Re: Authentication handlers in a proxy setting

>
> It would be more logical to do the authentication on the front-end
> server. Then, if the back-end server needs the result of the
> authentication, you could add an appropriate HTTP header (with the
> user-id and maybe more stuff) to the request, before proxying it to the
> back-end.
> The idea is that (supposedly) the communication between the front-end
> and the back-end happens on a secure or private channel, so if the
> back-end gets this header, it knows it comes from the front-end.
> Getting the content of a request header is pretty light-weigth, so the
> work to do on the back-end for AAA could be minimal, since it can
> "believe" what the front-end tells it.
>
That makes sense, but the Apache documentation on server configuration 
suggests a very light-weight front end server with the heavy-weight perl 
server on the back end.  It seems like a lot of overhead to have mod_perl on 
the front end purely for authentication; I might as well keep the monolithic 
configuration I have now.  Thanks for the input, though, it helps clarify 
things.

Dan