[9fans] httpd/magic and authentication

[9fans] httpd/magic and authentication

[Skip Tavakkolian]

has anyone done any cgi's that enforce digest authentication?

i need it to enforce access control to some content that needs to be
accessible by none; along these lines:

http://groups.google.com/group/comp.os.plan9/browse_thread/thread/2d0acef2e2b85d5e/8166f4c14b6f9107?q=httpd+authentication&rnum=3#8166f4c14b6f9107

Re: [9fans] httpd/magic and authentication

[arisawa]

Hello,

I have been hesitated to support digest authentication in Pegasus  
(another httpd for Plan9),
because I have been suspicious  that digest authentication is not  
widely supported by browsers.
If recent browsers are supporting digest authentication, I will try  
to support it in Pegasus.

By the way, I don't think digest authentication is useful in case we  
want to protect some web contents from local users or other person's  
CGI.
Look
http://plan9.aichi-u.ac.jp/pegasus/eman-2.0/
http://plan9.aichi-u.ac.jp/pegasus/eman-2.1/
for the solution.

Kenji Arisawa


On 2006/05/27, at 4:37, Skip Tavakkolian wrote:

> has anyone done any cgi's that enforce digest authentication?
>
> i need it to enforce access control to some content that needs to be
> accessible by none; along these lines:
>
> http://groups.google.com/group/comp.os.plan9/browse_thread/thread/ 
> 2d0acef2e2b85d5e/8166f4c14b6f9107?q=httpd 
> +authentication&rnum=3#8166f4c14b6f9107
>

Re: [9fans] httpd/magic and authentication

[Skip Tavakkolian]

Thanks.

> By the way, I don't think digest authentication is useful in case we  
> want to protect some web contents from local users or other person's  
> CGI.

i noticed httpdigest proto has been added to factotum.  one of the
suggestions in the old thread was for each user to run its own httpd.
combining this with a change to the 'who' handler to redirect a ~user
request to the user's httpd (port↔user mapping) should do it.  each
user's own httpd (probably with ssl) then challenges all incoming
requests against his/her own factotum which would have a server side
secret for httpdigest proto.

> http://plan9.aichi-u.ac.jp/pegasus/eman-2.0/
> http://plan9.aichi-u.ac.jp/pegasus/eman-2.1/

I was able to look at 2.0 version but not 2.1.

Re: [9fans] httpd/magic and authentication

[arisawa]

Hello,

> i noticed httpdigest proto has been added to factotum.

I didn't noticed that.
The latest manual factotum(4) says nothing about httpdigest.

What browsers do you recommend to test http digest authentication ?
Mozilla is the best ?


>
>> http://plan9.aichi-u.ac.jp/pegasus/eman-2.0/
>> http://plan9.aichi-u.ac.jp/pegasus/eman-2.1/
>>
>
> I was able to look at 2.0 version but not 2.1.
>

You might have been very unlucky because my sever was powered off
while a short time for maintenance.

Kenji Arisawa

Re: [9fans] httpd/magic and authentication

[Skip Tavakkolian]

> What browsers do you recommend to test http digest authentication ?
> Mozilla is the best ?

i've not verified this, but presumably all popular browsers
support it.  according to apache 2.2 docs:

	"As of September 2004, major browsers that support digest
	authentication include Amaya, Konqueror, MS Internet Explorer
	for Mac OS X and Windows (although the Windows version fails
	when used with a query string -- see "Working with MS Internet
	Explorer" below for a workaround), Mozilla, Netscape 7, Opera,
	and Safari."

http://httpd.apache.org/docs/2.2/mod/mod_auth_digest.html

Re: [9fans] httpd/magic and authentication

[Skip Tavakkolian]

>> i noticed httpdigest proto has been added to factotum.
> The latest manual factotum(4) says nothing about httpdigest.

it's in sources.  but i read it again; server side is not
implemented :(

/sys/src/cmd/auth/factotum/httpdigest.c

Re: [9fans] httpd/magic and authentication

[arisawa]

Thanks for your information.
I will try to implement.

Kenji Arisawa

On 2006/05/28, at 0:41, Skip Tavakkolian wrote:

>> What browsers do you recommend to test http digest authentication ?
>> Mozilla is the best ?
>
> i've not verified this, but presumably all popular browsers
> support it.  according to apache 2.2 docs:
>
> 	"As of September 2004, major browsers that support digest
> 	authentication include Amaya, Konqueror, MS Internet Explorer
> 	for Mac OS X and Windows (although the Windows version fails
> 	when used with a query string -- see "Working with MS Internet
> 	Explorer" below for a workaround), Mozilla, Netscape 7, Opera,
> 	and Safari."
>
> http://httpd.apache.org/docs/2.2/mod/mod_auth_digest.html
>