Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (asf.osuosl.org: domain of ryanmorgan@gmail.com designates
 64.233.184.203 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:mime-version:content-transfer-encoding:message-id:content-type:to:subject:date:x-mailer:from;
        b=ojpAGHQ4orjtQVP6rqmXx2Yv1vyAnbHjMSnb9xn7L7ilUYhqdTz01Lo/vm33DPEhtI0g3xv4C6pPnQTVyXl3YlrF+V/6Zm90BAF6MtjHNY5xQdyu0SJLRGrNezEUdt1Lr2+TEDo9ixBslfXQEYUM3YJyguYqpMRCTkACfBFCWhE=
Mime-Version: 1.0 (Apple Message framework v733)
Content-Transfer-Encoding: 7bit
Message-Id: <4433C7B8-258C-42AC-9A06-9F2722D6AC33@pobox.com>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
To: dev@httpd.apache.org
Subject: Multiple group authorization in mod_ldap
Date: Thu, 1 Sep 2005 15:34:13 -0700
From: Ryan Morgan <ryanmorgan@gmail.com>


Hey everyone,

I have a quick question regarding authorization against multiple  
groups in
mod_ldap.

Currently, if any of the require lines succeed, the user will be granted
access. (Unless I'm missing something obvious in the code and docs)

I'd like to add the ability to require all, so that each require line  
is checked
for successful authorization.  This would allow mod_ldap to check  
that a user
is in multiple groups before granting access.

I can think of a couple of ways of implementing this:

1) Use the core's Satisfy directive to check if 'Satisfy all' has been
    requested.

2) Add a new directive 'AuthLDAPRequireAll' which would be a flag  
indicating
    to check all require lines.

Thoughts?

(Apologies if this comes through twice, I originally sent it from the  
wrong
email address, so it's probably in the queue for the list moderator)