mod_perl authentication and messages

BigLug has asked for the wisdom of the Perl Monks concerning the following question:

I'm using mod_perl to do basic authentication on apache. I tried using mod_auth_mysql but the newer version won't compile against an older apache, and the older version didn't allow anything but usernames and passwords. I need to check other flags.

As I need to check other flags, I'd like to give the users messages in the AuthName. Is it possible to change the AuthName at runtime? Or can it only be set in the config?

My AuthName begins as "Enter your serial number and password", but if they enter those correctly but have not paid, I'd like to change it to something along the lines of "Your serial number and password are correct. Please pay in order to enter the support area."

Update: I should point out that the authentication is all working without any problems. I'm just looking for a way to change the AuthName.

Cheers!
Rick
If this is a root node: Before responding, please ensure your clue bit is set.
If this is a reply: This is a discussion group, not a helpdesk ... If the discussion happens to answer a question you've asked, that's incidental.

Comment on mod_perl authentication and messages

Replies are listed 'Best First'.
Re: mod_perl authentication and messages by johnnywang (Priest) on Dec 15, 2004 at 05:38 UTC
Not sure about your problem, I use Apache::AuthDBI for my basic authentication, didn't have any problem with it. If you want to only allow paid users, you can certainly put it in the "where" class in the SQL statement (for AuthDBI, it is Auth_DBI_pwd_whereclass). I'm not sure whether you can change the message dynamiclly in Basic Authentication.	[reply]
Re: mod_perl authentication and messages by r11132a (Scribe) on Dec 15, 2004 at 13:42 UTC
If I'm understanding your question correctly, you might be able to change the AuthName on the fly if you put your authentication in .htaccess files in the directory (as opposed to the global httpd.conf file). However, you then run the risk of someone who has paid logging into that directory at the wrong time and also getting the "not paid" message. Off the top of my head, I would say your best bet is to try to alert the users of non-payment, would be to redirect them to an alternate "error" page when you decline their authorization.	[reply]