?
Solved

How can I produce a custom authentication module for Apache httpd?

Posted on 2007-11-16
1
Medium Priority
?
631 Views
Last Modified: 2012-06-27
I need a custom authentication module for Apache that will  put up a  customized authentication dialogue.  The existing authentication modules cause the browser to pop up a username/password dialogue, which is fine for what it is intended to do, but I would like to do something that only asks for a password, and does so as part of a page that is big enough to provide a paragraph of documentation and a link to  more detailed documentation.

At present, I'm faking it with
DirectoryIndex index.html index.php
in my apache config, so that index.html  has priority over index.php., and I have written an index.html which contains an html form that invokes a PHP action routine which verifies the password and then invokes the web app (named index.php) if the password is OK. Below the form I have a link to the user manual for the web app.

This looks nice, as I used Dreamweaver to surround the the form with some nice eye candy, but the security  level is not very good. Anybody who can find out or  guess the name of the subdirectory in which the web app lives can invoke it.

How can I produce  (or find) an authentication module that will put up the same screen?
0
Comment
Question by:jdgressett
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 3

Accepted Solution

by:
kylealanhale earned 2000 total points
ID: 20303555
You're going about it all the wrong way.  The basic apache authentication is handled by the browser, so you can't control what that popup looks like.  If that doesn't do it for you, you need to do some research on a few things:

PHP session handling
PHP security
SSL

There is no quick way to do this really.. but if you do some googling on at least the first two topics, you'll get a much more secure solution.  If you want to implement a Secure HTTP solution, you'll need to research the third.

Here's a fairly good little tutorial:

http://www.trap17.com/forums/php-simple-login-tutorial-t7887.html
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hi, in this article I'm going to teach you how to run your own site, and how to let people in (without IP). I'll talk about and explain each step... :) By the way, everything in this Tutorial is completely free and legal. This article is for …
If you've heard about htaccess and it sounds like it does what you want, but you're not sure how it works... well, you're in the right place. Read on. Some Basics #1. It's a file and its filename is .htaccess (yes, with a dot in the front). #…
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
Suggested Courses
Course of the Month10 days, left to enroll

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question