Apache 2.4替代mod_auth_shadow？

看起来你已经探索了一个select，这里有更多的可能性，虽然看起来像两个将需要一些工作。

mod_auth_external： https ： //github.com/phokz/mod-auth-external
mod_auth_kerb： http : //modauthkerb.sourceforge.net/

看了一些其他的select，包括那些不信仰者提出的select，我决定继续尝试改写原来的mod_auth_shadow，使其与当前的authentication/授权架构兼容。 我已经在mod_authnz_ldap模块之后创build了一个非常基本的精简模块。

 /* * mod_auth_shadow.c * * An apache module to authenticate using the /etc/shadow file. * This module interacts with another program "validate", which * is setuid root. Thus the /etc/shadow file can remain * root:root 0400. * * Author: Brian Duggan <[email protected]> * Some code was taken from the sample code supplied with * _Apache Modules_ by Stein and MacEachern. Parts of this * were also influenced by mod_auth.c. * * Adapted for Apache2: Bernard du Breuil * <[email protected]> * I went back to mod_auth.c to see how it was converted. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License along * with this program; if not, write to the Free Software Foundation, Inc., * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. * */ #include "apr_strings.h" #include "ap_config.h" #include "httpd.h" #include "http_config.h" #include "http_core.h" #include "http_log.h" #include "http_protocol.h" #include "http_request.h" #include "mod_auth.h" #include <shadow.h> #include <string.h> #include <stdio.h> #include <errno.h> #include <stdlib.h> #include <unistd.h> #include <sys/wait.h> #include <pwd.h> #include <grp.h> #include "validate.h" static const char module_name[] = "authnz_shadow_module"; static authn_status authn_shadow_check_password(request_rec *r, const char *user, const char *password) { return AUTH_GRANTED; } static authz_status valid_user_check_authorization(request_rec *r, const char *require_args, const void *parsed_require_args) { return AUTH_GRANTED; } static authz_status group_check_authorization(request_rec *r, const char *require_args, const void *parsed_require_args) { return AUTH_GRANTED; } typedef struct { int auth_shadow_flag; /* 1 for yes, 0 for no */ } auth_shadow_config_rec; static const authn_provider authn_shadow_provider = { &authn_shadow_check_password, NULL, }; static const authz_provider authz_valid_user_provider = { &valid_user_check_authorization, NULL, }; static const authz_provider authz_group_provider = { &group_check_authorization, NULL, }; static void register_hooks(apr_pool_t *p) { /* Register authn provider */ ap_register_auth_provider(p, AUTHN_PROVIDER_GROUP, "shadow", AUTHN_PROVIDER_VERSION, &authn_shadow_provider, AP_AUTH_INTERNAL_PER_CONF); /* Register authz providers */ ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "shadow-valid-user", AUTHZ_PROVIDER_VERSION, &authz_valid_user_provider, AP_AUTH_INTERNAL_PER_CONF); ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "shadow-group", AUTHZ_PROVIDER_VERSION, &authz_group_provider, AP_AUTH_INTERNAL_PER_CONF); } static void *create_auth_shadow_dir_config(apr_pool_t *p, char *d) { auth_shadow_config_rec *sec = (auth_shadow_config_rec *) apr_palloc(p, sizeof(*sec)); sec->auth_shadow_flag = 0; return sec; } static const command_rec auth_shadow_cmds[] = { AP_INIT_FLAG("AuthShadow", ap_set_flag_slot, (void *)APR_OFFSETOF(auth_shadow_config_rec, auth_shadow_flag), OR_AUTHCFG, "On or Off depending on whether to use /etc/shadow"), {NULL} }; module AP_MODULE_DECLARE_DATA authnz_shadow_module = { STANDARD20_MODULE_STUFF, create_auth_shadow_dir_config , /* dir config creator */ NULL, /* merge per-dir config structures */ NULL, /* create per-server config structures */ NULL, /* merge per-server config structures */ auth_shadow_cmds, /* [config file] command table */ register_hooks /* register hooks */ }; 

现在，我只是想了解auth模块的整体逻辑顺序。 我在我的Web服务器上创build了一个安全的testing目录，定义如下：

 <Location /secure> AuthName SecureDocument AuthType Basic AuthBasicProvider shadow AuthShadow on Require shadow-valid-user Require shadow-group xyzzy </Location> 

在这里，我感到非常困惑：在testing过程中，我发现valid_user_check_authorization和group_check_authorization例程是用r->user设置为NULL来调用的。 但是authentication例程authn_shadow_check_password 从不被调用。

经过编码，mod_authnz_ldap.c模块似乎意味着authentication和授权可以合并成一个模块。 但是，我假设authenticationfunction，如果存在，将始终在任何授权function之前被调用。 而且我进一步假设，如果浏览器提供的凭证根据authenticationfunction是有效的，那么用户标识将被传递到随后的授权function。 但是我还没有find有关这个话题的明确的文件。

我愿意接受我的假设的build议，提示和更正！