AuthGroupFile - support for nested groups?

Question

I'm currently using groups managed in a simple text file to allow for read and write access to various ressources:

res1-r: alice bob
res1-w: zak

This file is used with the AuthGroupFile directive. With the groups file growing steadily, I'd like to establish some kind of "subgrouping". Let's assume that alice and bob are members of a team and I'd like to grant read access to the entire team. In effect, I'd like to write something like:

ateam: alice bob
res1-r: @ateam

Is this possible - either directly or through some workaround?

Answer 1

Is this possible? Probably. Is it a good idea? Nope.

It looks like kind of like you're trying to reinvent the wheel. Apache supports a pretty wide variety of authentication backends and since it looks like your organization already has an LDAP implementation in the form of Active Directory I would recommend you take a look at mod_authnz_ldap. In the long run, I'm willing to bet the time it takes to implement, maintain and secure your text file based system will be significantly more than the time it takes to work with your Directory Services team.

Answer 2

In the end, I used the following perl script to get the job done:

#!/usr/bin/perl 

use strict;
use warnings;

if ($#ARGV != 0) {
    die "Usage: agc <target file>\n";
}

our %groups;

my $dstfilename = "$ARGV[0]";
my $srcfilename = "$ARGV[0].src";
open (SRCFILE, $srcfilename) or die "Could not open $srcfilename.\n";
while (<SRCFILE>) {
    chomp;
    if ($_ =~ /^(.*)\s*:\s*(.*)$/) {
        $groups{$1} = $2;
    }
}
close (SRCFILE);

open (DSTFILE, ">$dstfilename") or die "Could not open $dstfilename.\n";
print DSTFILE "# CAUTION: This file was generated from $srcfilename.\n";
print DSTFILE "# DO NOT EDIT MANUALLY - all changes will be lost upon re-generation.\n";
print DSTFILE "# Instead, edit $srcfilename and run 'agc $dstfilename'.\n";
foreach my $key (sort (keys (%groups))) {
    print DSTFILE "$key:";
    my @elems = split(/\s/, $groups{$key});
    foreach my $elem (@elems) {
        if ($elem =~ /^@(.*)/) {
            print DSTFILE " " . $groups{$1};
        } else {
            print DSTFILE " $elem";
        }
    }
    print DSTFILE "\n";
}
close (DSTFILE);