Which means for me, I need to separate authentication into its own piece of code and call it from Apache as an AuthHandler, right.
Thanks! | [reply] |
Or you could use form-based authentication.
| [reply] |
That would solve the data-sharing problems (see below) but isn't feasible in a scenario which relies on standards like Basic/Digest HTTP auth. For example, you can't teach a WebDAV client to process a login-scheme I define.
| [reply] |
I just realized: that also means my script is never able to get a grip on the username which is part of the wrapping authentication, right? Unleass I find a way to share (session) data among processes/scripts.
How am I supposed to offer user-customized service then, if my script never gets access to HTTP Basic or Digest auth values?? | [reply] |
It's available as $cgi->remote_user (which it gets from $ENV{REMOTE_USER}).
| [reply] |
slap on the forehead... of course!
I've overseen this.. So I could summarize the lesson learned as:
the actual authentication ('Authorization' header) isn't accessible for the script, but once a user is logged in/authenticated, the 'Remote-User' header is set and this *is* part of the script's %ENV and thus accessible.
| [reply] |