Apache Module mod_authz_dbd

mod_dbd configuration DBDriver pgsql DBDParams "dbname=apacheauth user=apache pass=xxxxxx" DBDMin 4 DBDKeep 8 DBDMax 20 DBDExptime 300

mod_authn_core and mod_auth_basic configuration

for mod_authn_dbd AuthType Basic AuthName Team AuthBasicProvider dbd

mod_authn_dbd SQL query to authenticate a logged-in user AuthDBDUserPWQuery \ "SELECT password FROM authn WHERE user = %s AND login = 'true'"

mod_authz_core configuration for mod_authz_dbd Require dbd-group team

mod_authz_dbd configuration AuthzDBDQuery "SELECT group FROM authz WHERE user = %s"

when a user fails to be authenticated or authorized,

invite them to login; this page should provide a link

to /team-private/login.html ErrorDocument 401 /login-info.html

don't require user to already be logged in! AuthDBDUserPWQuery "SELECT password FROM authn WHERE user = %s"

dbd-login action executes a statement to log user in Require dbd-login AuthzDBDQuery "UPDATE authn SET login = 'true' WHERE user = %s"

return user to referring page (if any) after

successful login AuthzDBDLoginToReferer On

dbd-logout action executes a statement to log user out Require dbd-logout AuthzDBDQuery "UPDATE authn SET login = 'false' WHERE user = %s"

This module provides authorization capabilities so that authenticated users can be allowed or denied access to portions of the web site by group membership. Similar functionality is provided by

, with the exception that this module queries a SQL database to determine whether a user is a member of a group.modauthzdbm

This module can also provide database-backed user login/logout capabilities. These are likely to be of most value when used in conjunction with

to specify the backend database driver and connection parameters, and manage the database connections.mod_dbd

directives are used during the authorization phase to ensure that a user is allowed to access a resource. modauthzdbd extends the authorization types with Requiredbd-group

Since v2.4.8, expressions are supported within the DBD require directives.

This directive specifies group membership that is required for the user to gain access.

In addition to the standard authorization function of checking group membership, this module can also provide server-side user session management via database-backed login/logout capabilities. Specifically, it can update a user's session status in the database whenever the user visits designated URLs (subject of course to users supplying the necessary credentials).

This works by defining two special

. For usage details, see the configuration example below.

exports an optional hook that will be run whenever a user's status is updated in the database. Other session management modules can then use the hook to implement functions that start and end client-side sessions.modauthzdbd

directive, it specifies a query to look up groups for the current user. This is the standard functionality of other authorization modules such as modauthzgroupfile

. The first column value of each row returned by the query statement should be a string containing a group name. Zero, one, or more rows may be returned. Require dbd-group AuthzDBDQuery "SELECT group FROM groups WHERE user = %s"

directive, it will never deny access, but will instead execute a SQL statement designed to log the user in or out. The user must already be authenticated with modauthndbd

AuthzDBDRedirectQuery "SELECT userpage FROM userpages WHERE user = %s"

The first column value of the first row returned by the query statement should be a string containing a URL to which to redirect the client. Subsequent rows will be ignored. If no rows are returned, the client will not be redirected.

takes precedence if both are set.

Modules | Directives | FAQ | Glossary | Sitemap

Apache HTTP Server Version 2.4