Apache 2 Module: mod_auth_cookie_mysql2

Current version: 0.3
Attention: This is a alpha version !! Use and test it at your own risk :))

Are you looking for a version for Apache 1.3 ? click here

• Introduction
  This is a rewrite of the mod_auth_cookie_mysql module for apache 1.3. Some features were added, some were forgotten.
  
  
• Description:
  Instead of basic auth you can authorize your users with cookies. An external script (perl, C, php, ..) sets the cookie and this module checks it against a MySQL database.The data stored in the cookie are only random session data, so nobody can "hack" the system by manipulating the cookie values. Additionally you can add checks for session expiry and the correct remote ip.
  
  
• Features:
  • Fake Basic Auth with Cookies
  • Can check expiry information stored in database against cookie
  • Can check if the remote IP is equal to the IP stored in database
    
    
• Installation:
  • Configure your apache like always, add the following lines:
    LDFLAGS="-L/usr/local/mysql/lib/" LIBS="-lz -lmysqlclient" INCLUDES="-I/usr/local/mysql/include" \
    ./configure --with-module=aaa:<pathtofile>/mod_auth_cookie_mysql2.c
    (or whereever your MySQL library and include files are)
    
• Configuration:
  • The are a hand of configuration directives you can set:
    

    Name	Values	Description	Required
    CookieAuth	{on|off}	Activates this module	YES
    CookieAuth_DBhost	<hostname> or <IP>	Hostname or IP of the host where MySQL is running on	YES
    CookieAuth_DBName	<dbname>	Name of the database in MySQL	YES
    CookieAuth_DBTable	<tbname>	Tablename in database	YES
    CookieAuth_DBUser	<username>	Username for MySQL connection	YES
    CookieAuth_DBPassword	<password>	Password for MySQL connection	YES
    CookieAuth_UsernameField	<fieldname>	Field in MySQL table where username of session is stored. This username is displayed as the "Remote Username" variable "REMOTE_USER" in Apache	YES
    CookieAuth_SessnameField	<fieldname>	Field in MySQL table where session name is stored in. This is the name of the cookie !	YES
    CookieAuth_SessvalField	<fieldname>	Field in MySQL table where session value (this is the value which is compared with the cookies value) is stored in	YES
    CookieAuth_CookieName	<name>	If this option is set, only the cookie with this name is searched. If it is not set, this module searches all cookies the browser sencs and checks the name against the values in die Sessname field and its value against Sessval field.	OPTIONAL
    CookieAuth_ExpiryField	<fieldname>	When this option is set, the current time of the webserver is compared against this field in the database. This value is: time in seconds since 01.01.1970 (unix timestamp).	OPTIONAL
    CookieAuth_RemoteIPField	<fieldname>	When this option is set, the remote address of the connected client is checked against this field. Only when the remote IP and the stored IP are eqal the client can authorize	OPTIONAL
    CookieAuth_FailureURL	<url>	Normally, when the authorization failed, the client gets a "AUTHORIZATION REQUIRED" message from the webserver, when this option is set, you can redirect the client to another URL instead of "AUTHORIZATION REQUIRED"	OPTIONAL

    
    
• Examples:
  • MySQL table:
    

    CREATE TABLE `inter_sessions` ( `sessname` varchar(32) NOT NULL default '', `sesskey` varchar(32) NOT NULL default '', `expiry` int(11) NOT NULL default '0', `remoteip` varchar(15) NOT NULL default '', `username` varchar(32) NOT NULL default '', UNIQUE KEY `sessname` (`sessname`) ) TYPE=MyISAM;

    
    
  • Apache config file:
    

    <Directory /www/secure> AuthName "SomeName" AuthType Cookie CookieAuth on CookieAuth_DBhost localhost CookieAuth_DBName authdb CookieAuth_DBUser mike CookieAuth_DBPassword pass1234 CookieAuth_DBtable apacheauth CookieAuth_UsernameField username CookieAuth_SessnameField sessname CookieAuth_SessvalField sesskey CookieAuth_RemoteIPField remoteip CookieAuth_FailureURL /error.html require user bill thimo </Directory>

    
    
  • PHP Code to set the cookie:
    

    <?php $ip=getenv("REMOTE_ADDR"); $sessname="abc"; $sesskey="abc"; $expires=time()+60*60*24*30; // expires in one month $cookie=setcookie($sessname,$sesskey,$expires,"/","www.mydomain.com"); // set cookie for www.mydomain.com $query="INSERT INTO $tbname '$sessname','$sesskey','$expires','$ip','mark'"; // this adds the data into a MySQL database ?>

    
    
• Bugs:
  If you have found a bug, please report them to me!
  
• License:
  This module is licensed under the Apache License
  
• Download:
  mod_auth_cookie_mysql2_0.3.tar.gz
  
• Contact:
  If you have further questions or bug reports, please feel free to contact me:
  E-Mail: apache-mod at digithi.de
  Website: http://home.digithi.de/digithi/dev/mod_auth_cookie_mysql2.html