From: ahoward <ahoward@...>
Date: 2003-06-21T02:56:40+09:00
Subject: authentication and monolithic fcgi programs



fastcgi'rs-

i have the following situation

  #!/usr/local/bin/ruby

  FCGI.each do |cgi|
    authmode = cgi['authmode']

    case authmode
      when 'insecure'
	# generate html
      when 'secure'
	# authenticate
	# generate different html
    end
  end


i'm using the apache pam module and .htaccess file for access/auth control.
my thoughts are that something like

  ./index.cgi

  ./secure/index.cgi -> ../index.cgi
  ./secure/.htaccess

may work.  huh you say?  i mean that by having *one* fastcgi program but also
having a soft link to the *same* cgi in a directory which contains an
..htaccess file may allow me to provide two urls for the same fastcgi program:

  * one which does not require auth since it lives in a non-htaccess directory
  * one which *does* require auth since it lives in a htaccess protected
    directory

my concern is this:  will mod_fastcgi start *two* process if a fastcgi program
is accessed via two different urls - eg. does mod_fastcgi 'follow links' to
determine what is running, or will i end up with two (pools) of fastcgi
processes: one running securely and one running insecurely?

of course, there may be solutions to this (authentication for *part* of a
fastcgi process) problem that i have not considered and i would be happy for
any suggestions.  perhaps something exists in the fastcgi api i am unaware of?

thanks.

-a
--
  ====================================
  | Ara Howard
  | NOAA Forecast Systems Laboratory
  | Information and Technology Services
  | Data Systems Group
  | R/FST 325 Broadway
  | Boulder, CO 80305-3328
  | Email: ara.t.howard@noaa.gov
  | Phone:  303-497-7238
  | Fax:    303-497-7259
  | ~ > ruby -e 'p(%.\x2d\x29..intern)'
  ====================================