Apache 2.4

[Cantor, Scott]

> Do you recall back in 2007 when I was doing the initial COmanage work we
> had a few go-arounds regarding how Apache handles authZ - I was wanting
> to get Apache to do shib for authN but then LDAP group based authZ.  I have
> not looked at any of the 2.4 stuff but I was wondering about your thoughts as
> to whether or not this sort of thing will finally be possible with 2.4?

As far as I remember, it's possible now, that's what the AuthzShibAuthoritative command is for. Today, each authz module has to expose a flag like that so that if they don't understand some of the require options, control will be passed to a later module. If you want to combine them today, you have to select one module to be the final authority, and you have to avoid things Apache doesn't support, like AND logic between rules handled by separate modules.

At the time you asked about it, there was no flag supported. Once I understood the undocumented convention that module writers were expected to follow to get around the limitation, I added it.

With 2.4, that need goes away, and support for AND/OR containers is provided by the core. There's no single module that's considered authoritative because the logic tree is implemented by mod_authz_core. In return, they broke all older authz modules.

-- Scott