Re: Authentication and cookies

Hi.

This is a suggestion to solve what I understand of your problem, but slightly differently.
(And I admit that it is because I do not know if you can do that with a cookie-jar, I have 
never tried; but what is below, I did try and it works).

The idea is as follows.
A cookie is useful in the sense that it is an "information store" which you can offload to 
the browser by means of a "Set-Cookie" header /at the moment when you send a response to 
the browser/, and of which you can be (almost) sure that when the browser sends its next 
request to your server, it will re-send this same cookie along with the new request (in a 
"Cookie" header.
So it saves you from creating a local store on the server, and anyway have to manage some 
way for the browser to receive and send back some "session-id" that allows your server to 
retrieve the corresponding local store entry.

But a cookie is less useful at the server level, as a means to save information between 
Apache (and mod_perl) request processing phases.
For that, you have a better choice : the "pnotes".
http://perl.apache.org/docs/2.0/api/Apache2/RequestUtil.html#C_pnotes_

In your first handler (e.g. PerlAccessHandler), you get and decode the cookie sent by the 
browser; you store the user-id, and whatever else you have from the cookie, in a perl hash 
for example, and then store this perl hash as an entry in the $r->pnotes.
$r->pnotes("key" => $hashref);
In later phases of the same request, another handler can retrieve this same hash from the 
$hashref = $r->pnotes("key").
E.g. in the PerlAuthenHandler, instead of decoding the cookie again, you retrieve the 
hash, and check the values stored in the hash.
Same thing in a PerlAuthzHandler.

Then right before you create the response to the user (e.g. a PerlFixupHandler), you 
retrieve this hash again, and you create the cookie to send along with the response, in 
the HTTP response headers.

At the end of the request, the pnotes disappear automatically.

Actually, it is a bit more complicated than that, because Web AAA is quite spaghetti-like 
in terms of logic.  But that, I suppose, you have already found out.



Dan Axtell wrote:
> I'm trying to upgrade mod_perl authentication/authorization handlers for 
> application menu to be more fine-grained by using cookies.  The basic idea is
> - restrict a script alias in httpd.conf with basic authentication calling the 
> custon handlers
> - validate the user ID/password in the authentication handler, and look up 
> role and client access info; stash in cookie.  If a valid cookie is already 
> there, authenticat
> - in authorization, check for cookie, reset if it's not there, and authorize 
> based on role and client information
> - in menu app, check for cookie, and configure output depending on user's 
> role.
> 
> What happens is that even though the browser shows a cookie with the correct 
> info, the menu ends up with a "no cookie found" error, and the logs show 
> neither the authorization handler nor app are seeing the cookie.  Hitting 
> refresh on the menu shows both handlers seeing the cookie and the menu comes 
> up correctly.
> 
> I've tried using both CGI::Cookie and Apache2::Cookie; I get the same problem 
> either way.  Currently the authentication handler sets the cookie as follows:
> 
>  my $cookie = Apache2::Cookie->new($r, -name => 'ls_authentication', 
>                  value => { user_id => $user, digest => crypt($password, 
> $salt), role_id => $ur{role_id}, clients => $client_list });
>  if ($cookie) {
>        $cookie->bake($r);
>  } else {
>         warn "Unable to make cookie";
>  }
>  
> I get no warning, and the cookie looks fine in the browser's debug tool, but 
> the next handler and app just don't see it.  This is how I try and read it in 
> the authorization handler:
> 
>         my $jar = Apache2::Cookie::Jar->new($r);
>         my $cookie = $jar->cookies('ls_authentication');
>         if ($cookie) {
>             $have_cookie = 1;
>             my %fields = $cookie->value;
>             if ($fields{'user_id'}) {
>                 $user = $fields{'user_id'};
>             }
>             if ( $fields{'role_id'} ) {
>                 $user_role = $fields{'role_id'};
>             }
>             if ( $fields{'clients'} ) {
>                 @user_clients = split(/,/, $fields{'clients'}); # turn client 
> list back into array
>             }
>             warn "AUTHORIZATION: found cookie, user ID = $user, user role = 
> $user_role" if $DEBUG;
>         } else {
>             warn "AUTHORIZATION: NO COOKIE FOUND" if $DEBUG;
>         }
> 
> 
> I'm running Perl 5.12.1, Apache 2.2.17 and libapreq2 2.13 built from source.  
> Is using 'bake' insufficient to make the cookie visible by the next handler?  
> I've tried using both
>  $r->err_headers_out->set('Set-Cookie', $cookie);
> and
>  $r->err_headers_out->addt('Set-Cookie', $cookie);
> but I get the same problem.  
> 
> Does anyone know of any up to date demos of using cookies in mod_perl2 
> authentication handlers?  
>