Some more backports of information from trunk that applies to 2.2 as well.

<manualpage metafile="auth.xml.meta">

<parentdocument href="./">How-To / Tutorials</parentdocument>

<title>Authentication, Authorization and Access Control</title>

<title>Authentication and Authorization</title>

<summary>

    <p>Authentication is any process by which you verify that

    someone is who they claim they are. Authorization is any

    process by which someone is allowed to be where they want to

    go, or to have information that they want to have.</p>

    <p>For general access control, see the <a href="access.html">Access

    Control How-To</a>.</p>

</summary>

<section id="related"><title>Related Modules and Directives</title>

<ul>

  <li>Authentication type (see the

      <directive module="core">AuthType</directive> directive)

      <directive module="mod_authn_core">AuthType</directive> directive)

    <ul>

      <li><module>mod_auth_basic</module></li>

      <li><module>mod_auth_digest</module></li>

    </ul>

  </li>

  <li>Authentication provider

  <li>Authentication provider (see the

  <directive module="mod_auth_basic">AuthBasicProvider</directive> and

  <directive module="mod_auth_digest">AuthDigestProvider</directive> directives)

    <ul>

      <li><module>mod_authn_alias</module></li>

      <li><module>mod_authn_anon</module></li>

      <li><module>mod_authn_dbd</module></li>

      <li><module>mod_authn_dbm</module></li>

      <li><module>mod_authn_default</module></li>

      <li><module>mod_authn_file</module></li>

      <li><module>mod_authnz_ldap</module></li>

      <li><module>mod_authn_socache</module></li>

    </ul>

  </li>

  <li>Authorization (see the

      <directive module="core">Require</directive> directive)

      <directive module="mod_authz_core">Require</directive> directive)

    <ul>

      <li><module>mod_authnz_ldap</module></li>

      <li><module>mod_authz_dbd</module></li>

      <li><module>mod_authz_dbm</module></li>

      <li><module>mod_authz_default</module></li>

      <li><module>mod_authz_groupfile</module></li>

      <li><module>mod_authz_host</module></li>

      <li><module>mod_authz_owner</module></li>

      <li><module>mod_authz_user</module></li>

    </ul>

    structure of your server, in order to know where some files are

    kept. This should not be terribly difficult, and I'll try to

    make this clear when we come to that point.</p>

    <p>You will also need to make sure that the modules

    <module>mod_authn_core</module> and <module>mod_authz_core</module>

    have either been built into the httpd binary or loaded by the

    httpd.conf configuration file. Both of these modules provide core

    directives and functionality that are critical to the configuration

    and use of authentication and authorization in the web server.</p>

</section>

<section id="gettingitworking"><title>Getting it working</title>

    >mod_auth_digest</module> and is much more secure. Most recent

    browsers support Digest authentication.</p>

    <p>The <directive module="core">AuthName</directive> directive sets

    <p>The <directive module="mod_authn_core">AuthName</directive> directive sets

    the <dfn>Realm</dfn> to be used in the authentication. The realm serves

    two major functions. First, the client often presents this information to

    the user as part of the password dialog box. Second, it is used by the

    href="http://modules.apache.org/">Apache Modules

    Database</a>.</p>

    <p>Finally, the <directive module="core">Require</directive>

    <p>Finally, the <directive module="mod_authz_core">Require</directive>

    directive provides the authorization part of the process by

    setting the user that is allowed to access this region of the

    server. In the next section, we discuss various ways to use the

    need to have Apache configured to permit CGI execution. There

    are several ways to do this.</p>

    <note type="warning">Note: If Apache has been built with shared module

    support you need to ensure that the module is loaded; in your

    <code>httpd.conf</code> you need to make sure the

    <directive module="mod_so">LoadModule</directive>

    directive has not been commented out.  A correctly configured directive

    may look like this:

    <highlight language="config">

      LoadModule cgi_module modules/mod_cgi.so

    </highlight></note>

    <section id="scriptalias">

      <title>ScriptAlias</title>

      <p>Make sure that this is in fact the path to the

      interpreter.</p>

      <p>In addition, if your CGI program depends on other <a

      href="#env">environment variables</a>, you will need to

      assure that those variables are passed by Apache.</p>

      <note type="warning">

      When editing CGI scripts on Windows, end-of-line characters may be

      appended to the interpreter path. Ensure that files are then

      unrecognized end-of-line character being interpreted as a part of

      the interpreter filename.

      </note>

    </section>

    <section id="missingenv">

      <title>Missing environment variables</title>

      <p>If your CGI program depends on non-standard <a

      href="#env">environment variables</a>, you will need to

      assure that those variables are passed by Apache.</p>

      <p>When you miss HTTP headers from the environment, make

      sure they are formatted according to

      <a href="http://tools.ietf.org/html/rfc2616">RFC 2616</a>,

      section 4.2: Header names must start with a letter,

      followed only by letters, numbers or hyphen. Any header

      violating this rule will be dropped silently.</p>

    </section>