On Wed, Feb 27, 2002 at 05:10:07PM +0100, Magnus Lie Hetland wrote:
> Mike Orr <[EMAIL PROTECTED]>:
> >
> [...]
> > RewriteCond %{HTTP:Authorization} ^(.*)
> > RewriteRule ^/(.*) /usr/lib/cgi-bin/Zope.cgi/M/$1 \
> > [e=HTTP_CGI_AUTHORIZATION:%1, t=application/x-httpd-cgi,l]
>
> Thanks. I've found several versions of this on the web and I think I
> understand the way it ought to function -- but I can't make it work.
> Even if I supply a literal value for HTTP_CGI_AUTHORIZATION, I can't
> find it with req.hasField afterwards...
The rules above are copied straight from my old Zope install. I haven't
tried them with Webware.
> What do you see as the problem with HTTP authentication? I think it
> simplifies my code quite a lot, since I don't have to think about
> sessions and login pages and the like...
Basic authentication is great if you can live with its limitations.
I haven't used it with Webware, but on other platforms it's always been
easy to set up and reliable. Under Apache you can use a standard
htpasswd file for static users, or mod_auth_mysql if your
application itself creates users.
With mod_auth_mysql, all your application has to do is
maintain username and password columns (under any column names) in the
table you store your other user info in, and voila`, Apache takes care
of the rest. In PHP, the servlet then reads the envvar
$HTTP_SERVER_VARS['PHP_AUTH_USER'] to determine the current user.
You don't care about the password because they've already been
authenticated. My memory is failing as to where PHP_AUTH_USER
comes from; whether PHP extracts it from HTTP_CGI_AUTHORIZATION or
whether Apache supplies an AUTH_USER envvar, but you can find it in
Webware by looking at all the envvars in the traceback. The database
password can be in plaintext or one of several encryption schemes, but
you have to encrypt the password yourself when you store it.
mod_auth_mysql can cascade through several encryption schemes while it
tries to match the password, if you decide to change encryption schemes
but already have existing users.
Some disadvantages of Basic Authentication:
** You can't customize the login dialog except the short "realm name"
string. If users are confused about why they are being asked for a
password, there's no way to provide a "click here for help" hyperlink.
** Users can't log out without quitting the browser. There's no way
to provide a "logout" button because the browsers don't provide that
feature. If a user goes to lunch and leaves their browser open, a creep
can sit at their desk and have all their privileges.
** Users can't relog in as someone else without quitting the browser.
This may be necessary for some applications.
--
-Mike (Iron) Orr, [EMAIL PROTECTED] (if mail problems: [EMAIL PROTECTED])
http://iron.cx/ English * Esperanto * Russkiy * Deutsch * Espan~ol
_______________________________________________
Webware-discuss mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/webware-discuss
