Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of minfrin@sharp.fm designates
 174.143.229.200 as permitted sender)
From: Graham Leggett <minfrin@sharp.fm>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Subject: SSLUserName -> mod_auth_user
Message-Id: <041F6AA8-831E-4581-9920-AE9BE3A1C43F@sharp.fm>
Date: Mon, 21 Apr 2014 13:38:48 +0200
To: dev@httpd.apache.org
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))

Hi all,

Right now, we have the SSLUserName directive, which takes an arbitrary =
SSL variable and turns it into a username for the benefit of the =
request. This has the downside that only SSL variables (and some CGI =
variables) are usable as usernames, and it combines with FakeBasicAuth =
to create undesirable side effects.

What would be cleaner is if we deprecate SSLUserName and create a =
mod_auth_user.c module that declares AuthType User, and then offers a =
AuthUser directive that sets the user based on an arbitrary expression =
from ap_expr.h. This will make client certificates easier to work with, =
and provide options for authentication that aren't based purely on =
logins, such as tokens in URLs, etc.

Thoughts?

Regards,
Graham
--