Checking multiple text password files

+ # mod_dbd configuration # UPDATED to include authentication cacheing DBDriver pgsql @@ -100,10 +100,9 @@ DBDExptime 300 Require valid-user # mod_authn_dbd SQL query to authenticate a user - AuthDBDUserPWQuery \ - "SELECT password FROM authn WHERE user = %s" + AuthDBDUserPWQuery "SELECT password FROM authn WHERE user = %s" </Directory> -

- <Directory /usr/www/myhost/private> - AuthType Basic - AuthName "Cached Authentication Example" - AuthBasicProvider socache dbd - AuthDBDUserPWQuery "SELECT password FROM authn WHERE user = %s" - AuthnCacheProvideFor dbd - AuthnCacheContext dbd-authn-example - AuthnCacheSOCache dbm - Require valid-user - </Directory> -

Require ldap-group @@ -366,58 +366,58 @@ Require ldap-user "Joe Manager"
group. Note: Do not surround the group name with quotes. For example, assume that the following entry existed in the LDAP directory:

- -dn: cn=Administrators, o=Example
-objectClass: groupOfUniqueNames
-uniqueMember: cn=Barbara Jenson, o=Example
-uniqueMember: cn=Fred User, o=Example
- +

+dn: cn=Administrators, o=Example
+objectClass: groupOfUniqueNames
+uniqueMember: cn=Barbara Jenson, o=Example
+uniqueMember: cn=Fred User, o=Example
+

The following directive would grant access to both Fred and Barbara:

-Require ldap-group cn=Administrators, o=Example +Require ldap-group cn=Administrators, o=Example

Members can also be found within sub-groups of a specified LDAP group if AuthLDAPMaxSubGroupDepth is set to a value greater than 0. For example, assume the following entries exist in the LDAP directory:

- -dn: cn=Employees, o=Example
-objectClass: groupOfUniqueNames
-uniqueMember: cn=Managers, o=Example
-uniqueMember: cn=Administrators, o=Example
-uniqueMember: cn=Users, o=Example
-
-dn: cn=Managers, o=Example
-objectClass: groupOfUniqueNames
-uniqueMember: cn=Bob Ellis, o=Example
-uniqueMember: cn=Tom Jackson, o=Example
-
-dn: cn=Administrators, o=Example
-objectClass: groupOfUniqueNames
-uniqueMember: cn=Barbara Jenson, o=Example
-uniqueMember: cn=Fred User, o=Example
-
-dn: cn=Users, o=Example
-objectClass: groupOfUniqueNames
-uniqueMember: cn=Allan Jefferson, o=Example
-uniqueMember: cn=Paul Tilley, o=Example
-uniqueMember: cn=Temporary Employees, o=Example
-
-dn: cn=Temporary Employees, o=Example
-objectClass: groupOfUniqueNames
-uniqueMember: cn=Jim Swenson, o=Example
-uniqueMember: cn=Elliot Rhodes, o=Example
- +

+dn: cn=Employees, o=Example
+objectClass: groupOfUniqueNames
+uniqueMember: cn=Managers, o=Example
+uniqueMember: cn=Administrators, o=Example
+uniqueMember: cn=Users, o=Example
+
+dn: cn=Managers, o=Example
+objectClass: groupOfUniqueNames
+uniqueMember: cn=Bob Ellis, o=Example
+uniqueMember: cn=Tom Jackson, o=Example
+
+dn: cn=Administrators, o=Example
+objectClass: groupOfUniqueNames
+uniqueMember: cn=Barbara Jenson, o=Example
+uniqueMember: cn=Fred User, o=Example
+
+dn: cn=Users, o=Example
+objectClass: groupOfUniqueNames
+uniqueMember: cn=Allan Jefferson, o=Example
+uniqueMember: cn=Paul Tilley, o=Example
+uniqueMember: cn=Temporary Employees, o=Example
+
+dn: cn=Temporary Employees, o=Example
+objectClass: groupOfUniqueNames
+uniqueMember: cn=Jim Swenson, o=Example
+uniqueMember: cn=Elliot Rhodes, o=Example
+

The following directives would allow access for Bob Ellis, Tom Jackson, Barbara Jensen, Fred User, Allan Jefferson, and Paul Tilley but would not allow access for Jim Swenson, or Elliot Rhodes (since they are at a sub-group depth of 2):

- -Require ldap-group cn=Employees, o-Example
-AuthLDAPSubGroupDepth 1
- + +Require ldap-group cn=Employees, o-Example +AuthLDAPSubGroupDepth 1 +

Behavior of this directive is modified by the AuthLDAPGroupAttribute,

The following directive would grant access to a specific DN:

-Require ldap-dn cn=Barbara Jenson, o=Example +Require ldap-dn cn=Barbara Jenson, o=Example

Behavior of this directive is modified by the AuthLDAPCompareDNOnServer @@ -457,7 +457,7 @@ AuthLDAPSubGroupDepth 1

The following directive would grant access to anyone with the attribute employeeType = active

- Require ldap-attribute employeeType=active + Require ldap-attribute employeeType=active

Multiple attribute/value pairs can be specified on the same line separated by spaces or they can be specified in multiple @@ -470,7 +470,7 @@ AuthLDAPSubGroupDepth 1

The following directive would grant access to anyone with the city attribute equal to "San Jose" or status equal to "Active"

- Require ldap-attribute city="San Jose" status=active + Require ldap-attribute city="San Jose" status=active

The following directive would grant access to anyone having a cell phone and is in the marketing department

The difference between the Require ldap-filter directive and the Require ldap-attribute directive is that ldap-filter @@ -504,19 +504,19 @@ AuthLDAPSubGroupDepth 1

+Configuration example + # mod_dbd configuration DBDriver pgsql DBDParams "dbname=apacheauth user=apache pass=xxxxxx" @@ -115,13 +115,11 @@ DBDExptime 300 <Files login.html> # don't require user to already be logged in! - AuthDBDUserPWQuery \ - "SELECT password FROM authn WHERE user = %s" + AuthDBDUserPWQuery "SELECT password FROM authn WHERE user = %s" # dbd-login action executes a statement to log user in Require dbd-login - AuthzDBDQuery \ - "UPDATE authn SET login = 'true' WHERE user = %s" + AuthzDBDQuery "UPDATE authn SET login = 'true' WHERE user = %s" # return user to referring page (if any) after # successful login @@ -131,11 +129,10 @@ DBDExptime 300 <Files logout.html> # dbd-logout action executes a statement to log user out Require dbd-logout - AuthzDBDQuery \ - "UPDATE authn SET login = 'false' WHERE user = %s" + AuthzDBDQuery "UPDATE authn SET login = 'false' WHERE user = %s" </Files> </Directory> -