1<?xml version="1.0" encoding="ISO-8859-1"?> 2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 3<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!-- 4 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 5 This file is generated from xml source: DO NOT EDIT 6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 7 --> 8<title>mod_authz_owner - Apache HTTP Server</title> 9<link href="/style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /> 10<link href="/style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /> 11<link href="/style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="/style/css/prettify.css" /> 12<script src="/style/scripts/prettify.js" type="text/javascript"> 13</script> 14 15<link href="/images/favicon.ico" rel="shortcut icon" /></head> 16<body> 17<div id="page-header"> 18<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p> 19<p class="apache">Apache HTTP Server Version 2.2</p> 20<img alt="" src="/images/feather.gif" /></div> 21<div class="up"><a href="./"><img title="<-" alt="<-" src="/images/left.gif" /></a></div> 22<div id="path"> 23<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.2</a> > <a href="./">Modules</a></div> 24<div id="page-content"> 25<div id="preamble"><h1>Apache Module mod_authz_owner</h1> 26<div class="toplang"> 27<p><span>Available Languages: </span><a href="/en/mod/mod_authz_owner.html" title="English"> en </a> | 28<a href="/ja/mod/mod_authz_owner.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> | 29<a href="/ko/mod/mod_authz_owner.html" hreflang="ko" rel="alternate" title="Korean"> ko </a></p> 30</div> 31<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Authorization based on file ownership</td></tr> 32<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Extension</td></tr> 33<tr><th><a href="module-dict.html#ModuleIdentifier">Module�Identifier:</a></th><td>authz_owner_module</td></tr> 34<tr><th><a href="module-dict.html#SourceFile">Source�File:</a></th><td>mod_authz_owner.c</td></tr> 35<tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.1 and later</td></tr></table> 36<h3>Summary</h3> 37 38 <p>This module authorizes access to files by comparing the userid used 39 for HTTP authentication (the web userid) with the file-system owner or 40 group of the requested file. The supplied username and password 41 must be already properly verified by an authentication module, 42 such as <code class="module"><a href="/mod/mod_auth_basic.html">mod_auth_basic</a></code> or 43 <code class="module"><a href="/mod/mod_auth_digest.html">mod_auth_digest</a></code>. <code class="module"><a href="/mod/mod_authz_owner.html">mod_authz_owner</a></code> 44 recognizes two arguments for the <code class="directive"><a href="/mod/core.html#require">Require</a></code> directive, <code>file-owner</code> and 45 <code>file-group</code>, as follows:</p> 46 47 <dl> 48 <dt><code>file-owner</code></dt> 49 <dd>The supplied web-username must match the system's name for the 50 owner of the file being requested. That is, if the operating system 51 says the requested file is owned by <code>jones</code>, then the 52 username used to access it through the web must be <code>jones</code> 53 as well.</dd> 54 55 <dt><code>file-group</code></dt> 56 <dd>The name of the system group that owns the file must be present 57 in a group database, which is provided, for example, by <code class="module"><a href="/mod/mod_authz_groupfile.html">mod_authz_groupfile</a></code> or <code class="module"><a href="/mod/mod_authz_dbm.html">mod_authz_dbm</a></code>, 58 and the web-username must be a member of that group. For example, if 59 the operating system says the requested file is owned by (system) 60 group <code>accounts</code>, the group <code>accounts</code> must 61 appear in the group database and the web-username used in the request 62 must be a member of that group.</dd> 63 </dl> 64 65 <div class="note"><h3>Note</h3> 66 <p>If <code class="module"><a href="/mod/mod_authz_owner.html">mod_authz_owner</a></code> is used in order to authorize 67 a resource that is not actually present in the filesystem 68 (<em>i.e.</em> a virtual resource), it will deny the access.</p> 69 70 <p>Particularly it will never authorize <a href="/content-negotiation.html#multiviews">content negotiated 71 "MultiViews"</a> resources.</p> 72 </div> 73</div> 74<div id="quickview"><h3 class="directives">Directives</h3> 75<ul id="toc"> 76<li><img alt="" src="/images/down.gif" /> <a href="#authzownerauthoritative">AuthzOwnerAuthoritative</a></li> 77</ul> 78<h3>Topics</h3> 79<ul id="topics"> 80<li><img alt="" src="/images/down.gif" /> <a href="#examples">Configuration Examples</a></li> 81</ul><h3>See also</h3> 82<ul class="seealso"> 83<li><code class="directive"><a href="/mod/core.html#require">Require</a></code></li> 84<li><code class="directive"><a href="/mod/core.html#satisfy">Satisfy</a></code></li> 85</ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div> 86<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 87<div class="section"> 88<h2><a name="examples" id="examples">Configuration Examples</a></h2> 89 90 <h3><a name="examples.file-owner" id="examples.file-owner">Require file-owner</a></h3> 91 <p>Consider a multi-user system running the Apache Web server, with 92 each user having his or her own files in <code>~/public_html/private</code>. Assuming that there is a single 93 <code class="directive"><a href="/mod/mod_authn_dbm.html#authdbmuserfile">AuthDBMUserFile</a></code> database 94 that lists all of their web-usernames, and that these usernames match 95 the system's usernames that actually own the files on the server, then 96 the following stanza would allow only the user himself access to his 97 own files. User <code>jones</code> would not be allowed to access 98 files in <code>/home/smith/public_html/private</code> unless they 99 were owned by <code>jones</code> instead of <code>smith</code>.</p> 100 101 <div class="example"><p><code> 102 <Directory /home/*/public_html/private><br /> 103 <span class="indent"> 104 AuthType Basic<br /> 105 AuthName MyPrivateFiles<br /> 106 AuthBasicProvider dbm<br /> 107 AuthDBMUserFile /usr/local/apache2/etc/.htdbm-all<br /> 108 Satisfy All<br /> 109 Require file-owner<br /> 110 </span> 111 </Directory> 112 </code></p></div> 113 114 115 <h3><a name="examples.file-group" id="examples.file-group">Require file-group</a></h3> 116 <p>Consider a system similar to the one described above, but with 117 some users that share their project files in 118 <code>~/public_html/project-foo</code>. The files are owned by the 119 system group <code>foo</code> and there is a single <code class="directive"><a href="/mod/mod_authz_dbm.html#authdbmgroupfile">AuthDBMGroupFile</a></code> database that 120 contains all of the web-usernames and their group membership, 121 <em>i.e.</em> they must be at least member of a group named 122 <code>foo</code>. So if <code>jones</code> and <code>smith</code> 123 are both member of the group <code>foo</code>, then both will be 124 authorized to access the <code>project-foo</code> directories of 125 each other.</p> 126 127 <div class="example"><p><code> 128 <Directory /home/*/public_html/project-foo><br /> 129 <span class="indent"> 130 AuthType Basic<br /> 131 AuthName "Project Foo Files"<br /> 132 AuthBasicProvider dbm<br /> 133 <br /> 134 # combined user/group database<br /> 135 AuthDBMUserFile /usr/local/apache2/etc/.htdbm-all<br /> 136 AuthDBMGroupFile /usr/local/apache2/etc/.htdbm-all<br /> 137 <br /> 138 Satisfy All<br /> 139 Require file-group<br /> 140 </span> 141 </Directory> 142 </code></p></div> 143 144</div> 145<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div> 146<div class="directive-section"><h2><a name="AuthzOwnerAuthoritative" id="AuthzOwnerAuthoritative">AuthzOwnerAuthoritative</a> <a name="authzownerauthoritative" id="authzownerauthoritative">Directive</a></h2> 147<table class="directive"> 148<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets whether authorization will be passed on to lower level 149modules</td></tr> 150<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthzOwnerAuthoritative On|Off</code></td></tr> 151<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthzOwnerAuthoritative On</code></td></tr> 152<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr> 153<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr> 154<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr> 155<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_authz_owner</td></tr> 156</table> 157 <p>Setting the <code class="directive">AuthzOwnerAuthoritative</code> 158 directive explicitly to <code>Off</code> allows for 159 user authorization to be passed on to lower level modules (as defined 160 in the <code>modules.c</code> files) if:</p> 161 162 <ul> 163 <li>in the case of <code>file-owner</code> the file-system owner does not 164 match the supplied web-username or could not be determined, or</li> 165 166 <li>in the case of <code>file-group</code> the file-system group does not 167 contain the supplied web-username or could not be determined.</li> 168 </ul> 169 170 <p>Note that setting the value to <code>Off</code> also allows the 171 combination of <code>file-owner</code> and <code>file-group</code>, so 172 access will be allowed if either one or the other (or both) match.</p> 173 174 <p>By default, control is not passed on and an authorization failure 175 will result in an "Authentication Required" reply. Not 176 setting it to <code>Off</code> thus keeps the system secure and forces 177 an NCSA compliant behaviour.</p> 178 179</div> 180</div> 181<div class="bottomlang"> 182<p><span>Available Languages: </span><a href="/en/mod/mod_authz_owner.html" title="English"> en </a> | 183<a href="/ja/mod/mod_authz_owner.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> | 184<a href="/ko/mod/mod_authz_owner.html" hreflang="ko" rel="alternate" title="Korean"> ko </a></p> 185</div><div class="top"><a href="#page-header"><img src="/images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div> 186<script type="text/javascript"><!--//--><![CDATA[//><!-- 187var comments_shortname = 'httpd'; 188var comments_identifier = 'http://httpd.apache.org/docs/2.2/mod/mod_authz_owner.html'; 189(function(w, d) { 190 if (w.location.hostname.toLowerCase() == "httpd.apache.org") { 191 d.write('<div id="comments_thread"><\/div>'); 192 var s = d.createElement('script'); 193 s.type = 'text/javascript'; 194 s.async = true; 195 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier; 196 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s); 197 } 198 else { 199 d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>'); 200 } 201})(window, document); 202//--><!]]></script></div><div id="footer"> 203<p class="apache">Copyright 2013 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> 204<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- 205if (typeof(prettyPrint) !== 'undefined') { 206 prettyPrint(); 207} 208//--><!]]></script> 209</body></html>
