From: Sander Temme Other Other AuthLDAPDereferenceAliases
AuthLDAPGroupAttribute
AuthLDAPGroupAttributeIsDN
AuthLDAPRemoteUserAttribute
AuthLDAPRemoteUserIsDN
AuthLDAPUrl
AuthzLDAPAuthoritative
Require
values may also be
- used which may require loading additional authorization modules.Require
values may also
+ be used which may require loading additional authorization modules.
+ Note that if you use a Require
+ value from another authorization module, you will need to ensure that
+ AuthzLDAPAuthoritative
+ is set to off
to allow the authorization phase to fall
+ back to the module providing the alternate
+ Require
value.
Description: | Use the value of the attribute returned during the user +query to set the REMOTE_USER environment variable |
---|---|
Syntax: | AuthLDAPRemoteUserAttribute uid |
Default: | none |
Context: | directory, .htaccess |
Override: | AuthConfig |
Status: | Extension |
Module: | mod_authnz_ldap |
If this directive is set, the value of the
+ REMOTE_USER
environment variable will be set to the
+ value of the attribute specified. Make sure that this attribute is
+ included in the list of attributes in the AuthLDAPUrl definition,
+ otherwise this directive will have no effect. This directive, if
+ present, takes precedence over AuthLDAPRemoteUserIsDN. This
+ directive is useful should you want people to log into a website
+ using an email address, but a backend application expects the
+ username as a userid.
The Allow
directive affects which hosts can
access an area of the server. Access can be controlled by
- hostname, IP Address, IP Address range, or by other
+ hostname, IP address, IP address range, or by other
characteristics of the client request captured in environment
variables.
The Order
directive controls the default
- access state and the order in which Allow
and Deny
directives are evaluated.
- Ordering is one of
The Order
directive, along with the
+ Allow
and Deny
directives, controls a
+ three-pass access control system. The first pass processes either
+ all Allow
or all
+ Deny
directives, as
+ specified by the Order
directive. The second
+ pass parses the rest of the directives (Deny
or Allow
). The third pass applies
+ to all requests which do not match either of the first two.
Note that all Allow
and Deny
directives are processed,
+ unlike a typical firewall, where only the first match is used. The
+ last match is effective (also unlike a typical firewall).
+ Additionally, the order in which lines appear in the configuration
+ files is not significant -- all Allow
lines are processed as one
+ group, all Deny
lines
+ are considered as another, and the default state is considered by
+ itself.
Ordering is one of:
Deny,Allow
Deny
directives
- are evaluated before the Allow
directives. Access is
- allowed by default. Any client which does not match a
- Deny
directive or does
- match an Allow
- directive will be allowed access to the server.Allow
directives are
+ evaluated; at least one must match, or the request is rejected.
+ Next, all Deny
+ directives are evaluated. If any matches, the request is rejected.
+ Last, any requests which do not match an Allow
or a Deny
directive are denied by
+ default.Allow,Deny
Allow
- directives are evaluated before the Deny
directives. Access is denied
- by default. Any client which does not match an Allow
directive or does match a
- Deny
directive will be
- denied access to the server.Deny
+ directives are evaluated; if any match, the request is denied
+ unless it also matches an Allow
directive. Any requests
+ which do not match any Allow
or Deny
directives are
+ permitted.Mutual-failure
Allow
list and do not appear on
- the Deny
list are
- granted access. This ordering has the same effect as Order
- Allow,Deny
and is deprecated in favor of that
- configuration.Order
+ Allow,Deny
and is deprecated in its favor.Keywords may only be separated by a comma; no whitespace is
- allowed between them. Note that in all cases every Allow
and Deny
statement is evaluated.
Keywords may only be separated by a comma; no whitespace + is allowed between them.
+ +Match | +Allow,Deny result | +Deny,Allow result | +
---|---|---|
Match Allow only | +Request allowed | +Request allowed | +
Match Deny only | +Request denied | +Request denied | +
No match | +Default to second directive: Denied | +Default to second directive: Allowed | +
Match both Allow & Deny | +Final match controls: Denied | +Final match controls: Allowed | +
In the following example, all hosts in the apache.org domain are allowed access; all other hosts are denied access.
@@ -271,10 +309,9 @@ evaluated.In the next example, all hosts in the apache.org domain are - allowed access, except for the hosts which are in the - foo.apache.org subdomain, who are denied access. All hosts not - in the apache.org domain are denied access because the default - state is to deny access to the server.
+ allowed access, except for the hosts which are in the foo.apache.org + subdomain, who are denied access. All hosts not in the apache.org + domain are denied access because the default state is toDeny
access to the server.
Order Allow,Deny
@@ -282,20 +319,20 @@ evaluated.
Deny from foo.apache.org
On the other hand, if the Order
in the last
- example is changed to Deny,Allow
, all hosts will
- be allowed access. This happens because, regardless of the
- actual ordering of the directives in the configuration file,
- the Allow from apache.org
will be evaluated last
- and will override the Deny from foo.apache.org
.
- All hosts not in the apache.org
domain will also
- be allowed access because the default state will change to
- allow.
The presence of an Order
directive can affect
- access to a part of the server even in the absence of accompanying
- Allow
and Deny
directives because of its effect
- on the default access state. For example,
On the other hand, if the Order
in the
+ last example is changed to Deny,Allow
, all hosts will
+ be allowed access. This happens because, regardless of the actual
+ ordering of the directives in the configuration file, the
+ Allow from apache.org
will be evaluated last and will
+ override the Deny from foo.apache.org
. All hosts not in
+ the apache.org
domain will also be allowed access
+ because the default state is Allow
.
The presence of an Order
directive can
+ affect access to a part of the server even in the absence of
+ accompanying Allow
+ and Deny
directives
+ because of its effect on the default access state. For example,
<Directory /www>
@@ -305,20 +342,20 @@ evaluated.
</Directory>
will deny all access to the /www
directory
- because the default access state will be set to
- deny.
will Deny all access to the /www
directory
+ because the default access state is set to
+ Deny
.
The Order
directive controls the order of access
- directive processing only within each phase of the server's
+
The Order
directive controls the order of
+ access directive processing only within each phase of the server's
configuration processing. This implies, for example, that an
Allow
or Deny
directive occurring in a
- <Location>
section will
- always be evaluated after an Allow
or Deny
directive occurring in a
- <Directory>
section or
- .htaccess
file, regardless of the setting of the
- Order
directive. For details on the merging
- of configuration sections, see the documentation on How Directory, Location and Files sections
+ <Location>
section
+ will always be evaluated after an Allow
or Deny
directive occurring in a
+ <Directory>
+ section or .htaccess
file, regardless of the setting of
+ the Order
directive. For details on the
+ merging of configuration sections, see the documentation on How Directory, Location and Files sections
work.