Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of covener@gmail.com designates
 209.85.212.173 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:date:message-id:subject:from:to:content-type;
        b=TTrE0fyRRxJtGf/hGplDRWj6XAJuRLrCLijaqQxIsL3mSSLyEA2RNe52O5eyqxXL4L
         b8yexTVEZxNb+w+G7DMihBYnamZqxMYeD0YwlJX3p/z8farFB7tuxRi+nmQqjn6kNaJz
         xAY88huUCYbFXtifaRkbXo1f1Ojn922ByYcYQ=
MIME-Version: 1.0
Date: Sat, 29 May 2010 16:32:14 -0400
Message-ID: <AANLkTinrDr5pt9kon-Dc6_TBKSlFerc0iqZwNCOANFiD@mail.gmail.com>
Subject: thoughts on authnz_ldap stashing the basic auth password in
	per-request conf?
From: Eric Covener <covener@gmail.com>
To: dev@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1

Would it be too offensive if mod_authnz_ldap stashed away the users
basic auth password in its own per-request config after it
successfully authenticates, then used it later during authorization?
It is floating around base64'ed anyway, but it still sounds unsavory.

There are some cases where at authorization time, if LDAP was also the
authentication source, the users credentials could be used against the
backend instead of hard-coded server credentials (this non-anoynmous,
no-hard-coded BindDN/BindPassword config is requested every now and
again)

-- 
Eric Covener
covener@gmail.com