configuration snippet:</p>
<example>
- <VirtualHost www.abc.dom> <br />
- ServerAdmin webgirl@abc.dom <br />
- DocumentRoot /www/abc <br />
- </VirtualHost> <br />
+ <VirtualHost www.abc.dom><br />
+ <indent>
+ ServerAdmin webgirl@abc.dom<br />
+ DocumentRoot /www/abc<br />
+ </indent>
+ </VirtualHost><br />
<br />
- <VirtualHost www.def.dom> <br />
- ServerAdmin webguy@def.dom <br />
- DocumentRoot /www/def <br />
+ <VirtualHost www.def.dom><br />
+ <indent>
+ ServerAdmin webguy@def.dom<br />
+ DocumentRoot /www/def<br />
+ </indent>
</VirtualHost>
</example>
access is granted. For example the following authorization block would
apply the logic:</p>
- <p><var>
- if ((user == "John") || <br />
- ((Group == "admin") && (ldap-group <ldap-object> contains auth'ed_user) &&<br />
- ((ldap-attribute dept == "sales") ||
- (file-group contains contains auth'ed_user))))<br />
- then<br />
- auth_granted<br />
- else<br />
- auth_denied<br />
- </var></p>
-
<example>
- <Directory /www/mydocs><br />
- Authname ...<br />
- AuthBasicProvider ...<br />
- ...<br />
- Require user John<br />
- <SatisfyAll><br />
- Require Group admins<br />
- Require ldap-group cn=mygroup,o=foo<br />
- <SatisfyOne><br />
- Require ldap-attribute dept="sales"<br />
- Require file-group<br />
- </SatisfyOne><br />
- </SatisfyAll><br />
- </Directory><br />
+ # if ((user == "John") ||<br />
+ # ((Group == "admin")<br />
+ # && (ldap-group <ldap-object> contains auth'ed_user)<br />
+ # && ((ldap-attribute dept == "sales")<br />
+ # || (file-group contains auth'ed_user))))<br />
+ # then<br />
+ # auth_granted<br />
+ # else<br />
+ # auth_denied<br />
+ #<br />
+ <Directory /www/mydocs><br />
+ <indent>
+ Authname ...<br />
+ AuthBasicProvider ...<br />
+ ...<br />
+ Require user John<br />
+ <SatisfyAll><br />
+ <indent>
+ Require Group admins<br />
+ Require ldap-group cn=mygroup,o=foo<br />
+ <SatisfyOne><br />
+ <indent>
+ Require ldap-attribute dept="sales"<br />
+ Require file-group<br />
+ </indent>
+ </SatisfyOne><br />
+ </indent>
+ </SatisfyAll><br />
+ </indent>
+ </Directory>
</example>
<p>By default all <directive module="mod_authz_core">Require</directive>
<example>
<SatisfyAll><br />
- Reject ip <var>192.101.205</var><br />
- Reject host <var>cyberthugs.com</var> <var>moreidiots.com</var><br />
- Reject host ke<br />
+ <indent>
+ Reject ip <var>192.101.205</var><br />
+ Reject host <var>cyberthugs.com</var> <var>moreidiots.com</var><br /> Reject host ke<br />
+ </indent>
</SatisfyAll>
</example>
allow you to apply "AND" and "OR" logic to the authorization processing.
For example the following authorization block would apply the logic:</p>
- <p><var>
- if ((user == "John") || <br />
- ((Group == "admin") && (ldap-group <ldap-object> contains auth'ed_user) &&<br />
- ((ldap-attribute dept == "sales") ||
- (file-group contains contains auth'ed_user))))<br />
- then<br />
- auth_granted<br />
- else<br />
- auth_denied<br />
- </var></p>
-
<example>
- <Directory /www/mydocs><br />
- Authname ...<br />
- AuthBasicProvider ...<br />
- ...<br />
- Require user John<br />
- <SatisfyAll><br />
- Require Group admins<br />
- Require ldap-group cn=mygroup,o=foo<br />
- <SatisfyOne><br />
- Require ldap-attribute dept="sales"<br />
- Require file-group<br />
- </SatisfyOne><br />
- </SatisfyAll><br />
- </Directory><br />
+ # if ((user == "John") ||<br />
+ # ((Group == "admin")<br />
+ # && (ldap-group <ldap-object> contains auth'ed_user)<br />
+ # && ((ldap-attribute dept == "sales")<br />
+ # || (file-group contains auth'ed_user))))<br />
+ # then<br />
+ # auth_granted<br />
+ # else<br />
+ # auth_denied<br />
+ #<br />
+ <Directory /www/mydocs><br />
+ <indent>
+ Authname ...<br />
+ AuthBasicProvider ...<br />
+ ...<br />
+ Require user John<br />
+ <SatisfyAll><br />
+ <indent>
+ Require Group admins<br />
+ Require ldap-group cn=mygroup,o=foo<br />
+ <SatisfyOne><br />
+ <indent>
+ Require ldap-attribute dept="sales"<br />
+ Require file-group<br />
+ </indent>
+ </SatisfyOne><br />
+ </indent>
+ </SatisfyAll><br />
+ </indent>
+ </Directory>
</example>
-
</usage>
<seealso><a href="../howto/auth.html">Authentication, Authorization,