Re: [Cppcms-users] pass security credentials using fcgi

[Artyom B. <art...@ya...>]

Sometimes it is very useful to have generic HTTP authentication that can be used across different platforms.

For example if you want to have centralized login connected to Domain controller etc. Apache has wide range
of modules for such authentication - Kerberos that for example allow to run any application behind common
scheme like svn apache module can use any authentication schemes provided by Apache.

In such case you may relay on the authentication that web server provides and use it as is.

When you relay on the web server you indeed need to use specific CGI variables that should

be defined by the web server, see: http://tools.ietf.org/html/draft-robinson-www-interface-00#page-10
as you had already mentioned them.

However it is not common practice for public web sites to use HTTP authentication.

Also once you use HTTP authentication you will still need to handle the authorization in your
application to handle the permissions.

 

Artyom Beilis
--------------
CppCMS - C++ Web Framework:   http://cppcms.com/
CppDB - C++ SQL Connectivity: http://cppcms.com/sql/cppdb/



>________________________________
> From: Markus Raab <us...@ma...>
>To: cpp...@li... 
>Sent: Saturday, April 27, 2013 1:30 PM
>Subject: [Cppcms-users] pass security credentials using fcgi
> 
>
>Hello Group!
>
>I have a rather general question about fcgi but I still post in this group 
>because I am interested in a solution which plays nicely with cppcms.
>
>One way to authenticate users is to have some authentication code within 
>cppcms and keep the auth state within a session. The drawback of this is:
>- you need to write the authentication yourself
>- you need to have a (in the worst case redudant) passwd/shadow
>
>Another way is to use authentication methods found within webservers.
>I am interested in how those security credentials are passed using fcgi.
>E.g. in nginx I found "fastcgi_pass_header Authorization;" and to pass the 
>information if we are in a secure session "fastcgi_param HTTPS $https;".
>I wonder if other webservers also have this feature?
>
>Is there a standard for which environment variables should be declared and 
>how they should behave? Are the implementations found in apache/lighttpd 
>fcgi standard compliant?
>
>It seems like AUTH_TYPE and REMOTE_USER should be set for this feature.
>Cppcms seems to have convenience functions for those.
>Unfortunately I could not find detailed information about these.
>
>Is this approach used in practice?
>
>I also could not find anything about authentification in
>http://cppcms.com/wikipp/en/page/secure_programming
>
>
>best regards
>Markus
>
>
>------------------------------------------------------------------------------
>Try New Relic Now & We'll Send You this Cool Shirt
>New Relic is the only SaaS-based application performance monitoring service 
>that delivers powerful full stack analytics. Optimize and monitor your
>browser, app, & servers with just a few lines of code. Try New Relic
>and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr
>_______________________________________________
>Cppcms-users mailing list
>Cpp...@li...
>https://lists.sourceforge.net/lists/listinfo/cppcms-users
>
>
>