FastCGI capability question

Hello all.

I'm new to FastCGI and after reading the available docs I have a
question I'd like to submit to more knowledgeable people.

I use a SSO system called shibboleth which has various modules for some
web servers to implement it's functionality. It would be very
interesting if this functionality could be substituted by a FastCGI app.

Basically these shib modules intercept the http requests in two ways:

1- If the URL requested is the configured handler URL for shibboleth:
the module hijacks the request, processes the commands given through
POST or GET params, and outputs HTML.

2- The URL is checked against a map which indicates if auth is needed
for this particular URL.
  2.1 - If auth is needed and the user is not authenticated, he is
redirected to the login point.
  2.2 - If auth is needed and the user has it, request headers are added
identifying the user to the underlying application and the request is
passed on down the chain.
 2.3 - If no auth is needed the request is passed untouched.

Now... The point I'm having most difficulty porting to FastCGI is 2.2.
The filter role seems to activate AFTER the response was generated and
so can only alter the response. I need to capture the request and alter
it before it gets to the underlying application.

On the other hand, the authorizer role catches the request before but
can only return "200 OK" or anything else is assumed to be a denial and
is sent to the client...

Can anyone shed some light on this?
Thanks a lot,
André Cruz

___________________________________
fastcgi-developers mailing list
http://fastcgi.com/fastcgi-developers/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFFpn16CtEBg3IaVEgRApyMAJ9nq8y40kxfzyuMHLsxCH94FfDCegCfadD3
5PzyakiEXMYC6yvEokzRuyM=
=HX8Q
-----END PGP SIGNATURE-----