Mailing-List: contact modules-dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: modules-dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: local policy)
Message-ID: <4E7221AB.1010800@catseye.org>
Date: Thu, 15 Sep 2011 12:02:51 -0400
From: Mark Montague <mark@catseye.org>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7;
 rv:5.0) Gecko/20110630 Thunderbird/5.0
MIME-Version: 1.0
To: modules-dev@httpd.apache.org, suneetshah2000@gmail.com
Subject: Re: Developing an Authentication Module
References: 
 <CABtBcwB5vnQDLFX7Vgj3BO-K7A1OZsdPm_y0Moq+nwL_ZjKYBQ@mail.gmail.com>
In-Reply-To: 
 <CABtBcwB5vnQDLFX7Vgj3BO-K7A1OZsdPm_y0Moq+nwL_ZjKYBQ@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

On September 15, 2011 11:41 , Suneet Shah <suneetshah2000@gmail.com> wrote:
> In our architecture, authentication and authorization is handled by a set of
> web services.  I would need to have the apache module make calls to the
> service. I was planning on using Axis 2 for this. Are there any issues with
> thiat?

I have no experience with Axis 2, but an Apache module can certainly 
utilize external services.  For example, mod_auth_kerb makes RPC calls 
to Kerberos KDCs, and mod_auth_dbd makes queries against SQL databases.


> I need to be able to look at request and see if it has a security token. If
> it does, then I need to validate it through the service.
>
> If it does not, then I need to redirect them to an authentication page.
>
> I thought it would be easier to handle the authentication through our java
> application (as we have the rest of the application) or should this part of
> the module as well?
>
> If a person successful authenticates, then the authentication app would
> redirect the user to the originally requested url.


This sounds very much like the way cosign works.  cosign is a web 
single-sign-on solution that includes an Apache HTTP Server module, 
mod_cosign.  A diagram showing how cosign works is available at 
http://cosign.sourceforge.net/overview.shtml   The actual authentication 
(prompting for and verifying the user's username and password) is 
handled by an application written in C which runs as a CGI and is not a 
part of the mod_cosign module itself.

You may also want to study the implementation of other web 
single-sign-on solutions, including Pubcookie ( http://pubcookie.org/ ) 
and CAS ( http://www.jasig.org/cas ).  CAS may be of particular interest 
to you because it is written in Java.


> This would flow through
> the apache web service and mod-proxy to end up at the target location.

You may not need mod_proxy unless it is key to your requirements in some 
way.  cosign, for example, simply redirects the user to the target 
location after verifying the security token (cookie) or authenticating 
the user and issuing a new security token.

--
   Mark Montague
   mark@catseye.org