From: Stefan Fritsch Date: Thu, 30 Sep 2010 17:37:55 +0000 (+0000) Subject: add a bit of doc for the new authz providers X-Git-Tag: 2.3.9~382 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b2a906c8afea7ebec1d7e6c248e5c6bdc541d38b;p=thirdparty%2Fapache%2Fhttpd.git add a bit of doc for the new authz providers git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1003180 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/mod/mod_authz_core.html.en b/docs/manual/mod/mod_authz_core.html.en index 70d8eb2278c..dbb92ace8fe 100644 --- a/docs/manual/mod/mod_authz_core.html.en +++ b/docs/manual/mod/mod_authz_core.html.en @@ -247,6 +247,21 @@ +

Require expr

+ +

The expr provider allows to base authorization + decisions on arbitrary expressions.

+ +

+ Require expr %{TIME_HOUR} >= 9 & %{TIME_HOUR} <= 17
+

+ +

TODO: Include a link to a description of the ap_expr syntax, once we have + such a description.

+ + + +
top

AuthMerging Directive

@@ -374,6 +389,9 @@ an authorization provider.
Require method http-method [http-method] ...
Access is allowed only for the given HTTP methods.
+ +
Require expr expression
+
Access is allowed if expression evaluates to true.

Some of the allowed syntaxes provided by mod_authz_user @@ -395,8 +413,8 @@ an authorization provider.

Other authorization modules that implement require options include mod_authnz_ldap, mod_authz_dbm, mod_authz_dbd, - mod_authz_host, and - mod_authz_owner.

+ mod_authz_host, + mod_authz_owner and mod_ssl.

In most cases, for a complete authentication and authorization configuration, Require must be accompanied by diff --git a/docs/manual/mod/mod_authz_core.xml b/docs/manual/mod/mod_authz_core.xml index 29afa25d56f..1a29a8d693a 100644 --- a/docs/manual/mod/mod_authz_core.xml +++ b/docs/manual/mod/mod_authz_core.xml @@ -232,6 +232,21 @@ +

Require expr + +

The expr provider allows to base authorization + decisions on arbitrary expressions.

+ + + Require expr %{TIME_HOUR} >= 9 & %{TIME_HOUR} <= 17
+ + +

TODO: Include a link to a description of the ap_expr syntax, once we have + such a description.

+ +
+ + @@ -265,6 +280,9 @@ an authorization provider.
Require method http-method [http-method] ...
Access is allowed only for the given HTTP methods.
+ +
Require expr expression
+
Access is allowed if expression evaluates to true.

Some of the allowed syntaxes provided by mod_authz_user @@ -286,8 +304,8 @@ an authorization provider.

Other authorization modules that implement require options include mod_authnz_ldap, mod_authz_dbm, mod_authz_dbd, - mod_authz_host, and - mod_authz_owner.

+ mod_authz_host, + mod_authz_owner and mod_ssl.

In most cases, for a complete authentication and authorization configuration, Require must be accompanied by diff --git a/docs/manual/mod/mod_ssl.html.en b/docs/manual/mod/mod_ssl.html.en index d5702c3e6ef..10b2be413bd 100644 --- a/docs/manual/mod/mod_ssl.html.en +++ b/docs/manual/mod/mod_ssl.html.en @@ -92,6 +92,7 @@ to provide the cryptography engine.

  • Environment Variables
  • Custom Log Formats
  • Request Notes
    • +
  • Authorization providers for use with Require
    • top
    @@ -237,6 +238,42 @@ string in mod_log_conf for the current connection, the note is not set. +
    top
    +
    +

    Authorization providers for use with Require

    + +

    mod_ssl provides a few authentication providers for use + with mod_authz_core's + Require directive.

    + +

    Require ssl

    + +

    The ssl provider denies access if a connection is not + encrypted with SSL. This is similar to the + SSLRequireSSL directive.

    + +

    + Require ssl +

    + + + +

    Require ssl-verify-client

    + +

    The ssl provider allows access if the user is + authenticated with a valid client certificate. This is only + useful if SSLVerifyClient optional is in effect.

    + +

    The following example grants access if the user is authenticated + either with a client certificate or by username and password.

    + +

    + Require ssl-verify-client
    + Require valid-user +

    + + +
    top

    SSLCACertificateFile Directive

    @@ -1535,12 +1572,6 @@ This directive specifies a general access requirement which has to be fulfilled in order to allow access. It is a very powerful directive because the requirement specification is an arbitrarily complex boolean expression containing any number of access checks.

    -
    -

    The implementation of SSLRequire is not thread safe. - Using SSLRequire inside .htaccess files - on a threaded MPM may cause random crashes. -

    -

    The expression must match the following syntax (given as a BNF grammar notation):

    diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml index b126d606724..403193ea681 100644 --- a/docs/manual/mod/mod_ssl.xml +++ b/docs/manual/mod/mod_ssl.xml @@ -189,6 +189,42 @@ string in mod_log_config.

    +
    Authorization providers for use with Require + +

    mod_ssl provides a few authentication providers for use + with mod_authz_core's + Require directive.

    + +
    Require ssl + +

    The ssl provider denies access if a connection is not + encrypted with SSL. This is similar to the + SSLRequireSSL directive.

    + + + Require ssl + + +
    + +
    Require ssl-verify-client + +

    The ssl provider allows access if the user is + authenticated with a valid client certificate. This is only + useful if SSLVerifyClient optional is in effect.

    + +

    The following example grants access if the user is authenticated + either with a client certificate or by username and password.

    + + + Require ssl-verify-client
    + Require valid-user +     + +
    + +
    + SSLPassPhraseDialog Type of pass phrase dialog for encrypted private @@ -1192,12 +1228,6 @@ This directive specifies a general access requirement which has to be fulfilled in order to allow access. It is a very powerful directive because the requirement specification is an arbitrarily complex boolean expression containing any number of access checks.

    - -

    The implementation of SSLRequire is not thread safe. - Using SSLRequire inside .htaccess files - on a threaded MPM may cause random crashes. -

    -

    The expression must match the following syntax (given as a BNF grammar notation):