Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Message-Id: <46D68E98.6720.00AC.0@novell.com>
Date: Thu, 30 Aug 2007 09:32:09 -0600
From: "Brad Nicholes" <BNICHOLES@novell.com>
To: <dev@httpd.apache.org>
Subject: Re: authnz_ldap in 2.2.x
References: <1404e5910708290728v5b3ac782o5c94c70b42551eec@mail.gmail.com>
 <46D57467.6720.00AC.0@novell.com>
 <1404e5910708291414l7542aadagc808825ef3b7de82@mail.gmail.com>
 <46D5ADD5.3235.00AC.0@novell.com>
 <1404e5910708291851x5840a4cemd81caaedb41d18d5@mail.gmail.com>
In-Reply-To: <1404e5910708291851x5840a4cemd81caaedb41d18d5@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

>>> On 8/29/2007 at 7:51 PM, in message
<1404e5910708291851x5840a4cemd81caaedb41d18d5@mail.gmail.com>, "Eric =
Covener"
<covener@gmail.com> wrote:
>=20
> In 2.2.x If authz_XXX are one of dbm, owner, or groupfile they track
> the list of requires and decline if they don't see any they're
> responsible for -- this isn't a crap shoot of module ordering in this
> case.
>=20
> $ grep \!required *.c
> mod_authz_dbm.c:    if (!required_group || !conf->authoritative) {
> mod_authz_groupfile.c:    if (!required_group || !conf->authoritative) {
> mod_authz_owner.c:    if (!required_owner || !conf->authoritative) {
> mod_authz_user.c:    if (!required_user) {
>=20
> That roughly leaves authz_host, authz_default, and authnz_ldap.
> authz_host has a built-in default based on Order, and authz_default
> doesn't have any Requires to check -- leaving authnz_ldap as the odd
> man out.
>=20

True, so that brings up the question of what does AuthzXXXAuthoritative =
really mean?  Does it mean that if set to ON, this module is authoritativel=
y responsible for authorization and if it can't (whatever the reason =
including no require statement), then authorization fails?  Or does it =
mean that the module is only authoritatively responsible for authorization =
if a matching require statement exists?  According to what you are saying =
as well as what the code is currently saying in the other authz modules, =
the latter is true.  And if that is really the definition of AuthzXXXAuthor=
itative, then it appears that authnz_ldap needs to be fixed.

Brad