Andrew Ho wrote:
> Hello,
>
> GY>Apache::DigestAPI is a release of Recipe 13.8 in the Cookbook - a simple
> GY>API for supporting Digest authentication a la mod_digest.c from the
> GY>Apache distribution.
>
> I think this is a great idea. I'm a huge fan of digest authentication as a
> simple basic authentication replacement, and many modern clients now
> support it. One comment, why the odd name? Shouldn't it be
> Apache::AuthDigest or similar? Every library is an API so it seems kind of
> odd to call it Apache::DigestAPI.
well, it's an API in that it doesn't do anything for you except provide an API.
meaning,
I'd expect Apache::AuthDigest to work as so:
PerlAuthenHandler Apache::AuthDigest
all this module does is provide methods that parallel $r->get_basic_auth_pw() and
$r->note_basic_auth_failure - you need to use the methods yourself to build an actual
authentication mechanism.
>
> GY>keep in mind that the current implementation doesn't work with MSIE, so
> GY>you'll have to use something like Opera or Konqueror (or mozilla now, I
> GY>hear?) to play around with it.
>
> MSIE does do digest authentication that works with mod_digest.c. And
> Mozilla past 0.9.7 should do digest authentication.
>
are you sure? I can't get it to work right now using MSIE 5.00.31. in fact, I can
confirm that Apache sends the 401, but MSIE doesn't even display a dialogue box.
Opera
works just fine.
when I was researching this for the book, it was my understanding that MSIE requires
parameters not supplied by mod_digest.c (such as "qop") for it's implementation. some
old
threads on new-httpd on mod_auth_digest.c pointed me in this direction, IIRC.
then there was this recent article:
http://www.eweek.com/article/0,3658,s=702&a=24177,00.asp
which, even though it seemed to confirm what I had found out, suprised me somewhat,
since
I figured it was old news that MSIE and Apache's "standard" (for lack of a better
term)
Digest implementation didn't play nice together...
--Geoff
