Apache-AppSamurai

 view release on metacpan or  search on metacpan

FAQ  view on Meta::CPAN

   the "LogLevel" setting for "ErrorLog" in your Apache config to debug.
   Don't forget to turn OFF AppSamurai debugging for production!  It logs
   potentially sensitive information that you do not want sitting in a logfile
   in your DMZ.

Auth Modules
------------
Q: How does the AuthBasic auth module work?
A: The AuthBasic auth module attempts to authenticate with a web server using
   HTTP Basic Auth authentication.  (This is the "old" style login where
   a popup box appears asking for a username and password.)  Since AppSamurai
   is often used to protect backend servers that only have HTTP Basic Auth
   enabled, the server used will usually be the same as AppSamurai is
   protecting.

Q: "Basic", "Radius", and "Simple"... not a lot of auth choices...
A: Instead of writing 800 auth modules, AppSamurai comes with two basic auth
   modules (that I personally use), plus the AuthSimple module which opens
   up access to any Authen::Simple supported authentication adaptor.
   (Authen::Simple::Kerberos, Authen::Simple::PAM, etc.)  More AppSamurai
   auth modules may appear in future releases.  (Especially if anyone sends

examples/conf/appsamurai-owa.conf  view on Meta::CPAN

# Set the "secure" flag on the authentication cookie (Note - If you are not
# using SSL, well, USE SSL!!!)
PerlSetVar OwaSecure 1

# Set the silly Microsoft http-only cookie flag
PerlSetVar OwaHttpOnly 1

# Custom mapping of xxxxxx;yyyyyy Basic authentication password input
# to specific and separate individual credentials.
# Example: If the user logs into the basic auth popup with the password:
#		myRockinPassword;1234123456
# The map below will set credential_1 as "1234123456" and credential_2
# as "myRockinPassword", then proceed as if the same were entered into
# a form login.  (Default: undef)
#PerlSetVar OwaBasicAuthMap "2,1=(.+);([^;]+)"

# List the authentication methods (modules) you will be using, in order of
# credential number on the login form.  (credential_1, credential_2, etc)
PerlSetVar OwaAuthMethods "AuthBasic"

lib/Apache/AppSamurai.pm  view on Meta::CPAN

All configuration is done within Apache.  Requires Apache 1.3.x/mod_perl1 or 
Apache 2.0.x/mod_perl2.  See L</EXAMPLES> for sample configuration segments.

=head1 DESCRIPTION

B<Apache::AppSamurai> protects web applications from direct attack by
unauthenticated users, and adds a flexible authentication front end
to local or proxied applications with limited authentication options.

Unauthenticated users are presented with either a login form, or a basic
authentication popup (depending on configuration.)  User supplied credentials
are checked against one or more authentication systems before the user's
session is created and a session authentication cookie is passed back to the
browser.  Only authenticated and authorized requests are proxied through
to the backend server.

Apache::AppSamurai is based on, and includes some code from,
L<Apache::AuthCookie|Apache::AuthCookie>.
Upon that core is added a full authentication and session handling framework.
(No coding required.)  Features include:

lib/Apache/AppSamurai.pm  view on Meta::CPAN

The syntax is a bit odd.  First, specify a list of the credential numbers
you want mapped, in order they will be found within the input. Then
create a regular expression that will match the input, and group each item
you want mapped.

Example:

 PerlSetVar BobAuthBasicAuthMap "2,1=(.+);([^;]+)"

If the user logs into the basic auth popup with the password:
C<myRockinPassword;1234123456> ,the map above will set credential_1 as
C<1234123456> and credential_2 as C<myRockinPassword>, then proceed as if 
the same were entered into a form login.

=head3 ADDITIONAL AUTHENTICATION OPTIONS

Authentication submodules usually have one or more required settings.  All
settings are passed using PerlSetVar directives with variable names prefixed
with the AuthName and the module's name.

lib/Apache/AppSamurai/AuthBasic.pm  view on Meta::CPAN

In most cases, you should be able to configure I<UserAgent> as
C<"header:User-Agent">, which will just pass the client's field right
through to the auth server.

=head2 I<RequireRealm> C<NAME>

(Default: undef)
Require the auth server to return a specific basic auth "realm".  (This
is the value set by "realm=" inside the C<WWW-Authorization> server header.
This is also what shows across the top of the popup basic authentication
login box if you go directly to the login URL.

=head2 I<KeepAuth> C<0|1>

(Default: 0)
If 1, saves the basic authentication header that is sent to the auth server
by AuthBasic and continue to send the same header to the proxied server
after login.  This is almost always used when protecting a single basic auth
backend webserver.