Mike Orr <[EMAIL PROTECTED]>: [...] > The rules above are copied straight from my old Zope install. I haven't > tried them with Webware.
Well, they seem correct. The odd thing is that I can't seem to set the environmentvariable through the E rewrite directive. [...] > Basic authentication is great if you can live with its limitations. > I haven't used it with Webware, but on other platforms it's always been > easy to set up and reliable. Under Apache you can use a standard > htpasswd file for static users, or mod_auth_mysql if your > application itself creates users. Interesting. I'm using postgres, but I see there's a mod_auth_pgsql as well. [...] > My memory is failing as to where PHP_AUTH_USER > comes from; I guess that's where my problem is; initiating the authentication process is easy enough; I just can't get the username and password afterwards... > whether PHP extracts it from HTTP_CGI_AUTHORIZATION or Is that a standard environment variable? When I searched for it, I only found lots of versions of the Zope recipe. > whether Apache supplies an AUTH_USER envvar, but you can find it in > Webware by looking at all the envvars in the traceback. I tried, but since my authentication didn't work, no such environment variable was present. I guess I'll just try with a .htpasswd file or something (which should set the environment variables properly, I guess.) [...] > Some disadvantages of Basic Authentication: > > ** You can't customize the login dialog except the short "realm name" > string. If users are confused about why they are being asked for a > password, there's no way to provide a "click here for help" hyperlink. True. I can live with that -- especially if you have an intro screen with a help link etc, and a "log in" button/link or something. > ** Users can't log out without quitting the browser. There's no way > to provide a "logout" button because the browsers don't provide that > feature. I've heard that said before... Wouldn't it be a simple matter of providing the "unauthorized"/401 header/status again, and then have the user clicking cancel? [...] > ** Users can't relog in as someone else without quitting the browser. Ditto? [...] -- Magnus Lie Hetland The Anygui Project http://hetland.org http://anygui.org _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
