调试Apache 2.4 PerlAuthenHandler

Question

我正在尝试调试apache升级后出现的问题.我想将redmine集成到我的apache身份验证/访问控制中.

这是我的apache配置:

<Location "/git/">                                         

  AuthType Basic                                           

  AuthName "Git Access"                                    

  Require valid-user                                       

  Order deny,allow                                         
  Allow from all                                           

  PerlAccessHandler Apache::Authn::Redmine::access_handler 
  PerlAuthenHandler Apache::Authn::Redmine::authen_handler 
  ...

这是访问/验证处理程序:

sub access_handler {                                                                                                       
  my $r = shift;                                                                                                           

  unless ($r->some_auth_required) {                                                                                        
      $r->log_reason("No authentication has been configured");                                                             
      return FORBIDDEN;                                                                                                    
  }                                                                                                                        

  return OK unless request_is_read_only($r);                                                                               

  my $project_id = get_project_identifier($r);                                                                             

  $r->log_error("Setting Auth to OK") if is_public_project($project_id, $r) && anonymous_role_allows_browse_repository($r);
  $r->log_error("Content: " . $r->get_handlers("PerlAuthenHandler"));                                                      

  $r->set_handlers(PerlAuthenHandler => [\&ok_authen_handler])                                                             
      if is_public_project($project_id, $r) && anonymous_role_allows_browse_repository($r);                                

  return OK                                                                                                                
}                                                                                                                          

sub ok_authen_handler {                                                                                                    
  my $r = shift;                                                                                                           
  $r->log_error("ok_authen_handler()...");                                                                                 

  my ($res, $redmine_pass) =  $r->get_basic_auth_pw();                                                                     

  return OK;                                                                                                               
}                                                                                                                          

sub authen_handler {                                                                                                       
  my $r = shift;                                                                                                           
  $r->log_error("authen_handler() ...");                                                                                   
  my ($res, $redmine_pass) =  $r->get_basic_auth_pw();                                                                     
  return $res unless $res == OK;                                                                                           

  if (is_member($r->user, $redmine_pass, $r)) {                                                                            
      $r->log_error("Auth succeeded");                                                                                     
      return OK;                                                                                                           
  } else {                                                                                                                 
      $r->log_error("Auth failed...");                                                                                     
      $r->note_auth_failure();                                                                                             
      return DECLINED;                                                                                                     
  }                                                                                                                        
}  

如您所见,访问处理程序将auth处理程序重置为某些虚拟方法,以防不需要身份验证.理论上,这允许选择性匿名访问.

实际上,尽管apache 2.4会产生错误:

AH00027: No authentication done but request not allowed without authentication for $PATH. Authentication not configured?

我已经将问题钉在访问处理程序中的hack中,如果我取消注释set_handlers语句,我可以对redmine进行身份验证.所以我猜这个"黑客"有点不对劲.不幸的是,我不是一个真正的perl家伙,所以我不知道如何进一步调查这个问题.

有没有办法弄清楚"被黑"的控制流(即以编程方式设置auth处理程序)与正常控制流之间的重要区别是什么？

Answer 1

有点脏的解决方法是即使在匿名模式下也始终设置"user"(REMOTE_USER)变量,因此"Require valid-user"似乎很高兴,

  $r->user("");
  return Apache2::Const::OK;

我们有这个问题来实现惰性身份验证(Shibboleth样式).