Hi,
Look at module "auth_request"
(http://nginx.org/en/docs/http/ngx_http_auth_request_module.html).
Good working solution at the moment is to use auth_request module
together with some external auth-daemon.
You can avoid many problems, e.g. with async/sync handling etc.
Using that I have already successful realized many authentication
methods (inclusively NTLM/Negotiate for windows).
If you have to realize anything doing handshake, you can use a variable
$connection or combination "$connection:$remote_addr:$remote_port" as
identifier for your connect with persistent authentication.
Regards,
sebres.
01.07.2015 15:36, Petra Kamenickova:
Hi!
I'm working on custom PAM module which could be used as an
authorization support for authentication modules (e.g.
ngx_http_auth_spnego_module) and I ran into few problems. I'm not sure
I fully get the interactions between and within
phases in nginx. My background is Apache HTTP Server so that might have
twisted my expectations.
I have noticed that satisfy directive behaves slightly different than
Apache's satisfy - nginx checks every module in access phase and the
first successful invocation stops any subsequent checks whereas
Apache's satisfy checks host based access vs. other access modules. It
has some implications especially for authentication and authorization
implications. What would be the best way to make sure that
authorization phases that need authentication to be run gets that
authentication executed, even with satisfy any?
The post access phase looks like a good place for authorization but it
seems custom modules cannot really be added to this phase. So... is it
possible to add somehow my module handler into post access phase
without changing the core module? Or is there any way how to keep my
module in access phase but skip the satisfy check for that module?
I would be grateful for any help!
--
Petra Kamenickova
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel [1]
Links:
------
[1] http://mailman.nginx.org/mailman/listinfo/nginx-devel
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
