Thanks for the help.<br>
<br>
I feel not comfortable to put the username in URL. User may be able to
bypass the authentication and direct access zope with username in URL.<br>
<br>
And that's true, Apache can pass environment variable via mod_rewrite. What's a pity.<br>
<br>
Now the only solution I found is only working in Apache2 not 1.3. I can
use mod_header. requestheader can add http header to request before
mod_rewrite pass it to zope. I can put REMOTE_USER in http header and
zope will be able to pick it up. User will still be able to bypass the
check if they can use special web browser which can add http header.
But at least with standard IE & Firefox, this method will be safe.<br>
<br>
But I'm still using Apache 1.3. Above solution can't apply. :(<br><br>
I'm giving up. Maybe just use some browser script to submit current username to CredentialsPlugin.<br>
This will be easy, just write my own version of <a href="http://loginform.pt">loginform.pt</a>, and that will work. But it's ugly.<br>
<br>
Thanks,<br>
Simon<br>
<br><div><span class="gmail_quote">On 11/13/05, <b class="gmail_sendername">Philipp von Weitershausen</b> <<a href="mailto:philipp@weitershausen.de">philipp@weitershausen.de</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Florent Guillaume wrote:<br>>> Well, Zope 3 doesn't care that Apache has authenticated your user. It<br>>> doesn't see that. If you want the Zope 3 security system to interact<br>>> with Apache's, here's a suggestion (not sure if it'll actually work):
<br>>><br>>> - Have Apache forward the REMOTE_USER CGI env variable, e.g. by using<br>>> the "E" flag at the end of rewrite rule:<br>>><br>>> [P,L,E=REMOTE_USER:%{REMOTE_USER}]<br>
><br>><br>> Will that really work? env variables are only useful in CGI mode, but<br>> proxying doesn't involve CGI. Rather I'd advise using additional<br>> parameters to the URL, like we do here for Zope 2 for instance:
<br>><br>> <a href="http://svn.nuxeo.org/trac/pub/file/CMFNtlmSso/trunk/doc/vhost_sso.conf">http://svn.nuxeo.org/trac/pub/file/CMFNtlmSso/trunk/doc/vhost_sso.conf</a><br><br>Ah, yes. I thought of this initially but found the env way to be
<br>cleaner, simply assuming that mod_rewrite would pass the current env<br>along on the proxy request. It seems it doesn't.<br><br>Good example config, by the way.<br><br>>> - Have a custom ICredentialsPlugin that's simply looks at this env
<br>>> variable in the request for the log-in credentials. To challenge the<br>>> user for authentication, it would simply use the same authentication<br>>> realm as set in the apache.conf, so that it gets picked up by Apache
<br>>> when the user provides the credentials.<br>><br>><br>> And this plugin would have to get the credentials from the URL instead<br>> of the env variable. I wish apache had a proper way to add request
<br>> headers during proxying...<br><br>Yup and yup.<br><br>Philipp<br>_______________________________________________<br>Zope3-users mailing list<br><a href="mailto:Zope3-users@zope.org">Zope3-users@zope.org</a><br><a href="http://mail.zope.org/mailman/listinfo/zope3-users">
http://mail.zope.org/mailman/listinfo/zope3-users</a><br></blockquote></div><br>