Apache Module mod_authnz_fcgi 1y3k55

Invocation modes 3i3973

The invocation modes for FastCGI authorizers ed by this module are distinguished by two characteristics, type and auth mechanism.

Type is simply authn for authentication, authz for authorization, or authnz for combined authentication and authorization.

Auth mechanism refers to the Apache httpd configuration mechanisms and processing phases, and can be AuthBasirovider, Require, or check__id. The first two of these correspond to the directives used to enable participation in the appropriate processing phase.

Descriptions of each mode:

Type authn, mechanism AuthBasirovider

In this mode, FCGI_ROLE is set to AUTHORIZER and FCGI_APACHE_ROLE is set to AUTHENTICATOR. The application must be defined as provider type authn using AuthBasirovider. When invoked, the application is expected to authenticate the client using the provided id and . Example application:

#!/usr/bin/perl
use FCGI;
my $request = FCGI::Request();
while ($request->Accept() >= 0) {
    die if $ENV{'FCGI_APACHE_ROLE'} ne "AUTHENTICATOR";
    die if $ENV{'FCGI_ROLE'}        ne "AUTHORIZER";
    die if !$ENV{'REMOTE_WD'};
    die if !$ENV{'REMOTE_'};

    print STDERR "This text is written to the web server error log.\n";

    if ( ($ENV{'REMOTE_' } eq "foo" || $ENV{'REMOTE_'} eq "foo1") &&
        $ENV{'REMOTE_WD'} eq "bar" ) {
        print "Status: 200\n";
        print "Variable-AUTHN_1: authn_01\n";
        print "Variable-AUTHN_2: authn_02\n";
        print "\n";
    }
    else {
        print "Status: 401\n\n";
    }
}

Example configuration:

AuthnzFcgiDefineProvider authn FooAuthn fcgi://localhost:10102/
<Location "/protected/">
  AuthType Basic
  AuthName "Restricted"
  AuthBasirovider FooAuthn
  Require ...
</Location>

Type authz, mechanism Require

In this mode, FCGI_ROLE is set to AUTHORIZER and FCGI_APACHE_ROLE is set to AUTHORIZER. The application must be defined as provider type authz using AuthnzFcgiDefineProvider. When invoked, the application is expected to authorize the client using the provided id and other request data. Example application:

#!/usr/bin/perl
use FCGI;
my $request = FCGI::Request();
while ($request->Accept() >= 0) {
    die if $ENV{'FCGI_APACHE_ROLE'} ne "AUTHORIZER";
    die if $ENV{'FCGI_ROLE'}        ne "AUTHORIZER";
    die if $ENV{'REMOTE_WD'};

    print STDERR "This text is written to the web server error log.\n";

    if ($ENV{'REMOTE_'} eq "foo1") {
        print "Status: 200\n";
        print "Variable-AUTHZ_1: authz_01\n";
        print "Variable-AUTHZ_2: authz_02\n";
        print "\n";
    }
    else {
        print "Status: 403\n\n";
    }
}

Example configuration:

AuthnzFcgiDefineProvider authz FooAuthz fcgi://localhost:10103/
<Location "/protected/">
  AuthType ...
  AuthName ...
  AuthBasirovider ...
  Require FooAuthz
</Location>

Type authnz, mechanism AuthBasirovider + Require

In this mode, which s the web server-agnostic FastCGI AUTHORIZER protocol, FCGI_ROLE is set to AUTHORIZER and FCGI_APACHE_ROLE is not set. The application must be defined as provider type authnz using AuthnzFcgiDefineProvider. The application is expected to handle both authentication and authorization in the same invocation using the id, , and other request data. The invocation occurs during the Apache httpd API authentication phase. If the application returns 200 and the same provider is invoked during the authorization phase (via Require), mod_authnz_fcgi will return success for the authorization phase without invoking the application. Example application:

#!/usr/bin/perl
use FCGI;
my $request = FCGI::Request();
while ($request->Accept() >= 0) {
    die if $ENV{'FCGI_APACHE_ROLE'};
    die if $ENV{'FCGI_ROLE'} ne "AUTHORIZER";
    die if !$ENV{'REMOTE_WD'};
    die if !$ENV{'REMOTE_'};

    print STDERR "This text is written to the web server error log.\n";

    if ( ($ENV{'REMOTE_' } eq "foo" || $ENV{'REMOTE_'} eq "foo1") &&
        $ENV{'REMOTE_WD'} eq "bar" &&
        $ENV{'REQUEST_URI'} =~ m%/bar/.*%) {
        print "Status: 200\n";
        print "Variable-AUTHNZ_1: authnz_01\n";
        print "Variable-AUTHNZ_2: authnz_02\n";
        print "\n";
    }
    else {
        print "Status: 401\n\n";
    }
}

Example configuration:

AuthnzFcgiDefineProvider authnz FooAuthnz fcgi://localhost:10103/
<Location "/protected/">
  AuthType Basic
  AuthName "Restricted"
  AuthBasirovider FooAuthnz
  Require FooAuthnz
</Location>

Type authn, mechanism check__id

In this mode, FCGI_ROLE is set to AUTHORIZER and FCGI_APACHE_ROLE is set to AUTHENTICATOR. The application must be defined as provider type authn using AuthnzFcgiCheckAuthnProvider specifies when it is called. Example application:

#!/usr/bin/perl
use FCGI;
my $request = FCGI::Request();
while ($request->Accept() >= 0) {
    die if $ENV{'FCGI_APACHE_ROLE'} ne "AUTHENTICATOR";
    die if $ENV{'FCGI_ROLE'} ne "AUTHORIZER";

    # This authorizer assumes that the RequireBasicAuth option of 
    # AuthnzFcgiCheckAuthnProvider is On:
    die if !$ENV{'REMOTE_WD'};
    die if !$ENV{'REMOTE_'};

    print STDERR "This text is written to the web server error log.\n";

    if ( ($ENV{'REMOTE_' } eq "foo" || $ENV{'REMOTE_'} eq "foo1") &&
        $ENV{'REMOTE_WD'} eq "bar" ) {
        print "Status: 200\n";
        print "Variable-AUTHNZ_1: authnz_01\n";
        print "Variable-AUTHNZ_2: authnz_02\n";
        print "\n";
    }
    else {
        print "Status: 401\n\n";
        # If a response body is written here, it will be returned to
        # the client.
    }
}

Example configuration:

AuthnzFcgiDefineProvider authn FooAuthn fcgi://localhost:10103/
<Location "/protected/">
  AuthType ...
  AuthName ...
  AuthnzFcgiCheckAuthnProvider FooAuthn \
                               Authoritative On \
                               RequireBasicAuth Off \
                               Expr "%{reqenv:REMOTE_}"
  Require ...
</Location>

Additional examples v2jo

1. If your application s the separate authentication and authorization roles (AUTHENTICATOR and AUTHORIZER), define separate providers as follows, even if they map to the same application:

   AuthnzFcgiDefineProvider authn  FooAuthn  fcgi://localhost:10102/
   AuthnzFcgiDefineProvider authz  FooAuthz  fcgi://localhost:10102/

   Specify the authn provider on Require:

   AuthType Basic
   AuthName "Restricted"
   AuthBasirovider FooAuthn
   Require FooAuthz

2. If your application s the generic AUTHORIZER role (authentication and authorizer in one invocation), define a single provider as follows:

   AuthnzFcgiDefineProvider authnz FooAuthnz fcgi://localhost:10103/

   Specify the authnz provider on both AuthBasirovider and Require:

   AuthType Basic
   AuthName "Restricted"
   AuthBasirovider FooAuthnz
   Require FooAuthnz

Limitations 1q3r6p

The following are potential features which are not currently implemented:

Apache httpd access checker

The Apache httpd API access check phase is a separate phase from authentication and authorization. Some other FastCGI implementations implement this phase, which is denoted by the setting of FCGI_APACHE_ROLE to ACCESS_CHECKER.

Local (Unix) sockets or pipes

Only T sockets are currently ed.

for mod_authn_socache

mod_authn_socache interaction should be implemented for applications which participate in Apache httpd-style authentication.

for digest authentication using AuthDigestProvider

This is expected to be a permanent limitation as there is no authorizer flow for retrieving a hash.

Application process management

This is expected to be permanently out of scope for this module. Application processes must be controlled by other means. For example, fcgistarter can be used to start them.

AP_AUTH_INTERNAL_PER_URI

All providers are currently ed as AP_AUTH_INTERNAL_PER_CONF, which means that checks are not performed again for internal subrequests with the same access control configuration as the initial request.

Protocol data charset conversion

If mod_authnz_fcgi runs in an EBCDIC compilation environment, all FastCGI protocol data is written in EBCDIC and expected to be received in EBCDIC.

Multiple requests per connection

Currently the connection to the FastCGI authorizer is closed after every phase of processing. For example, if the authorizer handles separate authn and authz phases then two connections will be used.

URI Mapping

URIs from clients can't be mapped, such as with the Proxy used with FastCGI responders.

Logging 3t6c50

1. Processing errors are logged at log level error and higher.
2. Messages written by the application are logged at log level warn.
3. General messages for debugging are logged at log level debug.
4. Environment variables ed to the application are logged at log level trace2. The value of the REMOTE_WD variable will be obscured, but any other sensitive data will be visible in the log.
5. All I/O between the module and the FastCGI application, including all environment variables, will be logged in printable and hex format at log level trace5. All sensitive data will be visible in the log.

LogLevel can be used to configure a log level specific to mod_authnz_fcgi. For example:

LogLevel info authnz_fcgi:trace8