Re: [ADMIN] Apache authentication & PostgreSQL

On Fri, 11 Jun 1999, Jan Wieck wrote:

> Fomichev Mikhail wrote:
> 
> > Hi, all !
> > I'm trying to show data from the PostgreSQL database to the Web page,
> > using WWW-SQL. I want the users to get an access to the database from the
> > browsers under their own names. To achieve this I configured Apache so
> > that it would authenticate an user when the user enters the directory with
> > CGI-scripts. I'd like that the name and the password of the user having
> > been authenticated, will be used in CGI-script for the access to the
> > database.
> > I can get the user's name via environment variable $REMOTE_USER, wich is
> > set by Apache.
> >
> > Now the question: is it possible to get the password, which the user has
> > entered by the authentication ?
> >
> > I know one solution. But it requires hacking of Apache.
> 
>     Generally  it's  not such a bad idea to tell which version of
>     Apache you're using.
> 
I'm using 1.3.3 version.

>     Anyway, if you have a 1.3.3, you must compile it with
> 
>         -D SECURITY_HOLE_PASS_AUTHORIZATION
> 
>     In  that  case,  Apache  will  set  an  environment  variable
>     HTTP_AUTHORIZATON   whenever  it  sets  AUTH_TYPE.  That  is,
>     whenever a cgi is accessed that is  protected  by  a  require
>     directive so you need username/password to get it.
> 
>     The  variable  HTTP_AUTHORIZATION  contains the auth type and
>     for "Basic" authentication "username:password" b64 encoded.
> 
>     As the define clearly states, it's a security hole.  If users
>     are  allowed  to  use selfmade cgi's in their homepage, these
>     can potentially steel passwords. And users might  also  steel
>     passwords using 'ps -e'.
> 
>     Thus,  having  the username:password passed down into the cgi
>     script is really only a last  resort.  In  general  your  CGI
>     scripts  should use a pseudo user to contact the database. If
>     someone can call a CGI script but  should  not  have  the  db
>     access  permissions  required therein, something's wrong with
>     the entire design - back to drawing board.  If  the  user  is
>     already authenticated by Apache, why let PostgreSQL check the
>     password again?
> 
I want to give different access rights to the database for different
users (for select, for update, etc.). I can't do this using a pseudo user
to contact the database. In CGI script I can connect to the database with 
another username/password then a pseudo user, but I don't know the 
password of authenticated user. May be there is another way to do this ?