Mailing-List: contact modules-dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: modules-dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of covener@gmail.com designates
 66.249.92.174 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version
         :content-type:content-transfer-encoding:content-disposition
         :references;
        b=Za61TvJWFIajNjqjdOeR4VIVkySB9RIUAjCm7VlcMOzxK3n2P+ySf8I/1ys2NLk3Cs
         okB0hNv00uk4bQ7fbOxAI8+opQvfbhmfdMNCZgzGWQsLzFVOlrPDO9R7cSTQr9R9+ngu
         xmYh76cjAbteDXGpU9WQyL9Os9sIMwBaqdSkg=
Message-ID: <1404e5910810031253l364c2370g1d5a2441e86ade9f@mail.gmail.com>
Date: Fri, 3 Oct 2008 15:53:43 -0400
From: "Eric Covener" <covener@gmail.com>
To: modules-dev@httpd.apache.org
Subject: Re: Wrapping an existing hook (2.0)
In-Reply-To: <A84920684DBB3746A1BEA1296EC9E4EB01CE37BF@EXCVSRV2.aoins.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <A84920684DBB3746A1BEA1296EC9E4EB01CE37BF@EXCVSRV2.aoins.com>

On Fri, Oct 3, 2008 at 11:11 AM, Houser, Rick <Houser.Rick@aoins.com> wrote:
> I'm relatively new to module development, but I have a need to wrap a
> function in a proprietary module (no source) registered via a
> check_user_id hook in a proprietary module (mod_auth_saf).  Basically, I
> need to detect an expired password condition.  I've already tried to use
> the normal pre/post hook registration, but that function returns an
> HTTP_UNAUTHORIZED (some internal basic auth password change feature)
> instead of DECLINE, so Apache never runs my call.

If you ask Apache to run your code first, the proprietary module
shouldn't be able to prevent yours from being run. You should be able
to make sure that your own logic runs for the expired password case
and just DECLINE for everything else.

IMO an auth_checker probably shouldn't return DECLINED if it can
lookup a user and specifically find they have an expired password --
could you make a case to IBM for the behavior you ultimately want?

-- 
Eric Covener
covener@gmail.com