Individual Authenticator (Daemon) for Apache Wildcard-VHosts

Question

In our development environment we're using the following VHost-Configuration for the majority of our projects:

<VirtualHost *>
    ServerName misc.webdev.local
    ServerAlias *.webdev.local
    UseCanonicalName Off
    VirtualDocumentRoot /var/www/webdev.local/%0/htdocs

    <Directory "/var/www/webdev.local/*/htdocs"> 

        # Some configuration

    </Directory> 

</VirtualHost>

With this dynamic vhost configuration we don't need to add a vhost config for each project.

My goal is to set a semi automatic basic access authentication for these dynamic vhost. For example:

• Project A has no specific useraccounts so take the default account (eg. User / Password)
• Project B has a specific useraccount to take this specific account to be required for login

This should happen without the need to change the apache configuration

1) My first attempt was to compile mod_authnz_external as an apache module to pass the authentication data to an external script which could check the provided useraccount data against a postgresql database. This setup worked but is really slow because the external script is instantiated for every http-request.

I know that there are several apache modules out there to pass the authentication data to the database directly but with this solution I can't specify default accounts or fallbacks for specific projects

2) My second attempt is more a compromise than the ideal solution. But, apart from that, I don't know how to accomplish this (in pseudo code):

    ...
    <Directory "/var/www/webdev.local/*/htdocs"> 

        Deny from all
        AuthType Basic

        <IfFileExists "/var/www/accounts/%0.htpasswd">
               AuthUserFile /var/www/accounts/%0.htpasswd
        <Else>
               AuthUserFile /var/www/accounts/default.htpasswd
        </IfFileExists>         

        AuthName "please log in"
        require valid-user
        Satisfy any

    </Directory>
    ...

But because there is no IfFileExists directive on the one hand and no possibility to use the dynamic VHost wildcard in this context on the other hand I don't know if and how this is possible?

3) I think the ideal solution is if apache would passes the given authentication data from the user to a small socket daemon and builds a small cache where is stores the return value for several minutes.

The author of mod_authnz_external already thought about it but there is now implementation at this moment.

---

So I wonder if anyone of you has some input for me?

Thanks folks and best regards

Adrian

Answer 1

You can use a fastcgi authenticator, which daemonizes instead of being forked each time. It's part of the fastcgi spec and all the common fcgi modules support it.

Answer 2

I solved the problem by bypassing the http-request with mod_rewrite to a php script. This php script does the basic authentication and serves the inital requestet file via the virtual()-function