Hello community,
here is the log from the commit of package perl-Apache-AuthCookie for
openSUSE:Factory checked in at 2016-01-21 23:44:09
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-Apache-AuthCookie (Old)
and /work/SRC/openSUSE:Factory/.perl-Apache-AuthCookie.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Apache-AuthCookie"
Changes:
--------
---
/work/SRC/openSUSE:Factory/perl-Apache-AuthCookie/perl-Apache-AuthCookie.changes
2015-12-29 12:59:38.000000000 +0100
+++
/work/SRC/openSUSE:Factory/.perl-Apache-AuthCookie.new/perl-Apache-AuthCookie.changes
2016-01-22 01:09:48.000000000 +0100
@@ -1,0 +2,17 @@
+Tue Jan 19 09:34:24 UTC 2016 - [email protected]
+
+- updated to 3.24
+ see /usr/share/doc/packages/perl-Apache-AuthCookie/Changes
+
+ 3.24 2016-01-13
+ - Update Apache 2.4 README, flesh out guts of Authz Provider notes.
+ - Improve Apache 2.4 README's AuthzProvider documentation
+ - Add POD to Apache2_4::AuthCookie
+ - Add FAQ to Apache2_4::AuthCookie documenation
+ - 2.4: document that PerlAddAuthzProvider is only needed for *custom*
Requires directives.
+ - 2.4: make authz_handler recognize multiple usernames in the directive
like
+ mod_authz_user does.
+ - add test case for internal authz_handler
+ - explicitly require Apache::Test 1.39 so that APACHE2_4 defines are set
+
+-------------------------------------------------------------------
Old:
----
Apache-AuthCookie-3.23.tar.gz
New:
----
Apache-AuthCookie-3.24.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Apache-AuthCookie.spec ++++++
--- /var/tmp/diff_new_pack.XB2tIw/_old 2016-01-22 01:09:50.000000000 +0100
+++ /var/tmp/diff_new_pack.XB2tIw/_new 2016-01-22 01:09:50.000000000 +0100
@@ -1,7 +1,7 @@
#
# spec file for package perl-Apache-AuthCookie
#
-# Copyright (c) 2015 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -17,7 +17,7 @@
Name: perl-Apache-AuthCookie
-Version: 3.23
+Version: 3.24
Release: 0
%define cpan_name Apache-AuthCookie
Summary: Perl Authentication and Authorization via cookies
@@ -30,12 +30,12 @@
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: perl
BuildRequires: perl-macros
-BuildRequires: perl(Apache::Test) >= 1.35
+BuildRequires: perl(Apache::Test) >= 1.39
BuildRequires: perl(CGI) >= 3.12
BuildRequires: perl(Class::Load) >= 0.03
BuildRequires: perl(autobox) >= 1.1
BuildRequires: perl(mod_perl2) >= 1.999022
-Requires: perl(Apache::Test) >= 1.35
+Requires: perl(Apache::Test) >= 1.39
Requires: perl(CGI) >= 3.12
Requires: perl(Class::Load) >= 0.03
Requires: perl(autobox) >= 1.1
++++++ Apache-AuthCookie-3.23.tar.gz -> Apache-AuthCookie-3.24.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/Changes
new/Apache-AuthCookie-3.24/Changes
--- old/Apache-AuthCookie-3.23/Changes 2015-09-10 18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/Changes 2016-01-14 00:16:15.000000000 +0100
@@ -1,5 +1,16 @@
Revision history for Apache::AuthCookie
+3.24 2016-01-13
+ - Update Apache 2.4 README, flesh out guts of Authz Provider notes.
+ - Improve Apache 2.4 README's AuthzProvider documentation
+ - Add POD to Apache2_4::AuthCookie
+ - Add FAQ to Apache2_4::AuthCookie documenation
+ - 2.4: document that PerlAddAuthzProvider is only needed for *custom*
Requires directives.
+ - 2.4: make authz_handler recognize multiple usernames in the directive like
+ mod_authz_user does.
+ - add test case for internal authz_handler
+ - explicitly require Apache::Test 1.39 so that APACHE2_4 defines are set
+
3.23 2015-09-10
- Improve CGI mode param() handling to avoi CGI.pm's "param() called in
list context" warning.
- add support for Apache 2.4 via mod_perl 1.09.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/MANIFEST
new/Apache-AuthCookie-3.24/MANIFEST
--- old/Apache-AuthCookie-3.23/MANIFEST 2015-09-10 18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/MANIFEST 2016-01-14 00:16:15.000000000 +0100
@@ -32,6 +32,7 @@
t/htdocs/docs/index.html
t/htdocs/docs/login.pl
t/htdocs/docs/logout.pl
+t/htdocs/docs/myuser/get_me.html
t/htdocs/docs/protected/echo_user.pl
t/htdocs/docs/protected/get_me.html
t/htdocs/docs/stimeout/get_me.html
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/META.yml
new/Apache-AuthCookie-3.24/META.yml
--- old/Apache-AuthCookie-3.23/META.yml 2015-09-10 18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/META.yml 2016-01-14 00:16:15.000000000 +0100
@@ -19,4 +19,4 @@
bugtracker:
http://rt.cpan.org/Public/Dist/Display.html?Name=Apache-AuthCookie
homepage: http://search.cpan.org/dist/Apache-AuthCookie/
repository: git://github.com/mschout/apache-authcookie.git
-version: '3.23'
+version: '3.24'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/Makefile.PL
new/Apache-AuthCookie-3.24/Makefile.PL
--- old/Apache-AuthCookie-3.23/Makefile.PL 2015-09-10 18:59:48.000000000
+0200
+++ new/Apache-AuthCookie-3.24/Makefile.PL 2016-01-14 00:16:15.000000000
+0100
@@ -11,7 +11,7 @@
'NAME' => 'Apache::AuthCookie',
'VERSION_FROM' => 'lib/Apache/AuthCookie.pm',
'PREREQ_PM' => {
- 'Apache::Test' => 1.35,
+ 'Apache::Test' => 1.39,
'Test::More' => 0,
'CGI' => 0,
'Class::Load' => 0.03,
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/README.apache-2.4.pod
new/Apache-AuthCookie-3.24/README.apache-2.4.pod
--- old/Apache-AuthCookie-3.23/README.apache-2.4.pod 2015-09-10
18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/README.apache-2.4.pod 2016-01-14
00:16:15.000000000 +0100
@@ -25,7 +25,7 @@
=item Apache::Test
You need Apache::Test version 1.39 or later. Previous versions do not define
-the constant APACHE2_4 which is needed for the test suite.
+the constant C<APACHE2_4> which is needed for the test suite.
=item Your AuthCookie Subclass
@@ -44,7 +44,8 @@
=item Apache2::Const::AUTHZ_DENIED_NO_USER
-return this constant if C<< $r->user >> is empty/undefined.
+return this constant if C<< $r->user >> is empty/undefined and you do not wish
+to allow anonymous access.
=item Apache2::Const::AUTHZ_DENIED
@@ -54,6 +55,16 @@
return this constant if C<< $r->user >> is authorized for the current request
+=item Apache2::Const::AUTHZ_GENERAL_ERROR
+
+return this constant to indicate an error processing authz requirements.
+
+=item Apache2::Const::AUTHZ_NEUTRAL
+
+return this constant to indicate a neutral response. It is assumed that
+another authz provider will be checked in a parent/sibling scope that will
+return granted or denied.
+
=back
=back
@@ -64,33 +75,150 @@
=item *
-Replace all C<PerlAuthzHandler> entries with top level C<PerlAddAuthzProvider>
entries.
+Remove all C<PerlAuthzHandler> entries. C<PerlAuthzHandler> does not exist in
Apache 2.4.
-C<PerlAuthzHandler> is gone in Apache 2.4. It has been replaced with
-C<PerlAddAuthzProvider>. C<PerlAddAUthzProvider> methods are expected to
-return one of C<AUTHZ_DENIED_NO_USER>, C<AUTHZ_GRANTED>, or C<AUTHZ_DENIED>.
-Other return values are not valid. Be sure you have ported your authz methods
-to return the appropriate constant!
+=item *
+
+Depending on what your C<Require> directives say, you may need to add one or
+more top level C<PerlAddAuthzProvider> entires and implement a handler for each
+one.
+
+If your C<Require> directives are simply C<valid-user> or C<user ...> then you
+do not need to do this. Apache already provides an authz provider that handles
+C<user> and C<valid-user> requirements for you in C<mod_authz_user>.
+
+C<AuthCookie> does provide a C<authz_handler> for these requirements for
+backwards compatibility with previous versions, but the one provided by Apache
+is preferred.
=item *
-Add a C<PerlAddAuthzProvider> directive that calls C<authz_handler()>
+If you are C<Require>'ing anything other than C<valid-user> or C<user ...> then
+you will need to write your own Authz Provider method and register it with
Apache.
-E.g.:
+Authz Providers are the Apache 2.4 equivalent of a C<PerlAuthzHandler> method.
+Each one implements a specific requirement. E.g.:
- PerlAddAuthzProvider user Sample::Apache2::AuthCookieHandler->authz_handler
+ PerlAddAuthzProvider species My::AuthCookieHandler->authz_species
-Note that you can use something other than C<user>. e.g.: C<my-user> if you
-have other authentication modules in use that are responsible for
-C<Requires user ...> directives.
+Will be called to handle a
-=item *
+ Require species klingon
+
+Directive.
+
+It is important to know that Authz Providers are called B<twice> for
+a request. First, the authz provider is called before authentication has been
+processed to check for anonymous access. In this method call, C<< $r->user >>
+is not set. You are expected to return one of:
-Remove All Instances of PerlAuthzHandler that call authorize()
+=over 4
+
+=item AUTHZ_GRANTED
+
+Access is granted and no further authn/authz processing will occur for this
+request.
+
+=item AUTHZ_DENIED
+
+=item AUTHZ_NEUTRAL
-E.g.: remove all all instances of:
+The response is C<HTTP_FORBIDDEN> (unless neutral is overridden by another
+provider)
- PerlAuthzHandler Your::AuthCookie::Handler->authorize
+=item AUTHZ_DENIED_NO_USER
+
+Authentication is processed, C<< $r->user >> will be set with the current
+username and your authz provider will be called again.
+
+=back
+
+The second time the authz provider is called, C<< $r->user >> is set and you
+are expected to return one of:
+
+=over 4
+
+=item AUTHZ_GRANTED
+
+The request is allowed
+
+=item AUTHZ_DENIED
+
+The request is forbidden
+
+=item AUTHZ_NEUTRAL
+
+The request is forbidden, unless another authz provider returns
+C<AUTHZ_GRANTED>. Consult the apache documentation about authorization merging
+for more info.
+
+=back
+
+You could also return C<AUTHZ_GENERAL_ERROR> from any of these to indicate an
+error processing authz directives and halt processing immediately.
+
+One way to think about these response codes what kind of Require satisfies is
+in effect:
+
+=over 4
+
+=item RequireAll/RequireNone
+
+In this case the priority of responses is:
+
+=over 4
+
+=item AUTHZ_GENERAL_ERROR
+
+Processing stops immediately
+
+=item AUTHZ_DENIED
+
+Processing stops immediately, no siblings are processed. Request is denied.
+
+=item AUTHZ_DENIED_NO_USER
+
+Process Authentication and try again
+
+=item AUTHZ_GRANTED
+
+Continue processing siblings.
+
+=item AUTZ_NEUTRAL
+
+Continue processing siblings.
+
+=back
+
+=item RequireAny
+
+In this case the priority of responses is:
+
+=over 4
+
+=item AUTHZ_GENERAL_ERROR
+
+Processing stops immediately
+
+=item AUTHZ_GRANTED
+
+Processing stops immediately, no siblings are processed. Request is allowed.
+
+=item AUTHZ_DENIED_NO_USER
+
+Process Authentication and try again
+
+=item AUTHZ_DENIED
+
+Continue processing siblings.
+
+=item AUTZ_NEUTRAL
+
+Continue processing siblings.
+
+=back
+
+=back
=back
@@ -102,35 +230,34 @@
=item authorize() has been removed
-In C<Apache2_4::AuthCookie>, C<authorize()> is replaced by C<authz_handler>.
-C<authz_handler> has a different return type from C<authorize>. Apache expects
-a return value of one of C<AUTHZ_GRANTED>, C<AUTHZ_DENIED>, or
-C<AUTHZ_DENIED_NO_USER>.
+You need to use a C<PerlAddAuthzProvider> and write an appropriate handler as
+described above instead. Note that you do not need a C<PerlAddAuthzProvider>
+for C<user> or C<valid-user> requirements. Apache already handles those
+internally.
=item ${auth_name}Satisfy
Satisfy support is removed as it is no longer needed with Apache 2.4.
-You can handle other non-user requirements with RequireAll, and additional
-AuthzProvider handlers:
+You are expected to use C<RequireAll> or C<RequireAny> instead.
e.g.:
- PerlAddAuthzProvider user Your::AuthCookieHandler->authz_handler
PerlAddAuthzProvider species Your::AuthCookieHandler->authz_species_handler
<RequireAll>
Require valid-user
- Require species gerbil
+ Require species klingon
</RequireAll>
-see: https://httpd.apache.org/docs/2.4/howto/auth.html#reqaccessctrl
+see: L<https://httpd.apache.org/docs/2.4/howto/auth.html#reqaccessctrl>
=item Unauthorized User HTTP Response Code
-In Apache 2.4, in mod_authz_core, if no authz_handlers return C<AUTHZ_GRANTED>,
-then C<HTTP_UNAUTHORIZED> is returned. In previous versions, C<HTTP_FORBIDDEN>
-was returned. You can get the old behaviour if you want it with:
+In Apache 2.4, in C<mod_authz_core>, if no authz handlers return
C<AUTHZ_GRANTED>,
+then C<HTTP_UNAUTHORIZED> is returned. In previous versions of Apache,
+C<HTTP_FORBIDDEN> was returned. You can get the old behaviour if you want it
+with:
AuthzSendForbiddenOnFailure On
@@ -144,19 +271,20 @@
Why is my authz method called twice per request?
-This is normal behaviour under Apache 2.4. You are expected to return
-C<Apache2::Const::AUTHZ_DENIED_NO_USER> IF C<< $r->user >> has not yet been
-set. Your authz handler will be called a second time after the user has been
-authenticated.
-
-=back
+This is normal behaviour under Apache 2.4. This is to accomodate for
+authorization of anonymous access. You are expected to return
+C<Apache2::Const::AUTHZ_DENIED_NO_USER> IF C<< $r->user >> has not yet been set
+if you want authentication to proceed. Your authz handler will be called a
+second time after the user has been authenticated.
-=head1 TODO
+=item *
-=over 4
+My log shows an entry like:
-=item *
+ authorization result of Require ...: denied (no + # authenticated user yet)
-add support for mod_auth_socache if possible
+These are normal. This happens because the authz provider returned
+C<AUTHZ_DENIED_NO_USER> and the authz provider will be called again after
+authentication happens.
=back
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/SIGNATURE
new/Apache-AuthCookie-3.24/SIGNATURE
--- old/Apache-AuthCookie-3.23/SIGNATURE 2015-09-10 18:59:48.000000000
+0200
+++ new/Apache-AuthCookie-3.24/SIGNATURE 2016-01-14 00:16:15.000000000
+0100
@@ -14,30 +14,30 @@
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
-SHA1 4fb2e9aca110ad4efaa9acba8e71d6bfb510ffff Changes
+SHA1 9fba73a06915fdf43a0e5a3809f174b5e860b182 Changes
SHA1 cb36dd242de6d18cd64c4b55444347ebf09e43e7 LICENSE
-SHA1 a308ff70c88e605fc3ca9a756d08f9003c536b94 MANIFEST
+SHA1 4c0c99ee3b19ecbc08f30491799faa2ac9ecebf8 MANIFEST
SHA1 0ff75e1a6186d7274e76387884eca541fdd5ca4a MANIFEST.SKIP
-SHA1 d8d592009b6ed9fc6f7007385e5bb0d5740fce39 META.yml
-SHA1 5b5d0d04447e4814ff7b91584e094175ac84e141 Makefile.PL
+SHA1 5ffafb81bd4fa549d1b9954477bdd30255a44299 META.yml
+SHA1 7a2275cdc405f9585d15d08ff8edeeed8e6558de Makefile.PL
SHA1 b9945378262a25db34dcdba06da956a52876188b README
-SHA1 b9a7c4716c9ac0f47b8a3e1ca8d0c18141595f5e README.apache-2.4.pod
+SHA1 0fbbaf3a8362d5356d104ce148db9e3d07e1c7bf README.apache-2.4.pod
SHA1 ccbc46a0385aabadd1e6f4a22f8d4ebb11b44901 README.modperl2
-SHA1 de860466abecb2f3be5deb75a7e5eb23a1af43ed lib/Apache/AuthCookie.pm
-SHA1 714a5abef95062cde56356bfcd5110fbbb562f21 lib/Apache/AuthCookie/Autobox.pm
-SHA1 59d7b1093b226bf896ddcea875accb55c40fc6c2 lib/Apache/AuthCookie/FAQ.pod
-SHA1 2bf8c686f85bbe52bcc5cf4236d8b8369a9dc031 lib/Apache/AuthCookie/Params.pm
-SHA1 22d88939f72b0c934dd54b3f895c7670a9e4afdf
lib/Apache/AuthCookie/Params/Base.pm
-SHA1 d80828eb8fbb44f06e1262d5cdb0be136e7dd5f7
lib/Apache/AuthCookie/Params/CGI.pm
-SHA1 d37b201d846510b6197375260494c3b5857d562d lib/Apache/AuthCookie/Util.pm
-SHA1 33a0abcd4da5dcc8703c93ba0b6e99361c5624fe lib/Apache2/AuthCookie.pm
-SHA1 04a38982e21cd55af8b4730bf3adcbabefcbe47a lib/Apache2/AuthCookie/Base.pm
-SHA1 6945012b16cefcffb2c793b3a7bc19e6622a200c lib/Apache2/AuthCookie/Params.pm
-SHA1 c1b92f9f5956f6263e9a9c7bc1f977a167629fed lib/Apache2_4/AuthCookie.pm
+SHA1 b5885da476dded21d874ddaf62eeab9afa4ef660 lib/Apache/AuthCookie.pm
+SHA1 6cbdbebc1b4a1ce90f9ded7bf5c31f19c19f4e1b lib/Apache/AuthCookie/Autobox.pm
+SHA1 3fc5539118a30496b9c9a2659aa4ecba010d37f7 lib/Apache/AuthCookie/FAQ.pod
+SHA1 f05973756eaa606d62965641ce181ef877061bde lib/Apache/AuthCookie/Params.pm
+SHA1 8da245e78647a7d6f6319190b29571166b63ea34
lib/Apache/AuthCookie/Params/Base.pm
+SHA1 7565fa5fb1bbd2ac8776e0f48950b067ef6b3974
lib/Apache/AuthCookie/Params/CGI.pm
+SHA1 b79b109eb9e83eae771f84150e9e29a6cafa0c97 lib/Apache/AuthCookie/Util.pm
+SHA1 8893d614abb8a99907204bb493ef7508d5b6e769 lib/Apache2/AuthCookie.pm
+SHA1 cfc494f7d1b3047f365fda488a57e9d31080b0b7 lib/Apache2/AuthCookie/Base.pm
+SHA1 05f74437cc15aa913fda411cfeafd82613a2dc02 lib/Apache2/AuthCookie/Params.pm
+SHA1 ca36db816d36bbe96f8b84f6481bf11b50234905 lib/Apache2_4/AuthCookie.pm
SHA1 3ac8de46e7bba83f6969caec3c9c14cbd99881cb t/Skeleton/AuthCookieHandler.pm
SHA1 b1f854e6edecbdd44fc7b8db719e0fe21d9340d1 t/TEST.PL
SHA1 290c96de9cbeafe5cc6ad7f3a47d706e740ba28f t/autobox.t
-SHA1 5bdda8342212ecb7450da1e7c34ec42ff99146fd t/conf/extra.conf.in
+SHA1 14b2d1c4e40ea7477059c6b792e31592b15120a4 t/conf/extra.conf.in
SHA1 2156ea84b69ca7fef7b73d72a06c07cb145da7a9 t/htdocs/docs/authall/get_me.html
SHA1 2156ea84b69ca7fef7b73d72a06c07cb145da7a9 t/htdocs/docs/authany/get_me.html
SHA1 2156ea84b69ca7fef7b73d72a06c07cb145da7a9
t/htdocs/docs/cookiename/get_me.html
@@ -46,19 +46,20 @@
SHA1 ff64131e263980ea9575b71dc05c5aa2063e135d t/htdocs/docs/index.html
SHA1 0dba04a9de174ab9881cfe575d1d23bb5fc588a8 t/htdocs/docs/login.pl
SHA1 b9eca1b328da7d703abaec2d6a6d5751866843ac t/htdocs/docs/logout.pl
+SHA1 2156ea84b69ca7fef7b73d72a06c07cb145da7a9 t/htdocs/docs/myuser/get_me.html
SHA1 b37a85d16cbb2342b407f2ba70b8a61aa1ca67bb
t/htdocs/docs/protected/echo_user.pl
SHA1 2156ea84b69ca7fef7b73d72a06c07cb145da7a9
t/htdocs/docs/protected/get_me.html
SHA1 2156ea84b69ca7fef7b73d72a06c07cb145da7a9
t/htdocs/docs/stimeout/get_me.html
SHA1 d8a8ea1ebe037a4dea4ad8d1c5b0704b2d43e854
t/lib/Sample/Apache/AuthCookieHandler.pm
SHA1 b17b0f3ee3a6643cd57c0d9946c4aa62b0d9e3bb
t/lib/Sample/Apache2/AuthCookieHandler.pm
SHA1 2fe3e04dd78f4e0ea8322f6482153bee96585b9a
t/lib/Sample/Apache2_4/AuthCookieHandler.pm
-SHA1 e24b180df613b201f9b4b9945af3b56549df223b t/real.t
+SHA1 97d4f24fa12ac67b785863fefcb491fcf8836af9 t/real.t
SHA1 61cea839dd94aaaeb301ccac9b83cde4c5c91b42 t/signature.t
SHA1 e91bf0ef7d63322eaf15ca7d9907c6db47ce90ca t/startup.pl
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
-iEYEARECAAYFAlXxtwQACgkQ+CqvSzp9LOyCfgCePYmJ7pcURQ0YQ3OnG3JciB9d
-s8gAmgO+buvx/KVwsu+BpEGOL1bhKMBp
-=JIIU
+iEYEARECAAYFAlaW2r8ACgkQ+CqvSzp9LOznBwCfVyvPHeoEKntFe34bphvP2cOh
+bHEAn0jRy+56CvxnZpE0adpINHCgBTbI
+=N7RO
-----END PGP SIGNATURE-----
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/Autobox.pm
new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/Autobox.pm
--- old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/Autobox.pm 2015-09-10
18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/Autobox.pm 2016-01-14
00:16:15.000000000 +0100
@@ -1,5 +1,5 @@
package Apache::AuthCookie::Autobox;
-$Apache::AuthCookie::Autobox::VERSION = '3.23';
+$Apache::AuthCookie::Autobox::VERSION = '3.24';
# ABSTRACT: Autobox Extensions for AuthCookie
use strict;
@@ -14,7 +14,7 @@
}
package Apache::AuthCookie::Autobox::Scalar;
-$Apache::AuthCookie::Autobox::Scalar::VERSION = '3.23';
+$Apache::AuthCookie::Autobox::Scalar::VERSION = '3.24';
sub is_blank {
return defined $_[0] && ($_[0] =~ /\S/) ? 0 : 1;
}
@@ -31,7 +31,7 @@
=head1 VERSION
-version 3.23
+version 3.24
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/FAQ.pod
new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/FAQ.pod
--- old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/FAQ.pod 2015-09-10
18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/FAQ.pod 2016-01-14
00:16:15.000000000 +0100
@@ -1,6 +1,6 @@
# make Dist::Zilla happy.
package Apache::AuthCookie::FAQ;
-$Apache::AuthCookie::FAQ::VERSION = '3.23';
+$Apache::AuthCookie::FAQ::VERSION = '3.24';
# ABSTRACT: Frequently Asked Questions about Apache::AuthCookie.
1;
@@ -15,7 +15,7 @@
=head1 VERSION
-version 3.23
+version 3.24
=head1 DESCRIPTION
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/Params/Base.pm
new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/Params/Base.pm
--- old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/Params/Base.pm
2015-09-10 18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/Params/Base.pm
2016-01-14 00:16:15.000000000 +0100
@@ -1,5 +1,5 @@
package Apache::AuthCookie::Params::Base;
-$Apache::AuthCookie::Params::Base::VERSION = '3.23';
+$Apache::AuthCookie::Params::Base::VERSION = '3.24';
# ABSTRACT: Internal CGI AuthCookie Params Base Class
use strict;
@@ -44,7 +44,7 @@
=head1 VERSION
-version 3.23
+version 3.24
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/Params/CGI.pm
new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/Params/CGI.pm
--- old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/Params/CGI.pm
2015-09-10 18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/Params/CGI.pm
2016-01-14 00:16:15.000000000 +0100
@@ -1,5 +1,5 @@
package Apache::AuthCookie::Params::CGI;
-$Apache::AuthCookie::Params::CGI::VERSION = '3.23';
+$Apache::AuthCookie::Params::CGI::VERSION = '3.24';
# ABSTRACT: Internal CGI Params Subclass
use strict;
@@ -32,7 +32,7 @@
=head1 VERSION
-version 3.23
+version 3.24
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/Params.pm
new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/Params.pm
--- old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/Params.pm 2015-09-10
18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/Params.pm 2016-01-14
00:16:15.000000000 +0100
@@ -1,5 +1,5 @@
package Apache::AuthCookie::Params;
-$Apache::AuthCookie::Params::VERSION = '3.23';
+$Apache::AuthCookie::Params::VERSION = '3.24';
# ABSTRACT: AuthCookie Params Driver for mod_perl 1.x
use strict;
@@ -44,7 +44,7 @@
=head1 VERSION
-version 3.23
+version 3.24
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/Util.pm
new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/Util.pm
--- old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie/Util.pm 2015-09-10
18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie/Util.pm 2016-01-14
00:16:15.000000000 +0100
@@ -1,5 +1,5 @@
package Apache::AuthCookie::Util;
-$Apache::AuthCookie::Util::VERSION = '3.23';
+$Apache::AuthCookie::Util::VERSION = '3.24';
# ABSTRACT: Internal Utility Functions for AuthCookie
use strict;
@@ -96,7 +96,7 @@
=head1 VERSION
-version 3.23
+version 3.24
=head1 SOURCE
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie.pm
new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie.pm
--- old/Apache-AuthCookie-3.23/lib/Apache/AuthCookie.pm 2015-09-10
18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/lib/Apache/AuthCookie.pm 2016-01-14
00:16:15.000000000 +0100
@@ -1,5 +1,5 @@
package Apache::AuthCookie;
-$Apache::AuthCookie::VERSION = '3.23';
+$Apache::AuthCookie::VERSION = '3.24';
# ABSTRACT: Perl Authentication and Authorization via cookies
use strict;
@@ -549,7 +549,7 @@
=head1 VERSION
-version 3.23
+version 3.24
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/Apache-AuthCookie-3.23/lib/Apache2/AuthCookie/Base.pm
new/Apache-AuthCookie-3.24/lib/Apache2/AuthCookie/Base.pm
--- old/Apache-AuthCookie-3.23/lib/Apache2/AuthCookie/Base.pm 2015-09-10
18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/lib/Apache2/AuthCookie/Base.pm 2016-01-14
00:16:15.000000000 +0100
@@ -1,5 +1,5 @@
package Apache2::AuthCookie::Base;
-$Apache2::AuthCookie::Base::VERSION = '3.23';
+$Apache2::AuthCookie::Base::VERSION = '3.24';
use strict;
use mod_perl2 '1.99022';
use Carp;
@@ -450,7 +450,7 @@
=head1 VERSION
-version 3.23
+version 3.24
=head1 SOURCE
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/Apache-AuthCookie-3.23/lib/Apache2/AuthCookie/Params.pm
new/Apache-AuthCookie-3.24/lib/Apache2/AuthCookie/Params.pm
--- old/Apache-AuthCookie-3.23/lib/Apache2/AuthCookie/Params.pm 2015-09-10
18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/lib/Apache2/AuthCookie/Params.pm 2016-01-14
00:16:15.000000000 +0100
@@ -1,5 +1,5 @@
package Apache2::AuthCookie::Params;
-$Apache2::AuthCookie::Params::VERSION = '3.23';
+$Apache2::AuthCookie::Params::VERSION = '3.24';
# ABSTRACT: AuthCookie Params Driver for mod_perl 2.x
use strict;
@@ -40,7 +40,7 @@
=head1 VERSION
-version 3.23
+version 3.24
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/lib/Apache2/AuthCookie.pm
new/Apache-AuthCookie-3.24/lib/Apache2/AuthCookie.pm
--- old/Apache-AuthCookie-3.23/lib/Apache2/AuthCookie.pm 2015-09-10
18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/lib/Apache2/AuthCookie.pm 2016-01-14
00:16:15.000000000 +0100
@@ -1,5 +1,5 @@
package Apache2::AuthCookie;
-$Apache2::AuthCookie::VERSION = '3.23';
+$Apache2::AuthCookie::VERSION = '3.24';
# ABSTRACT: Perl Authentication and Authorization via cookies
use strict;
@@ -113,11 +113,11 @@
=head1 VERSION
-version 3.23
+version 3.24
=head1 SYNOPSIS
-Make sure your mod_perl is at least 1.24, with StackedHandlers,
+Make sure your mod_perl is at least 2.0.0-RC5, with StackedHandlers,
MethodHandlers, Authen, and Authz compiled in.
# In httpd.conf or .htaccess:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/lib/Apache2_4/AuthCookie.pm
new/Apache-AuthCookie-3.24/lib/Apache2_4/AuthCookie.pm
--- old/Apache-AuthCookie-3.23/lib/Apache2_4/AuthCookie.pm 2015-09-10
18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/lib/Apache2_4/AuthCookie.pm 2016-01-14
00:16:15.000000000 +0100
@@ -1,44 +1,53 @@
package Apache2_4::AuthCookie;
-$Apache2_4::AuthCookie::VERSION = '3.23';
+$Apache2_4::AuthCookie::VERSION = '3.24';
use strict;
use base 'Apache2::AuthCookie::Base';
use Apache::AuthCookie::Autobox;
+use Apache2::Log;
use Apache2::Const -compile => qw(AUTHZ_GRANTED AUTHZ_DENIED
AUTHZ_DENIED_NO_USER);
+# You really do not need this provider at all. This provides an implementation
+# for "Require user ..." directives, that is compatible with mod_authz_core
+# (with the exception that expressions are not supported). You should really
+# just let mod_authz_core be your "user" authz provider. Nevertheless, due to
+# the fact that AuthCookie was released for Apache 2.4 with documentation that
+# shows this is needed, we leave this implementation for backwards
+# compatibility.
sub authz_handler {
- my ($auth_type, $r, @requires) = @_;
-
- return Apache2::Const::AUTHZ_DENIED unless @requires;
-
- my $debug = $r->dir_config("AuthCookieDebug") || 0;
+ my ($auth_type, $r, $requires) = @_;
my $user = $r->user;
- $r->server->log_error("authz user=$user type=$auth_type req=@requires") if
$debug >=3;
-
if ($user->is_blank) {
- # user not yet authenticated
- $r->server->log_error("No user authenticated", $r->uri);
+ # user is not yet authenticated
return Apache2::Const::AUTHZ_DENIED_NO_USER;
}
- foreach my $req (@requires) {
- $r->server->log_error("requirement := $req") if $debug >= 2;
+ if ($requires->is_blank) {
+ $r->server->log_error(q[Your 'Require user ...' config does not
specify any users]);
+ return Apache2::Const::AUTHZ_DENIED;
+ }
- if (lc $req eq 'valid-user') {
+ my $debug = $r->dir_config("AuthCookieDebug") || 0;
+
+ $r->server->log_error("authz user=$user type=$auth_type req=$requires") if
$debug >=3;
+
+ for my $valid_user (split /\s+/, $requires) {
+ if ($user eq $valid_user) {
return Apache2::Const::AUTHZ_GRANTED;
}
-
- return $req eq $user ? Apache2::Const::AUTHZ_GRANTED :
Apache2::Const::AUTHZ_DENIED;
}
+ # log a message similar to mod_authz_user
+ $r->log->debug(sprintf
+ q[access to %s failed, reason: user '%s' does not meet 'require'ments
for a ].
+ q[user to be allowed access], $r->uri, $r->user);
+
return Apache2::Const::AUTHZ_DENIED;
}
1;
-__END__
-
=pod
=head1 NAME
@@ -47,7 +56,567 @@
=head1 VERSION
-version 3.23
+version 3.24
+
+=head1 SYNOPSIS
+
+Make sure your mod_perl is at least 2.0.9, with StackedHandlers,
+MethodHandlers, Authen, and Authz compiled in.
+
+ # In httpd.conf or .htaccess:
+ PerlModule Sample::Apache2::AuthCookieHandler
+ PerlSetVar WhatEverPath /
+ PerlSetVar WhatEverLoginScript /login.pl
+
+ # The following line is optional - it allows you to set the domain
+ # scope of your cookie. Default is the current domain.
+ PerlSetVar WhatEverDomain .yourdomain.com
+
+ # Use this to only send over a secure connection
+ PerlSetVar WhatEverSecure 1
+
+ # Use this if you want user session cookies to expire if the user
+ # doesn't request a auth-required or recognize_user page for some
+ # time period. If set, a new cookie (with updated expire time)
+ # is set on every request.
+ PerlSetVar WhatEverSessionTimeout +30m
+
+ # to enable the HttpOnly cookie property, use HttpOnly.
+ # this is an MS extension. See:
+ # http://msdn.microsoft.com/workshop/author/dhtml/httponly_cookies.asp
+ PerlSetVar WhatEverHttpOnly 1
+
+ # Usually documents are uncached - turn off here
+ PerlSetVar WhatEverCache 1
+
+ # Use this to make your cookies persistent (+2 hours here)
+ PerlSetVar WhatEverExpires +2h
+
+ # Use to make AuthCookie send a P3P header with the cookie
+ # see http://www.w3.org/P3P/ for details about what the value
+ # of this should be
+ PerlSetVar WhatEverP3P "CP=\"...\""
+
+ # These documents require user to be logged in.
+ <Location /protected>
+ AuthType Sample::Apache2::AuthCookieHandler
+ AuthName WhatEver
+ PerlAuthenHandler Sample::Apache2::AuthCookieHandler->authenticate
+ Require valid-user
+ </Location>
+
+ # How to handle a custom requirement (non-user).
+ PerlAddAuthzProvider species Sample::Apache2::AuthCookieHandler->authz_species
+ <Location /protected/species>
+ Require species klingon
+ </Location>
+
+ # These documents don't require logging in, but allow it.
+ <FilesMatch "\.ok$">
+ AuthType Sample::Apache2::AuthCookieHandler
+ AuthName WhatEver
+ PerlFixupHandler Sample::Apache2::AuthCookieHandler->recognize_user
+ </FilesMatch>
+
+ # This is the action of the login.pl script above.
+ <Files LOGIN>
+ AuthType Sample::Apache2::AuthCookieHandler
+ AuthName WhatEver
+ SetHandler perl-script
+ PerlResponseHandler Sample::Apache2::AuthCookieHandler->login
+ </Files>
+
+=head1 DESCRIPTION
+
+This module is for C<mod_perl> version 2 for C<Apache> version 2.4.x. If you
+are running mod_perl version 1, you need B<Apache::AuthCookie> instead. If you
+are running C<Apache> 2.0.0-2.2.x, you need B<Apache2::AuthCookie> instead.
+
+B<Apache2_4::AuthCookie> allows you to intercept a user's first unauthenticated
+access to a protected document. The user will be presented with a custom form
+where they can enter authentication credentials. The credentials are posted to
+the server where AuthCookie verifies them and returns a session key.
+
+The session key is returned to the user's browser as a cookie. As a cookie, the
+browser will pass the session key on every subsequent accesses. AuthCookie will
+verify the session key and re-authenticate the user.
+
+All you have to do is write a custom module that inherits from AuthCookie.
+Your module is a class which implements two methods:
+
+=over 4
+
+=item C<authen_cred()>
+
+Verify the user-supplied credentials and return a session key. The session key
+can be any string - often you'll use some string containing username, timeout
+info, and any other information you need to determine access to documents, and
+append a one-way hash of those values together with some secret key.
+
+=item C<authen_ses_key()>
+
+Verify the session key (previously generated by C<authen_cred()>, possibly
+during a previous request) and return the user ID. This user ID will be fed to
+C<$r-E<gt>user()> to set Apache's idea of who's logged in.
+
+=back
+
+By using AuthCookie versus Apache's built-in AuthBasic you can design your own
+authentication system. There are several benefits.
+
+=over 4
+
+=item 1.
+
+The client doesn't *have* to pass the user credentials on every subsequent
+access. If you're using passwords, this means that the password can be sent on
+the first request only, and subsequent requests don't need to send this
+(potentially sensitive) information. This is known as "ticket-based"
+authentication.
+
+=item 2.
+
+When you determine that the client should stop using the credentials/session
+key, the server can tell the client to delete the cookie. Letting users "log
+out" is a notoriously impossible-to-solve problem of AuthBasic.
+
+=item 3.
+
+AuthBasic dialog boxes are ugly. You can design your own HTML login forms when
+you use AuthCookie.
+
+=item 4.
+
+You can specify the domain of a cookie using C<PerlSetVar> commands. For
+instance, if your AuthName is C<WhatEver>, you can put the command
+
+ PerlSetVar WhatEverDomain .yourhost.com
+
+into your server setup file and your access cookies will span all hosts ending
+in C<.yourhost.com>.
+
+=item 5.
+
+You can optionally specify the name of your cookie using the C<CookieName>
+directive. For instance, if your AuthName is C<WhatEver>, you can put the
+command
+
+ PerlSetVar WhatEverCookieName MyCustomName
+
+into your server setup file and your cookies for this AuthCookie realm will be
+named MyCustomName. Default is AuthType_AuthName.
+
+=back
+
+This is the flow of the authentication handler, less the details of the
+redirects. Two HTTP_MOVED_TEMPORARILY's are used to keep the client from
+displaying the user's credentials in the Location field. They don't really
+change AuthCookie's model, but they do add another round-trip request to the
+client.
+
+=for html <PRE>
+
+ (-----------------------) +---------------------------------+
+ ( Request a protected ) | AuthCookie sets custom error |
+ ( page, but user hasn't )---->| document and returns |
+ ( authenticated (no ) | HTTP_FORBIDDEN. Apache abandons |
+ ( session key cookie) ) | current request and creates sub |
+ (-----------------------) | request for the error document. |<-+
+ | Error document is a script that | |
+ | generates a form where the user | |
+ return | enters authentication | |
+ ^------------------->| credentials (login & password). | |
+ / \ False +---------------------------------+ |
+ / \ | |
+ / \ | |
+ / \ V |
+ / \ +---------------------------------+ |
+ / Pass \ | User's client submits this form | |
+ / user's \ | to the LOGIN URL, which calls | |
+ | credentials |<------------| AuthCookie->login(). | |
+ \ to / +---------------------------------+ |
+ \authen_cred/ |
+ \ function/ |
+ \ / |
+ \ / |
+ \ / +------------------------------------+ |
+ \ / return | Authen cred returns a session | +--+
+ V------------->| key which is opaque to AuthCookie.*| |
+ True +------------------------------------+ |
+ | |
+ +--------------------+ | +---------------+
+ | | | | If we had a |
+ V | V | cookie, add |
+ +----------------------------+ r | ^ | a Set-Cookie |
+ | If we didn't have a session| e |T / \ | header to |
+ | key cookie, add a | t |r / \ | override the |
+ | Set-Cookie header with this| u |u / \ | invalid cookie|
+ | session key. Client then | r |e / \ +---------------+
+ | returns session key with | n | / pass \ ^
+ | successive requests | | / session \ |
+ +----------------------------+ | / key to \ return |
+ | +-| authen_ses_key|------------+
+ V \ / False
+ +-----------------------------------+ \ /
+ | Tell Apache to set Expires header,| \ /
+ | set user to user ID returned by | \ /
+ | authen_ses_key, set authentication| \ /
+ | to our type (e.g. AuthCookie). | \ /
+ +-----------------------------------+ \ /
+ V
+ (---------------------) ^
+ ( Request a protected ) |
+ ( page, user has a )--------------+
+ ( session key cookie )
+ (---------------------)
+
+
+ * The session key that the client gets can be anything you want. For
+ example, encrypted information about the user, a hash of the
+ username and password (similar in function to Digest
+ authentication), or the user name and password in plain text
+ (similar in function to HTTP Basic authentication).
+
+ The only requirement is that the authen_ses_key function that you
+ create must be able to determine if this session_key is valid and
+ map it back to the originally authenticated user ID.
+
+=for html </PRE>
+
+=head1 METHODS
+
+C<Apache2_4::AuthCookie> has several methods you should know about.
+
+=over 4
+
+=item * authenticate()
+
+This method is one you'll use in a server config file (httpd.conf, .htaccess,
+...) as a PerlAuthenHandler. If the user provided a session key in a cookie,
+the C<authen_ses_key()> method will get called to check whether the key is
+valid. If not, or if there is no key provided, we redirect to the login form.
+
+=item * authen_cred()
+
+You must define this method yourself in your subclass of
+C<Apache2_4::AuthCookie>. Its job is to create the session key that will be
+preserved in the user's cookie. The arguments passed to it are:
+
+ sub authen_cred ($$\@) {
+ my $self = shift; # Package name (same as AuthName directive)
+ my $r = shift; # Apache request object
+ my @cred = @_; # Credentials from login form
+
+ ...blah blah blah, create a session key...
+ return $session_key;
+ }
+
+The only limitation on the session key is that you should be able to look at it
+later and determine the user's username. You are responsible for implementing
+your own session key format. A typical format is to make a string that
+contains the username, an expiration time, whatever else you need, and an MD5
+hash of all that data together with a secret key. The hash will ensure that
+the user doesn't tamper with the session key.
+
+=item * authen_ses_key()
+
+You must define this method yourself in your subclass of
+C<Apache2_4::AuthCookie>. Its job is to look at a session key and determine
+whether it is valid. If so, it returns the username of the authenticated user.
+
+ sub authen_ses_key ($$$) {
+ my ($self, $r, $session_key) = @_;
+ ...blah blah blah, check whether $session_key is valid...
+ return $ok ? $username : undef;
+ }
+
+Optionally, return an array of 2 or more items that will be passed to method
+custom_errors. It is the responsibility of this method to return the correct
+response to the main Apache module.
+
+=item * custom_errors($r,@_)
+
+This method handles the server response when you wish to access the Apache
+custom_response method. Any suitable response can be used. this is
+particularly useful when implementing 'by directory' access control using
+the user authentication information. i.e.
+
+ /restricted
+ /one user is allowed access here
+ /two not here
+ /three AND here
+
+The authen_ses_key method would return a normal response when the user attempts
+to access 'one' or 'three' but return (NOT_FOUND, 'File not found') if an
+attempt was made to access subdirectory 'two'. Or, in the case of expired
+credentials, (AUTH_REQUIRED,'Your session has timed out, you must login
+again').
+
+ example 'custom_errors'
+
+ sub custom_errors {
+ my ($self,$r,$CODE,$msg) = @_;
+
+ # return custom message else use the server's standard message
+ $r->custom_response($CODE, $msg) if $msg;
+
+ return($CODE);
+ }
+
+ where CODE is a valid code from Apache2::Const
+
+=item * login()
+
+This method handles the submission of the login form. It will call the
+C<authen_cred()> method, passing it C<$r> and all the submitted data with names
+like C<"credential_#">, where # is a number. These will be passed in a simple
+array, so the prototype is C<$self-E<gt>authen_cred($r, @credentials)>. After
+calling C<authen_cred()>, we set the user's cookie and redirect to the URL
+contained in the C<"destination"> submitted form field.
+
+=item * login_form($r)
+
+This method is responsible for displaying the login form. The default
+implementation will make an internal redirect and display the URL you specified
+with the C<PerlSetVar WhatEverLoginScript> configuration directive. You can
+overwrite this method to provide your own mechanism.
+
+=item * login_form_status($r)
+
+This method returns the HTTP status code that will be returned with the login
+form response. The default behaviour is to return HTTP_FORBIDDEN, except for
+some known browsers which ignore HTML content for HTTP_FORBIDDEN responses
+(e.g.: SymbianOS). You can override this method to return custom codes.
+
+Note that HTTP_FORBIDDEN is the most correct code to return as the given
+request was not authorized to view the requested page. You should only change
+this if HTTP_FORBIDDEN does not work.
+
+=item * logout()
+
+This is simply a convenience method that unsets the session key for you. You
+can call it in your logout scripts. Usually this looks like
+C<$r-E<gt>auth_type-E<gt>logout($r);>.
+
+=item * send_cookie($r, $session_key)
+
+By default this method simply sends out the session key you give it. If you
+need to change the default behavior (perhaps to update a timestamp in the key)
+you can override this method.
+
+=item * recognize_user()
+
+If the user has provided a valid session key but the document isn't protected,
+this method will set C<$r-E<gt>user> anyway. Use it as a PerlFixupHandler,
+unless you have a better idea.
+
+=item * key($r)
+
+This method will return the current session key, if any. This can be handy
+inside a method that implements a C<require> directive check (like the
+C<species> method discussed above) if you put any extra information like
+clearances or whatever into the session key.
+
+=item * untaint_destination($self, $uri)
+
+This method returns a modified version of the destination parameter before
+embedding it into the response header. Per default it escapes CR, LF and TAB
+characters of the uri to avoid certain types of security attacks. You can
+override it to more limit the allowed destinations, e.g., only allow relative
+uris, only special hosts or only limited set of characters.
+
+=back
+
+=head1 EXAMPLE
+
+For an example of how to use C<Apache2_4::AuthCookie>, you may want to check
+out the test suite, which runs AuthCookie through a few of its paces. The
+documents are located in t/eg/, and you may want to peruse t/real.t to see the
+generated httpd.conf file (at the bottom of real.t) and check out what requests
+it's making of the server (at the top of real.t).
+
+=head1 THE LOGIN SCRIPT
+
+You will need to create a login script (called login.pl above) that generates
+an HTML form for the user to fill out. You might generate the page using a
+ModPerl::Registry script, a HTML::Mason component, an Apache handler, or
+perhaps even using a static HTML page. It's usually useful to generate it
+dynamically so that you can define the 'destination' field correctly (see
+below).
+
+The following fields must be present in the form:
+
+=over 4
+
+=item 1.
+
+The ACTION of the form must be /LOGIN (or whatever you defined in your
+server configuration as handled by the C<-E<gt>login()> method - see example in
+the SYNOPSIS section).
+
+=item 2.
+
+The various user input fields (username, passwords, etc.) must be named
+'credential_0', 'credential_1', etc. on the form. These will get passed to
+your C<authen_cred()> method.
+
+=item 3.
+
+You must define a form field called 'destination' that tells AuthCookie where
+to redirect the request after successfully logging in. Typically this value is
+obtained from C<$r-E<gt>prev-E<gt>uri>. See the login.pl script in t/eg/.
+
+=back
+
+In addition, you might want your login page to be able to tell why the user is
+being asked to log in. In other words, if the user sent bad credentials, then
+it might be useful to display an error message saying that the given username
+or password are invalid. Also, it might be useful to determine the difference
+between a user that sent an invalid auth cookie, and a user that sent no auth
+cookie at all. To cope with these situations, B<AuthCookie> will set
+C<$r-E<gt>subprocess_env('AuthCookieReason')> to one of the following values.
+
+=over 4
+
+=item I<no_cookie>
+
+The user presented no cookie at all. Typically this means the user is
+trying to log in for the first time.
+
+=item I<bad_cookie>
+
+The cookie the user presented is invalid. Typically this means that the user
+is not allowed access to the given page.
+
+=item I<bad_credentials>
+
+The user tried to log in, but the credentials that were passed are invalid.
+
+=back
+
+You can examine this value in your login form by examining
+C<$r-E<gt>prev-E<gt>subprocess_env('AuthCookieReason')> (because it's a
+sub-request).
+
+Of course, if you want to give more specific information about why access
+failed when a cookie is present, your C<authen_ses_key()> method can set
+arbitrary entries in C<$r-E<gt>subprocess_env>.
+
+=head1 THE LOGOUT SCRIPT
+
+If you want to let users log themselves out (something that can't be done using
+Basic Auth), you need to create a logout script. For an example, see
+t/htdocs/docs/logout.pl. Logout scripts may want to take advantage of
+AuthCookie's C<logout()> method, which will set the proper cookie headers in
+order to clear the user's cookie. This usually looks like
+C<$r-E<gt>auth_type-E<gt>logout($r);>.
+
+Note that if you don't necessarily trust your users, you can't count on cookie
+deletion for logging out. You'll have to expire some server-side login
+information too. AuthCookie doesn't do this for you, you have to handle it
+yourself.
+
+=head1 ABOUT SESSION KEYS
+
+Unlike the sample AuthCookieHandler, you have you verify the user's login and
+password in C<authen_cred()>, then you do something like:
+
+ my $date = localtime;
+ my $ses_key = Digest::SHA::sha256_hex(join(';', $date, $PID, $PAC));
+
+save C<$ses_key> along with the user's login, and return C<$ses_key>.
+
+Now C<authen_ses_key()> looks up the C<$ses_key> passed to it and returns the
+saved login. I use a database to store the session key and retrieve it later.
+
+=head1 FREQUENTLY ASKED QUESTIONS
+
+=over 4
+
+=item *
+
+I upgraded to Apache 2.4 and now AuthCookie doesn't work!
+
+Apache 2.4 radically changed the authenciation and authorization API. You will
+need to port your AuthCookie subclass over to the Apache 2.4 API. See the POD
+documenation in L<README.apache-2.4> for more information, but the quick
+rundown is you need to:
+
+=over 4
+
+=item *
+
+Inherit from C<Apache2_4::AuthCookie>
+
+=item *
+
+Remove all C<PerlAuthzHandler> configuration entries.
+
+=item *
+
+Write Authz Provider methods for any C<Requires> directives that you are using
+that apache does not provide for already (e.g. apache already handles C<user>
+and C<valid-user>) and register them with something like.
+
+ PerlAddAuthzProvier species Sample::AuthCookieHandler->authz_species
+
+=item *
+
+Replace instances of C<${AuthName}Satistfy> with either C<RequireAll> or
+C<RequireAny> blocks.
+
+=back
+
+=item *
+
+Why is my authz method called twice per request?
+
+This is normal behaviour under Apache 2.4. This is to accomodate for
+authorization of anonymous access. You are expected to return
+C<Apache2::Const::AUTHZ_DENIED_NO_USER> IF C<< $r->user >> has not yet been set
+if you want authentication to proceed. Your authz handler will be called a
+second time after the user has been authenticated.
+
+=item *
+
+AuthCookie authenticates, but the authorization handler is returning
+C<UNAUTHORIZED> instead of C<FORBIDDEN>!
+
+In Apache 2.4, in C<mod_authz_core>, if no authz handlers return
C<AUTHZ_GRANTED>,
+then C<HTTP_UNAUTHORIZED> is returned. In previous versions of Apache,
+C<HTTP_FORBIDDEN> was returned. You can get the old behaviour if you want it
+with:
+
+ AuthzSendForbiddenOnFailure On
+
+=item *
+
+My log shows an entry like:
+
+ authorization result of Require ...: denied (no authenticated user yet)
+
+These are normal. This happens because the authz provider returned
+C<AUTHZ_DENIED_NO_USER> and the authz provider will be called again after
+authentication happens.
+
+=back
+
+=head1 HISTORY
+
+Originally written by Eric Bartley <[email protected]>
+
+versions 2.x were written by Ken Williams <[email protected]>
+
+=head1 COPYRIGHT
+
+Copyright (c) 2015 Michael Schout. All rights reserved.
+
+This program is free software; you can redistribute it and/or modify it under
+the same terms as Perl itself.
+
+=head1 SEE ALSO
+
+L<perl(1)>, L<mod_perl(1)>, L<Apache(1)>.
=head1 SOURCE
@@ -71,3 +640,8 @@
the same terms as the Perl 5 programming language system itself.
=cut
+
+__END__
+
+
+# vim: sw=4 ts=4 ai et
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/t/conf/extra.conf.in
new/Apache-AuthCookie-3.24/t/conf/extra.conf.in
--- old/Apache-AuthCookie-3.23/t/conf/extra.conf.in 2015-09-10
18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/t/conf/extra.conf.in 2016-01-14
00:16:15.000000000 +0100
@@ -12,7 +12,7 @@
<IfDefine APACHE2_4>
PerlModule Sample::Apache2_4::AuthCookieHandler
PerlAddAuthzProvider dwarf Sample::Apache2_4::AuthCookieHandler->dwarf
- PerlAddAuthzProvider user
Sample::Apache2_4::AuthCookieHandler->authz_handler
+ PerlAddAuthzProvider myuser
Sample::Apache2_4::AuthCookieHandler->authz_handler
</IfDefine>
</IfDefine>
@@ -73,8 +73,7 @@
PerlAuthenHandler Sample::Apache2_4::AuthCookieHandler->authenticate
</IfDefine>
</IfDefine>
- Require user some-user
- Require user programmer
+ Require user some-user programmer
Require user 0
</Location>
@@ -113,6 +112,39 @@
</RequireAll>
</IfDefine>
</Location>
+
+# test our internal authz_handler for apache 2.4
+<Location /docs/myuser>
+ AuthName WhatEver
+
+ <IfDefine APACHE1>
+ AuthType Sample::Apache::AuthCookieHandler
+ PerlAuthenHandler Sample::Apache::AuthCookieHandler->authenticate
+ PerlAuthzHandler Sample::Apache::AuthCookieHandler->authorize
+ </IfDefine>
+ <IfDefine APACHE2>
+ <IfDefine !APACHE2_4>
+ PerlAuthenHandler Sample::Apache2::AuthCookieHandler->authenticate
+ AuthType Sample::Apache2::AuthCookieHandler
+ PerlAuthzHandler Sample::Apache2::AuthCookieHandler->authorize
+ </IfDefine>
+ <IfDefine APACHE2_4>
+ PerlAuthenHandler Sample::Apache2_4::AuthCookieHandler->authenticate
+ AuthType Sample::Apache2_4::AuthCookieHandler
+ </IfDefine>
+ </IfDefine>
+
+ <IfDefine !APACHE2_4>
+ # apache 1.x, apache 2.0, apache 2.2
+ Require user programmer
+ </IfDefine>
+ <IfDefine APACHE2_4>
+ # apache 2.4
+ <RequireAll>
+ Require myuser dopey programmer
+ </RequireAll>
+ </IfDefine>
+</Location>
<Location /docs/stimeout>
PerlSetVar WhatEverSessionTimeout +10m
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/Apache-AuthCookie-3.23/t/htdocs/docs/myuser/get_me.html
new/Apache-AuthCookie-3.24/t/htdocs/docs/myuser/get_me.html
--- old/Apache-AuthCookie-3.23/t/htdocs/docs/myuser/get_me.html 1970-01-01
01:00:00.000000000 +0100
+++ new/Apache-AuthCookie-3.24/t/htdocs/docs/myuser/get_me.html 2016-01-14
00:16:15.000000000 +0100
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD>
+<TITLE>Congratulations</TITLE>
+</HEAD>
+<BODY>
+<H1>Congratulations, you got past AuthCookie</H1>
+<P><A HREF="../logout.pl">Log Out</A></P>
+</BODY>
+</HTML>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Apache-AuthCookie-3.23/t/real.t
new/Apache-AuthCookie-3.24/t/real.t
--- old/Apache-AuthCookie-3.23/t/real.t 2015-09-10 18:59:48.000000000 +0200
+++ new/Apache-AuthCookie-3.24/t/real.t 2016-01-14 00:16:15.000000000 +0100
@@ -14,7 +14,7 @@
Apache::TestRequest::user_agent( reset => 1, requests_redirectable => 0 );
-plan tests => 51, need_lwp;
+plan tests => 52, need_lwp;
ok 1; # we loaded.
@@ -228,6 +228,17 @@
'username=0 access allowed');
}
+# local authz provider test for 2.4 (works same as authany on older versions)
+{
+ my $r = GET(
+ '/docs/myuser/get_me.html',
+ Cookie => 'Sample::AuthCookieHandler_WhatEver=programmer:Hero'
+ );
+
+ like($r->content, qr/Congratulations, you got past AuthCookie/,
+ 'myuser=programmer access allowed');
+}
+
# login with username=0 works
{
my $r = POST('/LOGIN', [
