view release on metacpan or  search on metacpan

AuthenN2.pm  view on Meta::CPAN

   my $r = shift;
   my $requires = $r->requires;
   return OK unless $requires;

   # get user name
   my $name = $r->connection->user;

   # get group table name
   my $dir_config = $r->dir_config;   
   my $group_table=$dir_config->get('NISPlus_Group_Table');

   for my $req (@$requires) {
      my($require, @rest) = split /\s+/, $req->{requirement};

      # ok if user is simply authenticated
      if($require eq 'valid-user'){return OK}

      # ok if user is one of these users
      elsif($require eq 'user') {return OK if grep $name eq $_, @rest}

      # ok if user is member of a required group. warning: this will fail 
      # if user is not in the nis+ domain, because there is no current
      # concept of nt domain groups in Authen::Smb
      elsif($require eq 'group') {
         my $group_table = Net::NISPlus::Table->new($group_table);
         unless ($group_table){
            $r->note_basic_auth_failure;
            $r->log_reason($self . ': cannot get nis+ group table', $r->uri);
            return AUTH_REQUIRED;
         }
         my %groups_to_gids;
         foreach ($group_table->list()){$groups_to_gids{@{$_}[0]} = @{$_}[2]}
         for my $group (@rest) {
            next unless exists $groups_to_gids{$group};
            return OK if $r->notes($name . 'Group') == $groups_to_gids{$group};
         }
      }
   }

   $r->note_basic_auth_failure;
   $r->log_reason(
      $self . ': user ' . $name . 
      ' not member of required group in ' . $group_table, $r->uri
   );
   return AUTH_REQUIRED;

}

1;

__END__

=pod

=head1 NAME

Apache::AuthenN2 - Authenticate into the NT and NIS+ domains

=head1 SYNOPSIS

Allow windows and unix users to use their familiar credentials to
gain authenticated access to restricted applications and files
offered via apache.

   #httpd.conf
   <Files *challenge*>
      AuthName 'your nt or nis+ account'
      AuthType Basic
      PerlSetVar NISPlus_Passwd_Table passwd.org_dir.yoyodyne.com
      PerlSetVar NISPlus_Group_Table group.org_dir.yoyodyne.com
      PerlSetVar NT_Default_Domains 'eng corporate'
      PerlSetVar NT_Controllers 'bapdc:babdc njpdc:njbdc'
      PerlAuthenHandler Apache::AuthenN2
      require group eng
      require user john larry
   </Files>

=head1 DESCRIPTION

Authenticate to one or more pdc:bdc controller pairs; these can be
true nt controllers or properly configured samba servers.  Only one
pdc:bdc pair is required by the module; you can add pairs to increase
reliability, or to circumvent domain trust wars.  If the user has
specified a domain, e.g., sales\john, then just try against that
domain; if no domain was specified by the user, try all of the
default domains listed in the above config.  Failing nt
authentication, try nis+.  This order (nt then nis+) is simply to
boost average apparent performance because the nt population is much
larger than the unix population at the author's company.  If your
population has an opposite demographic, feel free to reverse the
order of checking.

Note that this scheme is quite permissive.  Valid nt credentials
against any of the controllers or domains, or valid nis+ credentials
will allow access.  This multiplies exposure to poorly selected
passwords.

<Files *challenge*> is just a way of specifying which files should be
protected by this authenticator.  In this example, a script named
newbug-challenge.pl would be protected, regardless of where it is
located in the apache htdocs or cgi directories.  If you prefer, you
can use the simpler <Location> directive to protect a particular file
or directory.

Instead of requiring specific groups or users, you could just
'require valid-user'.

The nt part requires the Authen::Smb module.  When Authen::Smb
supports group authentication, I will add it to this module.

The nis+ part requires the Net::NISPlus module.

You just read all you need to know to get started -- but you should
read on if you care about nt/nis+ server load, network performance,
or response time (as the user perceives it).

_Every_ time a protected file is requested, this handler is invoked.
Depending on your configuration (how many controllers and default
domains you specify), and where the matching credentials are, it can
take a while.  This adds to your network and server load, as well as
bothering some users with the wait.  It makes sense to cache valid
credentials in memory so as to avoid invoking this expensive module
every time.  Luckily, Jason Bodnar already created AuthenCache.
Although written with AuthenDBI in mind, it works beautifully in this
case as well.  It is _highly_ recommended.  After installing it, you
need a few more lines in httpd.conf; to expand on the above example:

   PerlModule Apache::AuthenCache
   <Files *challenge*>
      AuthName 'your nt or nis+ account'
      AuthType Basic
      PerlSetVar NISPlus_Passwd_Table passwd.org_dir.yoyodyne.com
      PerlSetVar NISPlus_Group_Table group.org_dir.yoyodyne.com
      PerlSetVar NT_Default_Domains 'eng corporate'
      PerlSetVar NT_Controllers 'bapdc:babdc nypdc:nybdc'
      PerlSetVar AuthenCache_casesensitive off
      PerlAuthenHandler Apache::AuthenCache Apache::AuthenN2 Apache::AuthenCache::manage_cache
      require group eng
      require user john larry
   </Files>

A couple of tips about AuthenCache: 1 comment out the $r->warn lines
that echo the password to the apache error log (they are fine for
debugging but not good for production), and 2 keep in mind that the
cache has to be established separately in each current httpd child
process, so it does not appear to be working consistently until all
the children know about the user.  This is nothing to panic about; we
are just playing the odds: the more active the user is, the more they
will benefit from the caching.