Red Hat DIRECTORY SERVER 2.0 - GATEWAY Instrukcja Użytkownika Pobierz pdf (Strona 77)

Chapter 10. Access control

query redirected through a web proxy or cache will have the address of the web

proxy or cache.

Allow from 131.111

Access is allowed for queries originating from IP addresses whose ﬁrst two bytes

are 131.111. Note that Cambridge has more networks than just this primary one.

Allow from 131.111.10.0/255.255.254

Access is allowed from any IP address which when masked by 255.255.254.0

gives 131.111.10.0.

Allow from 131.111.10.0/23

Access is allowed from any IP address whose ﬁrst 23 bits form the address

131.111.10.0.

If you want to pass control of this to the delegated conﬁguration ﬁles then you must

pass the Limit option to the AllowOverride command. This command must also

appear in a <Directory> command.

LoadModule access_module modules/mod_access.so

AllowOverride Limit

</Directory>

Figure 10-3. Allowing access control to be delegated.

Access control by client identity

The alternative mechanism for restricting access to web pages is to demand a userid

and password from the user.

HTTP and userid/password

1. Browser sends request for a web page.

2. Server sends back a 401 error code and speciﬁes a realm.

3. Browser prompts user for userid and password for the realm.

4. User quotes userid and password.

5. Browser repeats the initial request with an extra header quoting the userid and pass-

word.

6. Server sends the page if the userid/password are OK.

7. Browser sends request for another web page.

8. Server sends back a 401 error code and speciﬁes the same realm.

9. Browser recovers the userid and password it has for that realm and repeats the

initial request with the extra header.

10. Server sends the page.

Of course things are different if the userid and password don’t grant access to the

page. There are two ways this can happen. The user and password could match but

that user, now identiﬁed, might not be allowed access to the page. In this case the

server sends back a 403, Forbidden, error code. Alternatively, the userid and pass-

word might not match, in which case the server sends back the 401 code again and

the cycle of prompting the user repeats.

1 2 ... 72 73 74 75 76 77 78 79 80 81 82 ... 95 96

Brak uwag

Red Hat DIRECTORY SERVER 2.0 - GATEWAY Instrukcja Użytkownika Strona 77