Re: Logout of apache?

Hi,

At Wed, 17 Mar 2004 14:18:11 -0600,
[email protected] wrote:
> I've tried now 100 ways to do authentication with mod_ruby and have
> reached the end of my rope.  Using CGI::Session, cookies arbitrarily do
> not get passed or get passed then deleted by the browser immediately.

This topic may help you.

http://modruby.net/doc/faq.en.html#label:14

> Moving to Apache RubyAuthenHandler utilizing:
> 
> AuthType Basic
> AuthName IC3Beta
> RubyRequire rrvc/rrauth
> require valid-user
> RubyAuthenHandler Site
> 
> Here is my Site Class:
> 
> require 'dbi'
> require 'md5'
> module Site
>   def Site.authenticate(r)
>     # Make sure client has sent us a username/password
>     file = File.open("/tmp/uname","a+")
>     file.write(r.notes['username'])
>     file.close
>     if r.get_basic_auth_pw.nil? or r.notes['username'] == "logout"
>       r.auth_name = 'IC3Beta'
>       r.auth_type = 'Basic'
>       r.note_auth_failure
>       return(Apache::DONE)
>     end
>     DBI.connect('DBI:Pg:rapidbilling:localhost','user','pwd')
> do |dbh|
>       uname = r.connection.user.downcase
>       passwd = MD5.new(r.get_basic_auth_pw)
>       row = dbh.select_one("SELECT username FROM tbl_users WHERE
> LOWER(username) = '#{uname}' AND password = '#{passwd}'").to_s
>       if row.length < 1
>         return(Apache::AUTH_REQUIRED)
>       else
>         r.notes['username'] = row
>         return(Apache::OK)
>       end # if row.nil?
>     end # DBI.connect()
>   end # def Site.authenticate()
>   def Site.logout(r)
>     # Make sure client has sent us a username/password
>     r.user=""
>     r.connection.user=""
>     r.auth_name = 'IC3Beta'
>     r.auth_type = 'Basic'
>     r.note_auth_failure
>     return(Apache::DONE)
>     DBI.connect('DBI:Pg:rapidbilling:localhost','user','pwd')
> do |dbh|
>       uname = r.connection.user.downcase
>       passwd = MD5.new(r.get_basic_auth_pw)
>       row = dbh.select_one("SELECT 1 FROM tbl_users WHERE
> LOWER(username) = '#{uname}' AND password = '#{passwd}'")
>       if row.nil?
>         return(Apache::AUTH_REQUIRED)
>       else
>         return(Apache::OK)
>       end # if row.nil?
>     end # DBI.connect()
>   end # def Site.authenticate()
> end # module Site
> 
> 
> At the top of my .rbx i've got 
> 
> r = Apache.request
> rp=r.prev
> if req["action"].to_s == "logout"
>     r.notes['username'] = "logout"
>     ENV['REMOTE_USER'] = nil
>     Site.logout(r)
>     puts "Thanks for logging out."
>     exit
> end
> 
> I have to puts that line and exit, because if I fallthrough absolutely
> nothing happens.  r.notes does get set to logout, but nothing else
> apparently works.  If i redirect in this code, it still does not ask for
> a new login/pass.  What to do?  

If you want to ask a new login/pass, you have to return
AUTH_REQUIRED to the client haven't you?

> As a side note, i only get one chance to
> enter username/password in the apache basic auth, then it immediately
> goes to AUTH_REQUIRED.  I'd love to give 3 tries.

Cookie may be better than the basic auth.

Shugo