1<?xml version="1.0" encoding="ISO-8859-1"?> 2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 3<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!-- 4 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 5 This file is generated from xml source: DO NOT EDIT 6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 7 --> 8<title>mod_auth_basic - Apache HTTP Server</title> 9<link href="/style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /> 10<link href="/style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /> 11<link href="/style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="/style/css/prettify.css" /> 12<script src="/style/scripts/prettify.min.js" type="text/javascript"> 13</script> 14 15<link href="/images/favicon.ico" rel="shortcut icon" /></head> 16<body> 17<div id="page-header"> 18<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p> 19<p class="apache">Apache HTTP Server Version 2.4</p> 20<img alt="" src="/images/feather.gif" /></div> 21<div class="up"><a href="./"><img title="<-" alt="<-" src="/images/left.gif" /></a></div> 22<div id="path"> 23<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.4</a> > <a href="./">Modules</a></div> 24<div id="page-content"> 25<div id="preamble"><h1>Apache Module mod_auth_basic</h1> 26<div class="toplang"> 27<p><span>Available Languages: </span><a href="/en/mod/mod_auth_basic.html" title="English"> en </a> | 28<a href="/fr/mod/mod_auth_basic.html" hreflang="fr" rel="alternate" title="Fran�ais"> fr </a> | 29<a href="/ja/mod/mod_auth_basic.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> | 30<a href="/ko/mod/mod_auth_basic.html" hreflang="ko" rel="alternate" title="Korean"> ko </a></p> 31</div> 32<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Basic HTTP authentication</td></tr> 33<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Base</td></tr> 34<tr><th><a href="module-dict.html#ModuleIdentifier">Module�Identifier:</a></th><td>auth_basic_module</td></tr> 35<tr><th><a href="module-dict.html#SourceFile">Source�File:</a></th><td>mod_auth_basic.c</td></tr> 36<tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.1 and later</td></tr></table> 37<h3>Summary</h3> 38 39 <p>This module allows the use of HTTP Basic Authentication to 40 restrict access by looking up users in the given providers. 41 HTTP Digest Authentication is provided by 42 <code class="module"><a href="/mod/mod_auth_digest.html">mod_auth_digest</a></code>. This module should 43 usually be combined with at least one authentication module 44 such as <code class="module"><a href="/mod/mod_authn_file.html">mod_authn_file</a></code> and one authorization 45 module such as <code class="module"><a href="/mod/mod_authz_user.html">mod_authz_user</a></code>.</p> 46</div> 47<div id="quickview"><h3 class="directives">Directives</h3> 48<ul id="toc"> 49<li><img alt="" src="/images/down.gif" /> <a href="#authbasicauthoritative">AuthBasicAuthoritative</a></li> 50<li><img alt="" src="/images/down.gif" /> <a href="#authbasicfake">AuthBasicFake</a></li> 51<li><img alt="" src="/images/down.gif" /> <a href="#authbasicprovider">AuthBasicProvider</a></li> 52<li><img alt="" src="/images/down.gif" /> <a href="#authbasicusedigestalgorithm">AuthBasicUseDigestAlgorithm</a></li> 53</ul> 54<h3>See also</h3> 55<ul class="seealso"> 56<li><code class="directive"><a href="/mod/mod_authn_core.html#authname">AuthName</a></code></li> 57<li><code class="directive"><a href="/mod/mod_authn_core.html#authtype">AuthType</a></code></li> 58<li><code class="directive"><a href="/mod/mod_authz_core.html#require">Require</a></code></li> 59<li><a href="/howto/auth.html">Authentication howto</a></li> 60</ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div> 61 62<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 63<div class="directive-section"><h2><a name="AuthBasicAuthoritative" id="AuthBasicAuthoritative">AuthBasicAuthoritative</a> <a name="authbasicauthoritative" id="authbasicauthoritative">Directive</a></h2> 64<table class="directive"> 65<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets whether authorization and authentication are passed to 66lower level modules</td></tr> 67<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicAuthoritative On|Off</code></td></tr> 68<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicAuthoritative On</code></td></tr> 69<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr> 70<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 71<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr> 72<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr> 73</table> 74 <p>Normally, each authorization module listed in <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code> will attempt 75 to verify the user, and if the user is not found in any provider, 76 access will be denied. Setting the 77 <code class="directive">AuthBasicAuthoritative</code> directive explicitly 78 to <code>Off</code> allows for both authentication and 79 authorization to be passed on to other non-provider-based modules 80 if there is <strong>no userID</strong> or <strong>rule</strong> 81 matching the supplied userID. This should only be necessary when 82 combining <code class="module"><a href="/mod/mod_auth_basic.html">mod_auth_basic</a></code> with third-party modules 83 that are not configured with the <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code> 84 directive. When using such modules, the order of processing 85 is determined in the modules' source code and is not configurable.</p> 86 87</div> 88<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 89<div class="directive-section"><h2><a name="AuthBasicFake" id="AuthBasicFake">AuthBasicFake</a> <a name="authbasicfake" id="authbasicfake">Directive</a></h2> 90<table class="directive"> 91<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Fake basic authentication using the given expressions for 92username and password</td></tr> 93<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicFake off|username [password]</code></td></tr> 94<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr> 95<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr> 96<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 97<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr> 98<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr> 99<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.4.5 and later</td></tr> 100</table> 101 <p>The username and password specified are combined into an 102 Authorization header, which is passed to the server or service 103 behind the webserver. Both the username and password fields are 104 interpreted using the <a href="/expr.html">expression parser</a>, 105 which allows both the username and password to be set based on 106 request parameters.</p> 107 108 <p>If the password is not specified, the default value "password" 109 will be used. To disable fake basic authentication for an URL 110 space, specify "AuthBasicFake off".</p> 111 112 <p>In this example, we pass a fixed username and password to a 113 backend server.</p> 114 115 <div class="example"><h3>Fixed Example</h3><pre class="prettyprint lang-config"><Location /demo> 116 AuthBasicFake demo demopass 117</Location></pre> 118</div> 119 120 <p>In this example, we pass the email address extracted from a client 121 certificate, extending the functionality of the FakeBasicAuth option 122 within the <code class="directive"><a href="/mod/mod_ssl.html#ssloptions">SSLOptions</a></code> 123 directive. Like the FakeBasicAuth option, the password is set to the 124 fixed string "password".</p> 125 126 <div class="example"><h3>Certificate Example</h3><pre class="prettyprint lang-config"><Location /secure> 127 AuthBasicFake %{SSL_CLIENT_S_DN_Email} 128</Location></pre> 129</div> 130 131 <p>Extending the above example, we generate a password by hashing the 132 email address with a fixed passphrase, and passing the hash to the 133 backend server. This can be used to gate into legacy systems that do 134 not support client certificates.</p> 135 136 <div class="example"><h3>Password Example</h3><pre class="prettyprint lang-config"><Location /secure> 137 AuthBasicFake %{SSL_CLIENT_S_DN_Email} %{sha1:passphrase-%{SSL_CLIENT_S_DN_Email}} 138</Location></pre> 139</div> 140 141 <div class="example"><h3>Exclusion Example</h3><pre class="prettyprint lang-config"><Location /public> 142 AuthBasicFake off 143</Location></pre> 144</div> 145 146 147</div> 148<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 149<div class="directive-section"><h2><a name="AuthBasicProvider" id="AuthBasicProvider">AuthBasicProvider</a> <a name="authbasicprovider" id="authbasicprovider">Directive</a></h2> 150<table class="directive"> 151<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the authentication provider(s) for this location</td></tr> 152<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicProvider <var>provider-name</var> 153[<var>provider-name</var>] ...</code></td></tr> 154<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicProvider file</code></td></tr> 155<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr> 156<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 157<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr> 158<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr> 159</table> 160 <p>The <code class="directive">AuthBasicProvider</code> directive sets 161 which provider is used to authenticate the users for this location. 162 The default <code>file</code> provider is implemented 163 by the <code class="module"><a href="/mod/mod_authn_file.html">mod_authn_file</a></code> module. Make sure 164 that the chosen provider module is present in the server.</p> 165 <div class="example"><h3>Example</h3><pre class="prettyprint lang-config"><Location /secure> 166 AuthType basic 167 AuthName "private area" 168 AuthBasicProvider dbm 169 AuthDBMType SDBM 170 AuthDBMUserFile /www/etc/dbmpasswd 171 Require valid-user 172</Location></pre> 173</div> 174 <p> Providers are queried in order until a provider finds a match 175 for the requested username, at which point this sole provider will 176 attempt to check the password. A failure to verify the password does 177 not result in control being passed on to subsequent providers.</p> 178 179 <p>Providers are implemented by <code class="module"><a href="/mod/mod_authn_dbm.html">mod_authn_dbm</a></code>, 180 <code class="module"><a href="/mod/mod_authn_file.html">mod_authn_file</a></code>, <code class="module"><a href="/mod/mod_authn_dbd.html">mod_authn_dbd</a></code>, 181 <code class="module"><a href="/mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> and <code class="module"><a href="/mod/mod_authn_socache.html">mod_authn_socache</a></code>.</p> 182 183</div> 184<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 185<div class="directive-section"><h2><a name="AuthBasicUseDigestAlgorithm" id="AuthBasicUseDigestAlgorithm">AuthBasicUseDigestAlgorithm</a> <a name="authbasicusedigestalgorithm" id="authbasicusedigestalgorithm">Directive</a></h2> 186<table class="directive"> 187<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Check passwords against the authentication providers as if 188Digest Authentication was in force instead of Basic Authentication. 189</td></tr> 190<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicUseDigestAlgorithm MD5|Off</code></td></tr> 191<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicUseDigestAlgorithm Off</code></td></tr> 192<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr> 193<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 194<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr> 195<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr> 196<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.4.7 and later</td></tr> 197</table> 198 <p>Normally, when using Basic Authentication, the providers listed in 199 <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code> 200 attempt to verify a user by checking their data stores for 201 a matching username and associated password. The stored passwords 202 are usually encrypted, but not necessarily so; each provider may 203 choose its own storage scheme for passwords.</p> 204 205 <p>When using <code class="directive"><a href="/mod/mod_auth_digest.html#authdigestprovider">AuthDigestProvider</a></code> and Digest 206 Authentication, providers perform a similar check to find a matching 207 username in their data stores. However, unlike in the Basic 208 Authentication case, the value associated with each stored username 209 must be an encrypted string composed from the username, realm name, 210 and password. (See 211 <a href="http://tools.ietf.org/html/rfc2617#section-3.2.2.2"> 212 RFC 2617, Section 3.2.2.2</a> for more details on the format used 213 for this encrypted string.)</p> 214 215 <p>As a consequence of the difference in the stored values between 216 Basic and Digest Authentication, converting from Digest 217 Authentication to Basic Authentication generally requires that all 218 users be assigned new passwords, as their existing passwords cannot 219 be recovered from the password storage scheme imposed on those 220 providers which support Digest Authentication.</p> 221 222 <p>Setting the <code class="directive"><a href="#authbasicusedigestalgorithm">AuthBasicUseDigestAlgorithm</a></code> directive 223 to <code>MD5</code> will cause the user's Basic Authentication password 224 to be checked using the same encrypted format as for Digest 225 Authentication. First a string composed from the username, realm name, 226 and password is hashed with MD5; then the username and this encrypted 227 string are passed to the providers listed in 228 <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code> 229 as if 230 <code class="directive"><a href="/mod/mod_authn_core.html#authtype">AuthType</a></code> 231 was set to <code>Digest</code> and Digest Authentication was in force. 232 </p> 233 234 <p>Through the use of <code class="directive"><a href="#authbasicusedigestalgorithm">AuthBasicUseDigestAlgorithm</a></code> 235 a site may switch from Digest to Basic Authentication without 236 requiring users to be assigned new passwords.</p> 237 238 <div class="note"> 239 The inverse process of switching from Basic to Digest 240 Authentication without assigning new passwords is generally 241 not possible. Only if the Basic Authentication passwords 242 have been stored in plain text or with a reversable encryption 243 scheme will it be possible to recover them and generate a 244 new data store following the Digest Authentication password 245 storage scheme. 246 </div> 247 248 <div class="note"> 249 Only providers which support Digest Authentication will be able 250 to authenticate users when <code class="directive"><a href="#authbasicusedigestalgorithm">AuthBasicUseDigestAlgorithm</a></code> 251 is set to <code>MD5</code>. Use of other providers will result 252 in an error response and the client will be denied access. 253 </div> 254 255</div> 256</div> 257<div class="bottomlang"> 258<p><span>Available Languages: </span><a href="/en/mod/mod_auth_basic.html" title="English"> en </a> | 259<a href="/fr/mod/mod_auth_basic.html" hreflang="fr" rel="alternate" title="Fran�ais"> fr </a> | 260<a href="/ja/mod/mod_auth_basic.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> | 261<a href="/ko/mod/mod_auth_basic.html" hreflang="ko" rel="alternate" title="Korean"> ko </a></p> 262</div><div class="top"><a href="#page-header"><img src="/images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div> 263<script type="text/javascript"><!--//--><![CDATA[//><!-- 264var comments_shortname = 'httpd'; 265var comments_identifier = 'http://httpd.apache.org/docs/2.4/mod/mod_auth_basic.html'; 266(function(w, d) { 267 if (w.location.hostname.toLowerCase() == "httpd.apache.org") { 268 d.write('<div id="comments_thread"><\/div>'); 269 var s = d.createElement('script'); 270 s.type = 'text/javascript'; 271 s.async = true; 272 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier; 273 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s); 274 } 275 else { 276 d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>'); 277 } 278})(window, document); 279//--><!]]></script></div><div id="footer"> 280<p class="apache">Copyright 2014 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> 281<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- 282if (typeof(prettyPrint) !== 'undefined') { 283 prettyPrint(); 284} 285//--><!]]></script> 286</body></html>
