The Auth DBAPI module deals with two phases of Apache's processing sequence. The Authorization and Authentication phases. Users of the Auth DBAPI module can use either or both of these phases.
The following steps are taken when authenticating a user:
If there was no password field specified in the AuthDBAPI_Layout directive, the authentication stops, and other Apache modules are given the chance to authenticate.
The database is queried for a row with the user field matching the one given by the client.
If the user was not found in the database, one of two things can occur:
If AuthDBAPI_Authoritative is on, the user is denied access.
If AuthDBAPI_Authoritative is off, the other Apache authentication modules are given a chance to authenticate the user.
The given password is checked against the value in the password field in the row using the scheme specified by AuthDBAPI_PasswdFormat.
If the passwords do not match, the user is denied access.
For authentication in Apache to occur, either the httpd.conf file or the .htaccess files must have a require directive specified. Require directives usually look like:
require user jtravis |
require valid-user |
require group boffo |
If there was no group field specified in the AuthDBAPI_Layout directive, the authorization stops, and other Apache modules are given the chance to authorize.
The database is queried for the user that authorization is being requested for.
If the user was not found in the database, one of two things can occur:
If AuthDBAPI_Authoritative is on, the user is denied access.
If AuthDBAPI_Authoritative is off, the other Apache authentication modules are given a chance to authenticate the user.
The groups fetched from the database are split via commas. If the group from the require line matches any of the groups from the database row, the user is allowed to proceed. Otherwise he is denied access.