httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From sterling <sterl...@covalent.net>
Subject Re: Authentication and Authorization
Date Sun, 09 Sep 2001 22:12:24 GMT
Hi -

IMHO, there is no apache dependency that requires auth and authz to be in
the same module.... usually, it is just logical that the application
handle both phases - but that is on the module writer.

On Fri, 7 Sep 2001, Sander Striker wrote:

> Hi,
>
> I've been going through the modules/aaa directory
> and found that modules there seem to implement both
> authentication and authorization.
>
> IMO this should be split.  Auth and authz are
> completely different things and it would be nice
> to have different modules to do authentication
> in a different way, but still utilize the same
> authorization method.
>
> To accomplish this, an extra field would be needed
> in request_req (and that's probably not going
> to happen): request_req->groups, which holds
> a string with all the groups the authenticated
> user belongs to.

welp, authorization does NOT imply groups... it could require all sorts
of information to authorize.
Authentication is simply 'who is this person' and authorization is 'are
they authorized to receive the requested location'.

Hence, the authorization phase (read auth_checker) is responsible for
reading the requirements and trying to validate them (given usually a
valid-user in the r->user field).  If that means check if they are part of
a group, so be it.  If it means check if they have red hair - that works
too.

Group lookup is NOT part of authentication IMHO.  Many authz solutions
have nothing to do with 'groups'.

>
> Or, there could be a new hook which is used to
> lookup the groups a user belongs to, or, if
> a user belongs to a certain group.  This hook
> will be called whenever the framework equivalent
> of this function is called.
>
> Thoughts?
>
> Sander
>
> /me hides from the 'core stabilizers' that probably
>  are going to hate me for bringing this up.


I don't think this should be skipped because of 'stabilization'.  I think
it should be skipped because it is not the right architecture.


sterling


Mime
View raw message