI::authz requirements: valid-user=>1<
user=>< group=><
31496 Apache::AuthDBI::authz user_result = OK: valid-user
31496 Apache::AuthDBI::authz return OK
I have followed step by step instructions of Apache::AuthDBI and I can
not get this thing to
work....perhaps I'm overlooking something....
From my understanding of Authentication and Authorization, it looks
like in spite of
Auth_DBI_authoritative being set, the authorization (or authentication)
is not doing its job
of rejectting and returning an OK....
Can someone help please...
-- ======================================================================= Medi Montaseri, [EMAIL PROTECTED], 408-450-7114 Prepass Inc, IT/Operations, Software Eng. =======================================================================
