Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Subject: RE: Fake Basic Authentication
Date: Thu, 9 Sep 2010 10:12:35 +0200
Message-ID: 
 <99EA83DCDE961346AFA9B5EC33FEC08B04A3C2F0@VF-MBX11.internal.vodafone.com>
In-Reply-To: <20100909000043.7f9f42ec@baldur>
Thread-Topic: Fake Basic Authentication
Thread-Index: ActPqcTFMH2FFYO5Sra23I7C1Xo7fwASrbZQ
References: <20100909000043.7f9f42ec@baldur>
From: =?iso-8859-1?Q?=22Pl=FCm=2C_R=FCdiger=2C_VF-Group=22?=
 <ruediger.pluem@vodafone.com>
To: <dev@httpd.apache.org>

=20

> -----Original Message-----
> From: Nick Kew=20
> Sent: Donnerstag, 9. September 2010 01:01
> To: dev@httpd.apache.org
> Subject: Fake Basic Authentication
>=20
> Someone asked on IRC today about seemlessly mixing SSL Client
> authentication (FakeBasicAuth) with normal basic authn.
> As I understood it, users without a client cert should authenticate,=20
> but those with one would be spared the authn dialogue.

You confuse me. Doesn't this already work with Basic Auth if the user
that presents the certificate is registered in the Authn provider
with the password 'password'?
Of course this also means that if someone knows the username in the
certificate of one of the users he can log in WITHOUT certificate
using the username and 'password' (provided that client certs are not
mandatory of course).
Maybe it would be helpful to post an example configuration snippet
to be sure that we are really talking about the same thing.


>=20
> A quick look at mod_ssl reveals that FakeBasicAuth sets r->user
> in an Access hook, so it's set before authn.  So what the user

In the case that FakeBasicAuth is turned on r->user is not set
by mod_ssl. In this case it only adds a fake Basic auth header
to r->headers_in in ssl_hook_UserCheck (which is the same hook that
mod_auth_basic runs in but earlier) and leaves the job of setting
r->user to mod_auth_basic.

Regards

R=FCdiger