/ 
Apache-AuthenN2-0.05
River stage zero No dependents
/ Apache::AuthenN2

NAME

Apache::AuthenN2 - Authenticate into the NT and NIS+ domains

SYNOPSIS

Allow windows and unix users to use their familiar credentials to gain authenticated access to restricted applications and files offered via apache.

#httpd.conf
<Files *challenge*>
   AuthName 'your nt or nis+ account'
   AuthType Basic
   PerlSetVar NISPlus_Passwd_Table passwd.org_dir.yoyodyne.com
   PerlSetVar NISPlus_Group_Table group.org_dir.yoyodyne.com
   PerlSetVar NT_Default_Domains 'eng corporate'
   PerlSetVar NT_Controllers 'bapdc:babdc njpdc:njbdc'
   PerlAuthenHandler Apache::AuthenN2
   require group eng
   require user john larry
</Files>

DESCRIPTION

Authenticate to one or more pdc:bdc controller pairs; these can be true nt controllers or properly configured samba servers. Only one pdc:bdc pair is required by the module; you can add pairs to increase reliability, or to circumvent domain trust wars. If the user has specified a domain, e.g., sales\john, then just try against that domain; if no domain was specified by the user, try all of the default domains listed in the above config. Failing nt authentication, try nis+. This order (nt then nis+) is simply to boost average apparent performance because the nt population is much larger than the unix population at the author's company. If your population has an opposite demographic, feel free to reverse the order of checking.

Note that this scheme is quite permissive. Valid nt credentials against any of the controllers or domains, or valid nis+ credentials will allow access. This multiplies exposure to poorly selected passwords.

<Files *challenge*> is just a way of specifying which files should be protected by this authenticator. In this example, a script named newbug-challenge.pl would be protected, regardless of where it is located in the apache htdocs or cgi directories. If you prefer, you can use the simpler <Location> directive to protect a particular file or directory.

Instead of requiring specific groups or users, you could just 'require valid-user'.

The nt part requires the Authen::Smb module. When Authen::Smb supports group authentication, I will add it to this module.

The nis+ part requires the Net::NISPlus module.

You just read all you need to know to get started -- but you should read on if you care about nt/nis+ server load, network performance, or response time (as the user perceives it).

_Every_ time a protected file is requested, this handler is invoked. Depending on your configuration (how many controllers and default domains you specify), and where the matching credentials are, it can take a while. This adds to your network and server load, as well as bothering some users with the wait. It makes sense to cache valid credentials in memory so as to avoid invoking this expensive module every time. Luckily, Jason Bodnar already created AuthenCache. Although written with AuthenDBI in mind, it works beautifully in this case as well. It is _highly_ recommended. After installing it, you need a few more lines in httpd.conf; to expand on the above example:

PerlModule Apache::AuthenCache
<Files *challenge*>
   AuthName 'your nt or nis+ account'
   AuthType Basic
   PerlSetVar NISPlus_Passwd_Table passwd.org_dir.yoyodyne.com
   PerlSetVar NISPlus_Group_Table group.org_dir.yoyodyne.com
   PerlSetVar NT_Default_Domains 'eng corporate'
   PerlSetVar NT_Controllers 'bapdc:babdc nypdc:nybdc'
   PerlSetVar AuthenCache_casesensitive off
   PerlAuthenHandler Apache::AuthenCache Apache::AuthenN2 Apache::AuthenCache::manage_cache
   require group eng
   require user john larry
</Files>

A couple of tips about AuthenCache: 1 comment out the $r->warn lines that echo the password to the apache error log (they are fine for debugging but not good for production), and 2 keep in mind that the cache has to be established separately in each current httpd child process, so it does not appear to be working consistently until all the children know about the user. This is nothing to panic about; we are just playing the odds: the more active the user is, the more they will benefit from the caching.

AUTHOR

valerie at savina dot com (Valerie Delane), originally based more or less on code shamelessly lifted from Doug MacEachern's Apache::AuthNIS and Micheal Parkers's Apache::AuthenSMB.

COPYRIGHT

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

SEE ALSO

mod_perl(3), Apache(3)