mod_authnz_fcgi.html.en 26.8 KB
Newer Older
powelld's avatar
powelld committed
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
<!--
        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
              This file is generated from xml source: DO NOT EDIT
        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
      -->
<title>mod_authnz_fcgi - Apache HTTP Server Version 2.4</title>
<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" />
<script src="../style/scripts/prettify.min.js" type="text/javascript">
</script>

<link href="../images/favicon.ico" rel="shortcut icon" /></head>
<body>
<div id="page-header">
<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
<p class="apache">Apache HTTP Server Version 2.4</p>
<img alt="" src="../images/feather.png" /></div>
<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
<div id="path">
<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.4</a> &gt; <a href="./">Modules</a></div>
<div id="page-content">
<div id="preamble"><h1>Apache Module mod_authnz_fcgi</h1>
<div class="toplang">
<p><span>Available Languages: </span><a href="../en/mod/mod_authnz_fcgi.html" title="English">&nbsp;en&nbsp;</a></p>
</div>
<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Allows a FastCGI authorizer application to handle Apache
httpd authentication and authorization</td></tr>
<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr>
<tr><th><a href="module-dict.html#ModuleIdentifier">ModuleIdentifier:</a></th><td>authnz_fcgi_module</td></tr>
<tr><th><a href="module-dict.html#SourceFile">SourceFile:</a></th><td>mod_authnz_fcgi.c</td></tr>
<tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available in version 2.4.10 and later</td></tr></table>
<h3>Summary</h3>

    <p>This module allows FastCGI authorizer applications to
    authenticate users and authorize access to resources.  It supports
    generic FastCGI authorizers which participate in a single phase
    for authentication and authorization as well as Apache httpd-specific
    authenticators and authorizors which participate in one or both
    phases.</p>

    <p>FastCGI authorizers can authenticate using user id and password, 
    such as for Basic authentication, or can authenticate using arbitrary
    mechanisms.</p>
</div>
<div id="quickview"><a href="https://www.apache.org/foundation/contributing.html" class="badge"><img src="https://www.apache.org/images/SupportApache-small.png" alt="Support Apache!" /></a><h3>Topics</h3>
<ul id="topics">
<li><img alt="" src="../images/down.gif" /> <a href="#invocations">Invocation modes</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#examples">Additional examples</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#limitations">Limitations</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#logging">Logging</a></li>
</ul><h3 class="directives">Directives</h3>
<ul id="toc">
<li><img alt="" src="../images/down.gif" /> <a href="#authnzfcgicheckauthnprovider">AuthnzFcgiCheckAuthnProvider</a></li>
<li><img alt="" src="../images/down.gif" /> <a href="#authnzfcgidefineprovider">AuthnzFcgiDefineProvider</a></li>
</ul>
<h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&amp;list_id=144532&amp;product=Apache%20httpd-2&amp;query_format=specific&amp;order=changeddate%20DESC%2Cpriority%2Cbug_severity&amp;component=mod_authnz_fcgi">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&amp;component=mod_authnz_fcgi">Report a bug</a></li></ul><h3>See also</h3>
<ul class="seealso">
<li><a href="../howto/auth.html">Authentication, Authorization,
and Access Control</a></li>
<li><code class="module"><a href="../mod/mod_auth_basic.html">mod_auth_basic</a></code></li>
<li><code class="program"><a href="../programs/fcgistarter.html">fcgistarter</a></code></li>
<li><code class="module"><a href="../mod/mod_proxy_fcgi.html">mod_proxy_fcgi</a></code></li>
<li><a href="#comments_section">Comments</a></li></ul></div>
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="invocations" id="invocations">Invocation modes</a></h2>

    <p>The invocation modes for FastCGI authorizers supported by this 
    module are distinguished by two characteristics, <em>type</em> and
    auth <em>mechanism</em>.</p>

    <p><em>Type</em> is simply <code>authn</code> for authentication,
    <code>authz</code> for authorization, or <code>authnz</code> for
    combined authentication and authorization.</p>

    <p>Auth <em>mechanism</em> refers to the Apache httpd configuration
    mechanisms and processing phases, and can be <code>
    AuthBasicProvider</code>, <code>Require</code>, or <code>
    check_user_id</code>.  The first two of these
    correspond to the directives used to enable participation in the
    appropriate processing phase.</p>

    <p>Descriptions of each mode:</p>

    <dl>
      <dt><em>Type</em> <code>authn</code>, <em>mechanism</em>
      <code>AuthBasicProvider</code></dt>

      <dd>In this mode, 
      <code>FCGI_ROLE</code> is set to <code>AUTHORIZER</code> and
      <code>FCGI_APACHE_ROLE</code> is set to <code>AUTHENTICATOR</code>.
      The application must be defined as provider type <em>authn</em>
      using <code class="directive"><a href="#authnzfcgidefineprovider">
      AuthnzFcgiDefineProvider</a></code> and enabled with
      <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code>.
      When invoked, the application is
      expected to authenticate the client using the provided user id and
      password.  Example application:

<pre class="prettyprint lang-perl">#!/usr/bin/perl
use FCGI;
my $request = FCGI::Request();
while ($request-&gt;Accept() &gt;= 0) {
    die if $ENV{'FCGI_APACHE_ROLE'} ne "AUTHENTICATOR";
    die if $ENV{'FCGI_ROLE'}        ne "AUTHORIZER";
    die if !$ENV{'REMOTE_PASSWD'};
    die if !$ENV{'REMOTE_USER'};

    print STDERR "This text is written to the web server error log.\n";

    if ( ($ENV{'REMOTE_USER' } eq "foo" || $ENV{'REMOTE_USER'} eq "foo1") &amp;&amp;
        $ENV{'REMOTE_PASSWD'} eq "bar" ) {
        print "Status: 200\n";
        print "Variable-AUTHN_1: authn_01\n";
        print "Variable-AUTHN_2: authn_02\n";
        print "\n";
    }
    else {
        print "Status: 401\n\n";
    }
}</pre>


      Example configuration:
<pre class="prettyprint lang-config">AuthnzFcgiDefineProvider authn FooAuthn fcgi://localhost:10102/
&lt;Location "/protected/"&gt;
  AuthType Basic
  AuthName "Restricted"
  AuthBasicProvider FooAuthn
  Require ...
&lt;/Location&gt;</pre>

      </dd>

      <dt><em>Type</em> <code>authz</code>, <em>mechanism</em>
      <code>Require</code></dt>
      <dd>In this mode, <code>FCGI_ROLE</code> is set to <code>
      AUTHORIZER</code> and <code>FCGI_APACHE_ROLE</code> is set to
      <code>AUTHORIZER</code>.  The application must be defined as
      provider type <em>authz</em> using <code class="directive"><a href="#authnzfcgidefineprovider">
      AuthnzFcgiDefineProvider</a></code>.  When invoked, the application 
      is expected to authorize the client using the provided user id and other
      request data.  Example application:
<pre class="prettyprint lang-perl">#!/usr/bin/perl
use FCGI;
my $request = FCGI::Request();
while ($request-&gt;Accept() &gt;= 0) {
    die if $ENV{'FCGI_APACHE_ROLE'} ne "AUTHORIZER";
    die if $ENV{'FCGI_ROLE'}        ne "AUTHORIZER";
    die if $ENV{'REMOTE_PASSWD'};

    print STDERR "This text is written to the web server error log.\n";

    if ($ENV{'REMOTE_USER'} eq "foo1") {
        print "Status: 200\n";
        print "Variable-AUTHZ_1: authz_01\n";
        print "Variable-AUTHZ_2: authz_02\n";
        print "\n";
    }
    else {
        print "Status: 403\n\n";
    }
}</pre>


      Example configuration:
<pre class="prettyprint lang-config">AuthnzFcgiDefineProvider authz FooAuthz fcgi://localhost:10103/
&lt;Location "/protected/"&gt;
  AuthType ...
  AuthName ...
  AuthBasicProvider ...
  Require FooAuthz
&lt;/Location&gt;</pre>

      </dd>

      <dt><em>Type</em> <code>authnz</code>, <em>mechanism</em>
      <code>AuthBasicProvider</code> <em>+</em> <code>Require</code></dt>

      <dd>In this mode, which supports the web server-agnostic FastCGI
      <code>AUTHORIZER</code> protocol, <code>FCGI_ROLE</code> is set to
      <code>AUTHORIZER</code> and <code>FCGI_APACHE_ROLE</code> is not set.
      The application must be defined as provider type <em>authnz</em>
      using <code class="directive"><a href="#authnzfcgidefineprovider">
      AuthnzFcgiDefineProvider</a></code>.  The application is expected to
      handle both authentication and authorization in the same invocation
      using the user id, password, and other request data.  The invocation 
      occurs during the Apache httpd API authentication phase.  If the 
      application returns 200 and the same provider is invoked during the
      authorization phase (via <code class="directive">Require</code>), mod_authnz_fcgi
      will return success for the authorization phase without invoking the
      application.  Example application:
<pre class="prettyprint lang-perl">#!/usr/bin/perl
use FCGI;
my $request = FCGI::Request();
while ($request-&gt;Accept() &gt;= 0) {
    die if $ENV{'FCGI_APACHE_ROLE'};
    die if $ENV{'FCGI_ROLE'} ne "AUTHORIZER";
    die if !$ENV{'REMOTE_PASSWD'};
    die if !$ENV{'REMOTE_USER'};

    print STDERR "This text is written to the web server error log.\n";

    if ( ($ENV{'REMOTE_USER' } eq "foo" || $ENV{'REMOTE_USER'} eq "foo1") &amp;&amp;
        $ENV{'REMOTE_PASSWD'} eq "bar" &amp;&amp;
        $ENV{'REQUEST_URI'} =~ m%/bar/.*%) {
        print "Status: 200\n";
        print "Variable-AUTHNZ_1: authnz_01\n";
        print "Variable-AUTHNZ_2: authnz_02\n";
        print "\n";
    }
    else {
        print "Status: 401\n\n";
    }
}</pre>


      Example configuration:
<pre class="prettyprint lang-config">AuthnzFcgiDefineProvider authnz FooAuthnz fcgi://localhost:10103/
&lt;Location "/protected/"&gt;
  AuthType Basic
  AuthName "Restricted"
  AuthBasicProvider FooAuthnz
  Require FooAuthnz
&lt;/Location&gt;</pre>

      </dd>

      <dt><em>Type</em> <code>authn</code>, <em>mechanism</em>
      <code>check_user_id</code></dt>

      <dd>In this mode, <code>FCGI_ROLE</code> is set to <code>
      AUTHORIZER</code> and <code>FCGI_APACHE_ROLE</code> is set to
      <code>AUTHENTICATOR</code>.  The application must be defined as
      provider type <em>authn</em> using <code class="directive"><a href="#authnzfcgidefineprovider">
      AuthnzFcgiDefineProvider</a></code>.  <code class="directive"><a href="#authnzfcgicheckauthnprovider">AuthnzFcgiCheckAuthnProvider</a></code>
      specifies when it is called.  Example application:
<pre class="prettyprint lang-perl">#!/usr/bin/perl
use FCGI;
my $request = FCGI::Request();
while ($request-&gt;Accept() &gt;= 0) {
    die if $ENV{'FCGI_APACHE_ROLE'} ne "AUTHENTICATOR";
    die if $ENV{'FCGI_ROLE'} ne "AUTHORIZER";

    # This authorizer assumes that the RequireBasicAuth option of 
    # AuthnzFcgiCheckAuthnProvider is On:
    die if !$ENV{'REMOTE_PASSWD'};
    die if !$ENV{'REMOTE_USER'};

    print STDERR "This text is written to the web server error log.\n";

    if ( ($ENV{'REMOTE_USER' } eq "foo" || $ENV{'REMOTE_USER'} eq "foo1") &amp;&amp;
        $ENV{'REMOTE_PASSWD'} eq "bar" ) {
        print "Status: 200\n";
        print "Variable-AUTHNZ_1: authnz_01\n";
        print "Variable-AUTHNZ_2: authnz_02\n";
        print "\n";
    }
    else {
        print "Status: 401\n\n";
        # If a response body is written here, it will be returned to
        # the client.
    }
}</pre>


      Example configuration:
<pre class="prettyprint lang-config">AuthnzFcgiDefineProvider authn FooAuthn fcgi://localhost:10103/
&lt;Location "/protected/"&gt;
  AuthType ...
  AuthName ...
  AuthnzFcgiCheckAuthnProvider FooAuthn \
                               Authoritative On \
                               RequireBasicAuth Off \
                               UserExpr "%{reqenv:REMOTE_USER}"
  Require ...
&lt;/Location&gt;</pre>

      </dd>

    </dl>
    
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="examples" id="examples">Additional examples</a></h2>

  <ol>
    <li>If your application supports the separate authentication and
    authorization roles (<code>AUTHENTICATOR</code> and <code>AUTHORIZER</code>), define 
    separate providers as follows, even if they map to the same
    application:

<pre class="prettyprint lang-config">AuthnzFcgiDefineProvider authn  FooAuthn  fcgi://localhost:10102/
AuthnzFcgiDefineProvider authz  FooAuthz  fcgi://localhost:10102/</pre>


    Specify the authn provider on 
    <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code>
    and the authz provider on
    <code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code>:

<pre class="prettyprint lang-config">AuthType Basic
AuthName "Restricted"
AuthBasicProvider FooAuthn
Require FooAuthz</pre>

    </li>

    <li>If your application supports the generic <code>AUTHORIZER</code> role 
    (authentication and authorizer in one invocation), define a
    single provider as follows:

<pre class="prettyprint lang-config">AuthnzFcgiDefineProvider authnz FooAuthnz fcgi://localhost:10103/</pre>


    Specify the authnz provider on both <code class="directive">AuthBasicProvider</code>
    and <code class="directive">Require</code>:

<pre class="prettyprint lang-config">AuthType Basic
AuthName "Restricted"
AuthBasicProvider FooAuthnz
Require FooAuthnz</pre>

    </li>
</ol>
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="limitations" id="limitations">Limitations</a></h2>

    <p>The following are potential features which are not currently
    implemented:</p>

    <dl>
      <dt>Apache httpd access checker</dt>
      <dd>The Apache httpd API <em>access check</em> phase is a separate
      phase from authentication and authorization.  Some other FastCGI
      implementations implement this phase, which is denoted by the 
      setting of <code>FCGI_APACHE_ROLE</code> to <code>ACCESS_CHECKER</code>.</dd>

      <dt>Local (Unix) sockets or pipes</dt>
      <dd>Only TCP sockets are currently supported.</dd>

      <dt>Support for mod_authn_socache</dt>
      <dd>mod_authn_socache interaction should be implemented for
      applications which participate in Apache httpd-style
      authentication.</dd>

      <dt>Support for digest authentication using AuthDigestProvider</dt>
      <dd>This is expected to be a permanent limitation as there is
      no authorizer flow for retrieving a hash.</dd>

      <dt>Application process management</dt>
      <dd>This is expected to be permanently out of scope for
      this module.  Application processes must be controlled by
      other means.  For example, <code class="program"><a href="../programs/fcgistarter.html">fcgistarter</a></code> can be used to
      start them.</dd>

      <dt>AP_AUTH_INTERNAL_PER_URI</dt>
      <dd>All providers are currently registered as 
      AP_AUTH_INTERNAL_PER_CONF, which means that checks are not
      performed again for internal subrequests with the same
      access control configuration as the initial request.</dd>

      <dt>Protocol data charset conversion</dt>
      <dd>If mod_authnz_fcgi runs in an EBCDIC compilation
      environment, all FastCGI protocol data is written in EBCDIC
      and expected to be received in EBCDIC.</dd>

      <dt>Multiple requests per connection</dt>
      <dd>Currently the connection to the FastCGI authorizer is
      closed after every phase of processing.  For example, if the
      authorizer handles separate <em>authn</em> and <em>authz</em>
      phases then two connections will be used.</dd>

      <dt>URI Mapping</dt>
      <dd>URIs from clients can't be mapped, such as with the <code class="directive">
      ProxyPass</code> used with FastCGI responders.</dd>

    </dl>

</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="section">
<h2><a name="logging" id="logging">Logging</a></h2>

    <ol>
        <li>Processing errors are logged at log level <code>error</code>
        and higher.</li>
        <li>Messages written by the application are logged at log
        level <code>warn</code>.</li>
        <li>General messages for debugging are logged at log level
        <code>debug</code>.</li>
        <li>Environment variables passed to the application are
        logged at log level <code>trace2</code>. The value of the 
        <code>REMOTE_PASSWD</code> variable will be obscured,
        but <strong>any other sensitive data will be visible in the 
        log</strong>.</li>
        <li>All I/O between the module and the FastCGI application,
        including all environment variables, will be logged in printable
        and hex format at log level <code>trace5</code>.  <strong>All
        sensitive data will be visible in the log.</strong></li>
    </ol>

    <p><code class="directive"><a href="../mod/core.html#loglevel">LogLevel</a></code> can be used
    to configure a log level specific to mod_authnz_fcgi.  For
    example:</p>

<pre class="prettyprint lang-config">LogLevel info authnz_fcgi:trace8</pre>


</div>
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="directive-section"><h2><a name="AuthnzFcgiCheckAuthnProvider" id="AuthnzFcgiCheckAuthnProvider">AuthnzFcgiCheckAuthnProvider</a> <a name="authnzfcgicheckauthnprovider" id="authnzfcgicheckauthnprovider">Directive</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Enables a FastCGI application to handle the check_authn
authentication hook.</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthnzFcgiCheckAuthnProvider <em>provider-name</em>|<code>None</code>
<em>option</em> ...</code></td></tr>
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_fcgi</td></tr>
</table>
    <p>This directive is used to enable a FastCGI authorizer to
    handle a specific processing phase of authentication or
    authorization.</p>

    <p>Some capabilities of FastCGI authorizers require enablement
    using this directive instead of
    <code class="directive">AuthBasicProvider</code>:</p>

    <ul>
      <li>Non-Basic authentication; generally, determining the user
      id of the client and returning it from the authorizer; see the
      <code>UserExpr</code> option below</li>
      <li>Selecting a custom response code; for a non-200 response
      from the authorizer, the code from the authorizer will be the
      status of the response</li>
      <li>Setting the body of a non-200 response; if the authorizer
      provides a response body with a non-200 response, that body
      will be returned to the client; up to 8192 bytes of text are
      supported</li>
    </ul>

    <dl>
      <dt><em>provider-name</em></dt>
      <dd>This is the name of a provider defined with <code class="directive">
      AuthnzFcgiDefineProvider</code>.</dd>

      <dt><code>None</code></dt>
      <dd>Specify <code>None</code> to disable a provider enabled
      with this directive in an outer scope, such as in a parent
      directory.</dd>

      <dt><em>option</em></dt>
      <dd>The following options are supported:
      
      <dl>
         <dt>Authoritative On|Off (default On)</dt>
         <dd>This controls whether or not other modules are allowed
         to run when this module has a FastCGI authorizer configured
         and it fails the request.</dd>

         <dt>DefaultUser <em>userid</em></dt>
         <dd>When the authorizer returns success and <code>UserExpr</code>
         is configured and evaluates to an empty string (e.g., authorizer
         didn't return a variable), this value will be used as the user
         id.  This is typically used when the authorizer has a concept of
         guest, or unauthenticated, users and guest users are mapped to
         some specific user id for logging and other purposes.</dd>

         <dt>RequireBasicAuth On|Off (default Off)</dt>
         <dd>This controls whether or not Basic auth is required
         before passing the request to the authorizer.  If required,
         the authorizer won't be invoked without a user id and
         password; 401 will be returned for a request without that.</dd>

         <dt>UserExpr <em>expr</em> (no default)</dt>
         <dd>When Basic authentication isn't provided by the client
         and the authorizer determines the user, this expression,
         evaluated after calling the authorizer, determines the
         user.  The expression follows <a href="../expr.html">
         ap_expr syntax</a> and must resolve to a string.  A typical
         use is to reference a <code>Variable-<em>XXX</em></code> 
         setting returned by the authorizer using an option like
         <code>UserExpr "%{reqenv:<em>XXX</em>}"</code>.  If
         this option is specified and the user id can't be retrieved
         using the expression after a successful authentication, the
         request will be rejected with a 500 error.</dd>

       </dl>
      </dd>
     </dl>

</div>
<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
<div class="directive-section"><h2><a name="AuthnzFcgiDefineProvider" id="AuthnzFcgiDefineProvider">AuthnzFcgiDefineProvider</a> <a name="authnzfcgidefineprovider" id="authnzfcgidefineprovider">Directive</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Defines a FastCGI application as a provider for
authentication and/or authorization</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthnzFcgiDefineProvider <em>type</em> <em>provider-name</em>
<em>backend-address</em></code></td></tr>
<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authnz_fcgi</td></tr>
</table>
    <p>This directive is used to define a FastCGI application as
    a provider for a particular phase of authentication or
    authorization.</p>

    <dl>
      <dt><em>type</em></dt>
      <dd>This must be set to <em>authn</em> for authentication,
      <em>authz</em> for authorization, or <em>authnz</em> for
      a generic FastCGI authorizer which performs both checks.</dd>

      <dt><em>provider-name</em></dt>
      <dd>This is used to assign a name to the provider which is
      used in other directives such as 
      <code class="directive"><a href="../mod/mod_auth_basic.html#authbasicprovider">AuthBasicProvider</a></code>
      and 
      <code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code>.</dd>

      <dt><em>backend-address</em></dt>
      <dd>This specifies the address of the application, in the form
      <em>fcgi://hostname:port/</em>.  The application process(es)
      must be managed independently, such as with
      <code class="program"><a href="../programs/fcgistarter.html">fcgistarter</a></code>.</dd>
    </dl>

</div>
</div>
<div class="bottomlang">
<p><span>Available Languages: </span><a href="../en/mod/mod_authnz_fcgi.html" title="English">&nbsp;en&nbsp;</a></p>
</div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
<script type="text/javascript"><!--//--><![CDATA[//><!--
var comments_shortname = 'httpd';
var comments_identifier = 'http://httpd.apache.org/docs/2.4/mod/mod_authnz_fcgi.html';
(function(w, d) {
    if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
        d.write('<div id="comments_thread"><\/div>');
        var s = d.createElement('script');
        s.type = 'text/javascript';
        s.async = true;
        s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
        (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
    }
    else { 
        d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
    }
})(window, document);
//--><!]]></script></div><div id="footer">
<p class="apache">Copyright 2017 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
<p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
if (typeof(prettyPrint) !== 'undefined') {
    prettyPrint();
}
//--><!]]></script>
</body></html>