Authorization module is not working

[Odysseas Pentakalos, Ph.D.]

I am trying to accomplish authorization of users using client certificates
for authenticating users and a database of valid DN's for authorization. As
a first step the only thing I am trying to do is verify that my
authorization module has been correctly installed. So, before I attempt to
write the database code to verify if a given certificate has access to the
web content, I am returning for all requests the constant FORBIDDEN. The
problem I am having is that regardless of what the module returns, the user
is still presented with the page. I know that the handler is invoked because
I see the logged statements in the log file for the requested page.

I am really not sure what else to try. The fact that the user is allowed to
access the page despite the fact that the module returns FORBIDDEN indicates
that another module is approving the request but I have minimized the
configuration file down to the bare minimum to make sure that nothing else
is interfering. Any help with this would be very much appreciated.

Thanks,
Odysseas

I have configured the module as follows:

<Location />
    AuthName "Certificate Authentication"
    AuthType Basic
    SSLVerifyClient require
    SSLRequireSSL
    PerlAuthenHandler Apache::OK
    PerlAuthzHandler Apache::CertAuthz
    require valid-user
</Location>

And the module CertAuthz looks like the following:

package Apache::CertAuthz;
# use strict;
use mod_perl ();
use Apache::Log ();
use Apache::URI ();

$Apache::CertAuthz::VERSION = '0.01';

my %is_installed = ();
my $Is_Win32 = ($^O eq "MSWin32");
{
    local $SIG{__DIE__};
    %is_installed = map {
        $_, (eval("require $_") || 0);
    } qw (Data::Dumper Devel::Symdump B Apache::Request Apache::Peek
Apache::Symbol);
}

use vars qw($newQ);

if ($is_installed{"Apache::Request"}) {
    $newQ ||= sub { Apache::Request->new(@_) };
}
else {
    $is_installed{"CGI"} = eval("require CGI") || 0;
    $newQ ||= sub { CGI->new; };
}

sub handler {
    my($r) = @_;

    my $log = $r->log;
    
    return FORBIDDEN unless $r->is_main;

    my $subr = $r->lookup_uri($r->uri);
    my $dn = $subr->subprocess_env('SSL_CLIENT_S_DN');

    $r->log_reason("In CertAuthz a certificate must be provided with a DN of
$dn.", $r->filename);
    return FORBIDDEN;
}

1;

__END__

<<attachment: winmail.dat>>