by I have a fairly low-security server where I want to set up a
hybrid authorization system. People with assigned userids and
passwords can log in, while other people can do an anonymous
login with a standard userid. This is sort of like the way
FTP works. Scripts would check the REMOTE_USER to see what
level of privilege should be allowed.
I thought I could do this by combining my normal auth
(mod_auth_mysql if it makes a difference) with Anonymous
and using "satisfy any". Instead it just lets anyone in
without checking for authorization.
Here's the relevant section of the httpd.conf file:
<Directory /path/protected>
Options Indexes FollowSymLinks
AuthName "Our Group"
AuthType Basic
Auth_MySQL_Password_Table people
Auth_MySQL_Group_Table people
Auth_MySQL_Username_Field userid
Auth_MySQL_Empty_Passwords off
Auth_MySQL_Encryption_Types MySQL Crypt_DES
Auth_MySQL on
order deny,allow
require group ourgroup
Anonymous anon
Anonymous_MustGiveEmail on
Anonymous_LogEmail on
satisfy any
</Directory>
The MySQL stuff has been working for ages. I just added
the Anonymous and satisfy lines.
--
* Patrick L. Nolan *
* W. W. Hansen Experimental Physics Laboratory (HEPL) *
* Stanford University *