This chapter is from the book
This chapter is from the book
This chapter is from the book
Client Authentication
You authenticate users of your Web site for tracking or authorization purposes. The HTTP specification provides two authentication mechanisms: basic and digest. In both cases, the process is the following:
A client tries to access restricted content in the Web server.
Apache checks whether the client is providing a username and password. If not, Apache returns an HTTP 401 status code, indicating user authentication is required.
The client reads the response and prompts the user for the required username and password (usually with a pop-up window).
The client retries accessing the Web page, this time transmitting the username and password as part of the HTTP request. The client remembers the username and password and transmits them in later requests to the same site, so the user does not need to retype them for every request.
Apache checks the validity of the credentials and grants or denies access based on the user identity and other access rules.
In basic authentication, the username and password are transmitted in clear text, as part of the HTTP request headers. This poses a security risk because an attacker could easily peek at the conversation between server and browser, learn the username and password, and reuse them freely afterwards.
Digest authentication provides increased security because it transmits a digest instead of the clear text password. The digest is based on a combination of several parameters, including the username, password, and request method. The server can calculate the digest on its own and check that the client knows the password, even when the password itself is not transmitted over the network.
NOTE
A digest algorithm is a mathematical operation that takes a text and returns another text, a digest, which uniquely identifies the original one. A good digest algorithm should make sure that, at least for practical purposes, different input texts produce different digests and that the original input text cannot be derived from the digest. MD5 is the name of a commonly used digest algorithm.
Unfortunately, although the specification has been available for quite some time, only very recent browsers (Internet Explorer 5, Opera 4.0, Konqueror) support digest authentication. This means that for practical purposes, digest authentication is restricted to scenarios in which you have control over the browser software of your clients, such as in a company intranet.
In any case, for both digest and basic authentication, the requested information itself is transmitted unprotected over the network. A better choice to secure access to your Web site involves using the HTTP over SSL protocol, as described in Hour 17, "Setting Up a Secure Server."
User Management
When the authentication module receives the username and password from the client, it needs to verify that they are valid against an existing repository of users. The usernames and passwords can be stored in a variety of backends. Apache bundles support for file- and database-based authentication mechanisms. Third-party modules provide support for additional mechanisms such as LDAP (Lightweight Directory Access Protocol) and NIS (Network Information Services) .