Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (hermes.apache.org: local policy)
Message-ID: <4225B0F5.6010704@modperlcookbook.org>
Date: Wed, 02 Mar 2005 07:26:29 -0500
From: Geoffrey Young <geoff@modperlcookbook.org>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20040927
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: Multiple AAA providers
References: 
 <6.2.1.2.2.20050228142137.07737eb0@pop3.rowe-clan.net><20050228210955.23366.qmail@mail.infinology.com><opsmxerqknrf0xls@ganesha.library.cornell.edu><6.2.1.2.2.20050301000016.09d1cb70@pop3.rowe-clan.net><422413DA.50106@force-elite.com>
          <49679.67.138.149.162.1109684861.squirrel@67.138.149.162>
       <19396.196.8.104.37.1109686697.squirrel@www.sharp.fm>
       <42247D3D.2020909@ptc.com>
    <41839.196.8.104.37.1109688338.squirrel@www.sharp.fm>
    <42249D6C.2060103@ptc.com>
 <39952.196.8.104.37.1109755200.squirrel@www.sharp.fm>
In-Reply-To: <39952.196.8.104.37.1109755200.squirrel@www.sharp.fm>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit


> This functionality would be useful for more than just LDAP: you might want
> to use two different flat file databases, or maybe you want to auth
> someone in LDAP and someone else in SQL.
> 
> This is really an AAA-wide question rather than an LDAP specific question.
> 
> Anyone know how difficult this would be to do in the current AAA structure?

I think we just need another status besides

typedef enum {
    AUTH_DENIED,
    AUTH_GRANTED,
    AUTH_USER_FOUND,
    AUTH_USER_NOT_FOUND,
    AUTH_GENERAL_ERROR
} authn_status

something like AUTH_DECLINED, which would mean that the current provider is
passing on doing the checking.  code that into the provider loop and you're
done.

I can find the time to do this probably this week if justin or the other
provider authors think it's a good idea.

--Geoff