Skip to content

Commit 5016d2b

Browse files
author
root
committed
Initial commit
0 parents  commit 5016d2b

File tree

8 files changed

+1290
-0
lines changed

8 files changed

+1290
-0
lines changed

‎ChangeLog‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
2007 mcarbonneaux
2+
* mod_authmemcookie/1.0 - initial release
3+
4+
2007 mcarbonneaux
5+
* mod_authmemcookie/1.01 - bug fix in cookie name.
6+
7+
2008-02-05 mcarbonneaux
8+
* mod_authmemcookie/1.02
9+
* bug fix of Auth_memCookie_SessionTableSize to 8 any time...
10+
* complete rewrite of match ip option to make possible to use it behind reverse proxy and to check x-forwarded or via http header in place of apache remote_ip.
11+

‎Makefile‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
MY_APXS=/usr/sbin/apxs2
2+
MY_LDFLAGS=-lmemcache -L/mnt/distributions/rpmbuilds/ste-1.0/ste-php/TMP/SFR-libmemcache-1.4.0.rc2-build/product/sfr-suse-addon/lib
3+
MY_CFLAGS=-I/mnt/distributions/rpmbuilds/ste-1.0/ste-php/TMP/SFR-libmemcache-1.4.0.rc2-build/product/sfr-suse-addon/include
4+
5+
.SUFFIXES: .c .o .la
6+
.c.la:
7+
$(MY_APXS) $(MY_LDFLAGS) $(MY_CFLAGS) -c $<
8+
9+
all: mod_auth_memcookie.la
10+
11+
install: mod_auth_memcookie.la
12+
@echo "-"$*"-" "-"$?"-" "-"$%"-" "-"$@"-" "-"$<"-"
13+
$(MY_APXS) -i $?
14+
15+
clean:
16+
-rm -f *.o *.lo *.la *.slo
17+
-rm -rf .libs
18+

‎docs/readme.htm‎

Lines changed: 308 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,308 @@
1+
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
2+
<html>
3+
<head>
4+
<title>memcached: a distributed memory object caching system</title>
5+
6+
7+
<link rel="stylesheet" type="text/css" href="readme_files/memcached.css">
8+
9+
</head>
10+
11+
12+
<body>
13+
14+
<h1>Auth MemCookie</h1>
15+
16+
<div class="linkbar">
17+
[<a href="http://authmemcookie.sourceforge.net/" class="barlink">About</a>]&nbsp;[<a href="https://sourceforge.net/project/showfiles.php?group_id=159430" class="barlink">Download</a>]
18+
</div>
19+
20+
<h2>What is <tt class="mem"><span style="font-family: sans;">"Auth MemCookie</span></tt>"?</h2>
21+
22+
"Auth MemCookie" are an Apache v2 authentification and authorization
23+
modules are based on "cookie" authentification mecanism.<br>
24+
25+
<br>
26+
27+
The module don't &nbsp;make authentification by it self, but verify
28+
if
29+
authentification "the&nbsp;cookie" are&nbsp;valid for each url
30+
protected by the module. The module validate also if&nbsp;the
31+
"authentificated user" have&nbsp;authorisation to
32+
acces&nbsp;url.<br>
33+
34+
<br>
35+
36+
Authentification are made externaly by an authentification form page
37+
and all authentification information nessary to the module a stored in
38+
memcached indentified by the cookie value "authentification session
39+
id"&nbsp;by this login page.<br>
40+
41+
<h2>How it Works</h2>
42+
43+
<h3>Phase 1 : The login Form</h3>
44+
45+
<p>
46+
Authentification are made by a
47+
login formular page.</p>
48+
49+
<p>This login page must&nbsp;authenticate the user with any
50+
authenticate source
51+
(ldap, /etc/password, file, database....) accessible to langage of the
52+
page (php, perl, java... an ldap login page sample in php are in
53+
samples directory).<br>
54+
55+
<br>
56+
57+
Then must set&nbsp;cookie that contain only a key
58+
the "authentification unique id" of the "authentification session".</p>
59+
60+
<p>The login page must store authorisation and user information
61+
of the authenticated user in <a href="http://www.danga.com/memcached/">memcached</a>
62+
identified by the cookie key "authentification unique id".</p>
63+
64+
<p>The
65+
login page can be developted in any langage you want, but must be
66+
capable to use memcached (they must have <a href="http://www.danga.com/memcached/apis.bml">memcache client api</a> for us)</p>
67+
68+
<h3>Phase 2 : The Apache v2 Module</h3>
69+
70+
After the user are logged, the apache 2 module check on each protected
71+
page&nbsp;by apache ACL&nbsp;the presence of the "cookie".<br>
72+
73+
<br>
74+
75+
if the "cookie" exist, try to get session in&nbsp;<a href="http://www.danga.com/memcached/">memcached</a>
76+
with the "cookie" value if not found return <span style="background-color: rgb(224, 224, 255); font-weight: bold;">"HTTP_UNAUTHORIZED"</span>
77+
page. <br>
78+
79+
<br>
80+
81+
if session exist in&nbsp;<a href="http://www.danga.com/memcached/">memcached</a>
82+
verify if acl match user session information if not match return
83+
<span style="background-color: rgb(224, 224, 255); font-weight: bold;">"HTTP_FORBIDDEN"</span>
84+
page.&nbsp;<br>
85+
86+
<br>
87+
88+
<h2>Session format stored in memcached</h2>
89+
90+
<br>
91+
92+
The session store in memcached are composed with multiple line in forme
93+
of <span style="background-color: rgb(224, 224, 255); font-weight: bold;">"name"</span>
94+
egual <span style="background-color: rgb(224, 224, 255); font-weight: bold;">"value"</span>
95+
ended by <span style="background-color: rgb(224, 224, 255); font-weight: bold;">"\r\n"</span>.
96+
some are mandatory, other are
97+
obtional and the reste are information only (all this field are
98+
transmited to the script langage protect the module).<br>
99+
100+
<br>
101+
102+
<pre class="example"><div class="exampletitle"> Session format :</div><span style="font-weight: bold;">UserName</span>=&lt;user name&gt;\r\n<br><span style="font-weight: bold;">Groups</span>=&lt;groupe name1&gt;:&lt;group name2&gt;:...\r\n<br><span style="font-weight: bold;">RemoteIP</span>=&lt;remote ip&gt;\r\n<br><span style="font-weight: bold;">Password</span>=&lt;password&gt;\r\n<br><span style="font-weight: bold;">Expiration</span>=&lt;expiration time&gt;\r\n<br><span style="font-weight: bold;">Email</span>=&lt;email&gt;\r\n<br><span style="font-weight: bold;">Name</span>=&lt;name&gt;\r\n<br><span style="font-weight: bold;">GivenName</span>=&lt;given name&gt;\r\n<br></pre>
103+
104+
<div style="margin-left: 40px;">
105+
<ul>
106+
107+
<li><span style="font-weight: bold;">Username:</span>
108+
are
109+
mandatory.</li>
110+
111+
<li><span style="font-weight: bold;">Groups:</span>
112+
are
113+
mandatory, are used to check group in apache acl. if no
114+
group are know for the user, must be blank (Groups=\r\n)</li>
115+
116+
<li><span style="font-weight: bold;">RemoteIP:</span>
117+
are mandatory, used by remote ip check function in apache
118+
module.</li>
119+
120+
</ul>
121+
122+
<span style="font-weight: bold;"></span>
123+
<ul>
124+
125+
<li><span style="font-weight: bold;">Password:</span>
126+
are not mandatory, and is not recomanded to
127+
store in
128+
memcached for security reson, but if strored,&nbsp;is sended to the
129+
script language protected by the module.</li>
130+
131+
</ul>
132+
133+
<ul>
134+
135+
<li>The other field are information only, but they are sended
136+
to langage
137+
that are behind the module (via environement variable or http header).</li>
138+
139+
</ul>
140+
141+
<br>
142+
143+
</div>
144+
145+
The session fields size are for the moment limited to 10 fields by
146+
default.<br>
147+
148+
<h2>Build dependency</h2>
149+
150+
You must have compiled and installed :<br>
151+
152+
<ul>
153+
154+
<li><a href="http://www.monkey.org/%7Eprovos/libevent/">libevent</a>
155+
used by memcached.</li>
156+
157+
<li><a href="http://www.danga.com/memcached/">memcached</a>
158+
the cache daemon it self.</li>
159+
160+
<li><a href="http://people.freebsd.org/%7Eseanc/libmemcache/">libmemcache</a>
161+
the C client API neaded to compile the Apache Module.</li>
162+
163+
</ul>
164+
165+
<h2>Compilation</h2>
166+
167+
You must modify Makefile:<br>
168+
169+
<ul>
170+
171+
<li>set correctly the MY_APXS varriable to point to the apache
172+
"apxs" scripts.</li>
173+
174+
<li>add the memcache library path in MY_LDFLAGS variable if
175+
nessesary (-L&lt;my memcache lib path&gt;)</li>
176+
177+
</ul>
178+
179+
<pre class="example"><div class="exampletitle">How to compile:</div>#make<br>#make install</pre>
180+
181+
After that the "mod_auth_memcookie.so" are genereted in apache
182+
"modules" directory.<br>
183+
184+
<h2>How to configure Apache Module</h2>
185+
186+
<h3>Module configuration option:</h3>
187+
This option can be used in "location" or "directory" apache context.
188+
<small><span style="font-weight: bold;"></span></small>
189+
<ul>
190+
191+
<li><small><span style="font-weight: bold;">Auth_memCookie_Memcached_AddrPort</span></small></li>
192+
193+
</ul>
194+
195+
<div style="margin-left: 40px;">Liste of ip or host
196+
adresse(s) and port&nbsp;':' separed of memcache(s) daemon to be
197+
used, coma separed.<br>
198+
199+
</div>
200+
201+
<pre class="example"><div class="exampletitle">For exemple: </div>host1:12000,host2:12000</pre>
202+
203+
<ul>
204+
205+
<li><small><span style="font-weight: bold;">Auth_memCookie_Memcached_SessionObject_ExpireTime</span></small></li>
206+
207+
</ul>
208+
209+
<div style="margin-left: 40px;">Session object stored in
210+
memcached expiry time, in secondes. <br>
211+
212+
Used only if "Auth_memCookie_Memcached_SessionObject_ExpiryReset" is
213+
set to on.<br>
214+
215+
Set to 3600 seconds by default.</div>
216+
217+
<ul>
218+
219+
<span style="font-weight: bold;">
220+
</span><li><small><span style="font-weight: bold;">Auth_memCookie_Memcached_SessionObject_ExpiryReset</span></small></li>
221+
222+
</ul>
223+
224+
<div style="margin-left: 40px;">Set to 'no' to not reset
225+
object expiry time in memcache on each url... set to yes by default</div>
226+
227+
<ul>
228+
229+
<li><small><span style="font-weight: bold;">Auth_memCookie_SessionTableSize</span></small></li>
230+
231+
</ul>
232+
233+
<div style="margin-left: 40px;">Max number of element in
234+
session information table. set to 10 by default.</div>
235+
236+
<ul>
237+
238+
<li><small><span style="font-weight: bold;">Auth_memCookie_SetSessionHTTPHeader</span></small></li>
239+
240+
</ul>
241+
242+
<div style="margin-left: 40px;">Set to 'yes' to set
243+
session information to http header of the authenticated users, set to
244+
no by default.</div>
245+
246+
<ul>
247+
248+
<li><small><span style="font-weight: bold;">Auth_memCookie_SetSessionHTTPHeaderEncode</span></small></li>
249+
250+
</ul>
251+
252+
<div style="margin-left: 40px;">Set to 'yes' to mime64
253+
encode session information to http header, set to no by default.</div>
254+
255+
<ul>
256+
257+
<li><small><span style="font-weight: bold;">Auth_memCookie_CookieName</span></small></li>
258+
259+
</ul>
260+
261+
<div style="margin-left: 40px;">Name of the cookie to used
262+
for check authentification, set to "AuthMemCookie" by default.</div>
263+
264+
<ul>
265+
266+
<li><small><span style="font-weight: bold;">Auth_memCookie_MatchIP_Mode</span></small></li>
267+
268+
</ul>
269+
270+
<div style="margin-left: 40px;">Set to '0' to not check IP address set in cookie with the remote browser ip, set to '0' by default. </br>To check cookie ip adresse, Set to '1' to use 'X-Forwarded-For' http header, to '2' to use 'Via' http header, and to '3' to use apache remote_ip.
271+
</div>
272+
273+
<ul>
274+
275+
<li><small><span style="font-weight: bold;">Auth_memCookie_GroupAuthoritative</span></small></li>
276+
277+
</ul>
278+
279+
<div style="margin-left: 40px;">Set to 'no' to allow
280+
access control to be passed along to lower modules, for group acl
281+
check. set to 'yes' by default.</div>
282+
283+
<ul>
284+
285+
<li><small><span style="font-weight: bold;">Auth_memCookie_Authoritative</span></small></li>
286+
287+
</ul>
288+
289+
<div style="margin-left: 40px;">Set to 'yes' to allow
290+
access control to be passed along to lower modules.Set to 'no' by
291+
default.</div>
292+
293+
<ul>
294+
295+
<li><small><span style="font-weight: bold;">Auth_memCookie_SilmulateAuthBasic</span></small></li>
296+
297+
</ul>
298+
299+
<div style="margin-left: 40px;">Set to 'no' to not fix http header and auth_type for simulating auth basic for scripting language like php auth framework work (set PHP_AUTH_* $SERVER variable in php and apache REMOTE_USER and AUTH_TYPE vars)., set to 'yes' by default</div>
300+
301+
<br>
302+
303+
<h3>Sample to configure Apache v2 Module:</h3>
304+
305+
<pre class="example"><div class="exampletitle">Configuration sample for using Auth_memcookie apache V2 module:</div><br>LoadModule mod_auth_memcookie_module modules/mod_auth_memcookie.so<br><br>&lt;IfModule mod_auth_memcookie.c&gt;<br> &lt;Location /&gt;<br> Auth_memCookie_CookieName myauthcookie<br> Auth_memCookie_Memcached_AddrPort 127.0.0.1:11000<br><br style="font-weight: bold;"><span style="font-weight: bold;"> # to redirect unauthorized user to the login page</span><br> ErrorDocument 401 "/gestionuser/login.php"<br><br><span style="font-weight: bold;"> # to specify if the module are autoritative in this directory</span><br> Auth_memCookie_Authoritative on<br> <span style="font-weight: bold;"># must be set without that the refuse authentification</span><br> AuthType Cookie<br> <span style="font-weight: bold;"># must be set (apache mandatory) but not used by the module</span><br> AuthName "My Login"<br> &lt;/Location&gt;<br><br>&lt;/IfModule&gt;<br><br><span style="font-weight: bold;"># to protect juste user authentification</span><br>&lt;Location "/myprotectedurl"&gt;<br> require valid-user<br>&lt;/Location&gt;<br><br># to protect acces to user in group1<br>&lt;Location "/myprotectedurlgroup1"&gt;<br> require group group1<br>&lt;/Location&gt;<br><br></pre>
306+
307+
</body>
308+
</html>

0 commit comments

Comments
 (0)