apache2_mod_authz_dbd

Extension of apache 2.4's mod_authz_dbd to include parametrable
parameters for database queries done thru the 'AuthzDBDQuery' directive.

This extension was contributed to the apache server and it's being
made available for other people here while waiting resolution for
its acceptance.

See https://bz.apache.org/bugzilla/show_bug.cgi?id=58025 for more
details.

To compile

Clone the repository, then

cd apache2_mod_authz_dbd
apxs2  -i -a -c mod_authz_dbd.c -Wc,-Wall -Wc,-g, -Wc,-Wunused

This will compile the module and install it, thus replacing the one
shippied in with apache. Restart apache to use it.

If you're not using the new directive and features, this module
is expected to be backwards compatible with the one shipped with Apache.

Usage

This module adds a new require directive, 'Require dbd-query', to specify
any number of parameters we want to feed to 'AuthzDBDQuery'.
These parameters must be space-separated and can be any kind of variables
supported by Apache as specified in
https://httpd.apache.org/docs/2.4/expr.html#vars.

The module also extends 'Require dbd-login' and 'dbd-logout' so that they
can use optional parameters if you want to feed them to 'AuthzDBDQuery'.
If you don't use any parameters, you will fallback to the previous
behavior for backwards compatibility.

Examples:

<Location "/my/protected/space">
    Require dbd-query %{REQUEST_URI} %{REMOTE_USER} %{REQUEST_METHOD}
    AuthzDBDQuery "SELECT true from uris \ 
                   WHERE u.uris = %s \
                   AND u.user = %s \
                   AND u.request_method = %s \
                   LIMIT 1"
</Location>

The query parameters will be feed in order and substitute the %s
place holders. Note that you don't need to encapsulate them with quotes
as the query will be compiled. If you feed more query parameters than are
needed by 'AuthzDBDQuery', they will be silently ignored. However, if
you feed less parameters than needed, an error will be logged and
the server will return an 'HTTP 500' status code.

The above query will authorize access to a resource if the database
has an authenticated user's identity and request method record for it.

Here are two examples where you can feed query parameters to 'dbd-login'
and 'dbd-logout'. As stated before, those parameters are optional and
if not used, will use '%{REMOTE_USER}' as a default value, to keep
backwards compatibility.

<Location "/my/protected/space/login">
    Require dbd-login %{REMOTE_USER}
    AuthzDBDQuery "UPDATE authn SET login = 'true' WHERE user = %s"
</Location>

<Location "/my/protected/space/logout">
    Require dbd-logout %{REMOTE_USER}
    AuthzDBDQuery "UPDATE authn SET login = 'false' WHERE user = %s" 
</Location>