Commit f1e16440 authored by Bradley Nicholes's avatar Bradley Nicholes
Browse files

Remove the references to all of the AuthzXXXAuthoritative directives in the... 

Remove the references to all of the AuthzXXXAuthoritative directives in the documentation since these directives no longer exist

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/authz-dev@366519 13f79535-47bb-0310-9956-ffa450edef68
parent ec859ea5

docs/manual/mod/mod_authn_alias.xml

+0 −1
Original line number Diff line number Diff line
@@ -76,7 +76,6 @@ 
    

         AuthType Basic<br />

         AuthName LDAP_Protected_Place<br />

         AuthzLDAPAuthoritative off<br />

         require valid-user<br />

      </indent>

      &lt;/Directory&gt;<br />

docs/manual/mod/mod_authnz_ldap.xml

+1 −29
Original line number Diff line number Diff line
@@ -301,9 +301,7 @@ for HTTP Basic authentication.</description> 
    <p>If this directive exists, <module>mod_authnz_ldap</module> grants

    access to any user that has successfully authenticated during the

    search/bind phase.  Requires that <module>mod_authz_user</module> be 

    loaded and that the 

    <directive module="mod_authnz_ldap">AuthzLDAPAuthoritative</directive>

    directive be set to off.</p>

    loaded.</p>

</section>



<section id="requser"><title>require ldap-user</title>
@@ -573,17 +571,10 @@ require valid-user 
    that gets created in the web</p>

<example><pre>

AuthLDAPURL            "the url"

AuthzLDAPAuthoritative off

AuthGroupFile <em>mygroupfile</em>

require group <em>mygroupfile</em>

</pre></example>



    <p><directive module="mod_authnz_ldap">AuthzLDAPAuthoritative</directive> 

    must be off to allow <module>mod_authnz_ldap</module> to decline group

    authentication so that Apache will fall back to file

    authentication for checking group membership. This allows the

    FrontPage-managed group file to be used.</p>



<section id="howitworks"><title>How It Works</title>



    <p>FrontPage restricts access to a web by adding the <code>require
@@ -643,25 +634,6 @@ require group <em>mygroupfile</em> 
</section>

</section>



<directivesynopsis>

<name>AuthzLDAPAuthoritative</name>

<description>Prevent other authentication modules from

authenticating the user if this one fails</description>

<syntax>AuthzLDAPAuthoritative on|off</syntax>

<default>AuthzLDAPAuthoritative on</default>

<contextlist><context>directory</context><context>.htaccess</context>

</contextlist>

<override>AuthConfig</override>



<usage>

    <p>Set to <code>off</code> if this module should let other

    authentication modules attempt to authenticate the user, should

    authentication with this module fail. Control is only passed on

    to lower modules if there is no DN or rule that matches the

    supplied user name (as passed by the client).</p>

</usage>

</directivesynopsis>



<directivesynopsis>

<name>AuthLDAPBindDN</name>

<description>Optional DN to use in binding to the LDAP server</description>

docs/manual/mod/mod_authz_dbd.xml

+0 −36
Original line number Diff line number Diff line
@@ -182,40 +182,4 @@ header is present</description> 
</usage>

</directivesynopsis>



<directivesynopsis>

<name>AuthzDBDAuthoritative</name>

<description>Sets whether authorization will be passed on to lower level

modules</description>

<syntax>AuthzDBDAuthoritative On|Off</syntax>

<default>AuthzDBDAuthoritative On</default>

<contextlist><context>directory</context></contextlist>



<usage>

    <p>Setting the <directive>AuthzDBDAuthoritative</directive>

    directive explicitly to <code>Off</code> allows group authorization

    to be handled by another authz module if the userID is not

    in any authorized dbd-group. If there are any groups

    specified, the usual checks will be applied and a failure will

    give an Authentication Required reply.</p>



    <p>So if a userID appears in the database of more than one module;

    or if a valid <directive module="core">Require</directive>

    directive applies to more than one module; then the first module

    will verify the credentials; and no access is passed on;

    regardless of the <directive>AuthAuthoritative</directive> setting.</p>



    <p>A common use for this is in conjunction with one of the

    auth providers; such or

    <module>mod_authn_file</module>. Whereas this DBD module supplies

    the bulk of the user credential checking; a few (administrator) related

    accesses fall through to a lower level with a well protected

    <code>.htpasswd</code> file.</p>



    <p>By default, control is not passed on and an unknown group

    will result in an Authentication Required reply. Not

    setting it thus keeps the system secure and forces an NCSA

    compliant behaviour.</p>

</usage>

</directivesynopsis>



</modulesynopsis>

docs/manual/mod/mod_authz_dbm.xml

+0 −47
Original line number Diff line number Diff line
@@ -119,51 +119,4 @@ store list of user groups</description> 
</usage>

</directivesynopsis>



<directivesynopsis>

<name>AuthzDBMAuthoritative</name>

<description>Sets whether authorization will be passed on to lower level

modules</description>

<syntax>AuthzDBMAuthoritative On|Off</syntax>

<default>AuthzDBMAuthoritative On</default>

<contextlist><context>directory</context><context>.htaccess</context>

</contextlist>

<override>AuthConfig</override>



<usage>

    <p>Setting the <directive>AuthzDBMAuthoritative</directive>

    directive explicitly to <code>Off</code> allows group authorization

    to be passed on to lower level modules (as defined in the

    <code>modules.c</code> file) if there is no group found

    for the the supplied userID. If there are any groups

    specified, the usual checks will be applied and a failure will

    give an Authentication Required reply.</p>



    <p>So if a userID appears in the database of more than one module;

    or if a valid <directive module="core">Require</directive>

    directive applies to more than one module; then the first module

    will verify the credentials; and no access is passed on;

    regardless of the <directive>AuthAuthoritative</directive> setting.</p>



    <p>A common use for this is in conjunction with one of the

    auth providers; such as <module>mod_authn_dbm</module> or

    <module>mod_authn_file</module>. Whereas this DBM module supplies

    the bulk of the user credential checking; a few (administrator) related

    accesses fall through to a lower level with a well protected

    <code>.htpasswd</code> file.</p>



    <p>By default, control is not passed on and an unknown group

    will result in an Authentication Required reply. Not

    setting it thus keeps the system secure and forces an NCSA

    compliant behaviour.</p>



    <note type="warning"><title>Security</title>

      <p>Do consider the implications of allowing a user to

      allow fall-through in his .htaccess file; and verify that this

      is really what you want; Generally it is easier to just secure

      a single <code>.htpasswd</code> file, than it is to secure a

      database which might have more access interfaces.</p>

    </note>

</usage>

</directivesynopsis>



</modulesynopsis>

docs/manual/mod/mod_authz_groupfile.xml

+0 −32
Original line number Diff line number Diff line
@@ -75,36 +75,4 @@ of user groups for authorization</description> 
</usage>

</directivesynopsis>



<directivesynopsis>

<name>AuthzGroupFileAuthoritative</name>

<description>Sets whether authorization will be passed on to lower level

modules</description>

<syntax>AuthzGroupFileAuthoritative On|Off</syntax>

<default>AuthzGroupFileAuthoritative On</default>

<contextlist><context>directory</context><context>.htaccess</context>

</contextlist>

<override>AuthConfig</override>



<usage>

    <p>Setting the <directive>AuthzGroupFileAuthoritative</directive>

    directive explicitly to <code>Off</code> allows for

    group authorization to be passed on to lower level modules (as defined

    in the <code>modules.c</code> files) if there is <strong>no

    group</strong> matching the supplied userID.</p>



    <p>By default, control is not passed on and an unknown group

    will result in an Authentication Required reply. Not

    setting it thus keeps the system secure and forces an NCSA

    compliant behaviour.</p>



    <note type="warning"><title>Security</title>

      <p>Do consider the implications of allowing a user to

      allow fall-through in his <code>.htaccess</code> file; and verify

      that this is really what you want; Generally it is easier to just

      secure a single <code>.htpasswd</code> file, than it is to secure

      a database which might have more access interfaces.</p>

    </note>

</usage>

</directivesynopsis>



</modulesynopsis>