[0001]
[0002]
[0003]
[0004]
[0005]
[0006]
[0007]
[0008]
[0009]
[0010]
[0011]
[0012]
[0013]
[0014]
[0015]
[0016]
[0017]
[0018]
[0019]
[0020]
[0021]
[0022]
[0023]
[0024]
[0025]
[0026]
[0027]
[0028]
[0029]
[0030]
[0031]
[0032]
[0033]
[0034]
[0035]
[0036]
[0037]
[0038]
[0039]
[0040]
[0041]
[0042]
[0043]
[0044]
[0045]
[0046]
[0047]
[0048]
[0049]
[0050]
[0051]
[0052]
[0053]
[0054]
[0055]
[0056]
[0057]
[0058]
[0059]
[0060]
[0061]
[0062]
[0063]
[0064]
[0065]
[0066]
[0067]
[0068]
[0069]
[0070]
[0071]
[0072]
[0073]
[0074]
[0075]
[0076]
[0077]
[0078]
[0079]
[0080]
[0081]
[0082]
[0083]
[0084]
[0085]
[0086]
[0087]
[0088]
[0089]
[0090]
[0091]
[0092]
[0093]
[0094]
[0095]
[0096]
[0097]
[0098]
[0099]
[0100]
[0101]
[0102]
[0103]
[0104]
[0105]
[0106]
[0107]
[0108]
[0109]
[0110]
[0111]
[0112]
[0113]
[0114]
[0115]
[0116]
[0117]
[0118]
[0119]
[0120]
[0121]
[0122]
[0123]
[0124]
[0125]
[0126]
[0127]
[0128]
[0129]
[0130]
[0131]
[0132]
[0133]
[0134]
[0135]
[0136]
[0137]
[0138]
[0139]
[0140]
[0141]
[0142]
[0143]
[0144]
[0145]
[0146]
[0147]
[0148]
[0149]
[0150]
[0151]
[0152]
[0153]
[0154]
[0155]
[0156]
[0157]
[0158]
[0159]
[0160]
[0161]
[0162]
[0163]
[0164]
[0165]
[0166]
[0167]
[0168]
[0169]
[0170]
[0171]
[0172]
[0173]
[0174]
[0175]
[0176]
[0177]
[0178]
[0179]
[0180]
[0181]
[0182]
[0183]
[0184]
[0185]
[0186]
[0187]
[0188]
[0189]
[0190]
[0191]
[0192]
[0193]
[0194]
[0195]
[0196]
[0197]
[0198]
[0199]
[0200]
[0201]
[0202]
[0203]
[0204]
[0205]
[0206]
[0207]
[0208]
[0209]
[0210]
[0211]
[0212]
[0213]
[0214]
[0215]
[0216]
[0217]
[0218]
[0219]
[0220]
[0221]
[0222]
[0223]
[0224]
[0225]
[0226]
[0227]
[0228]
[0229]
[0230]
[0231]
[0232]
[0233]
[0234]
[0235]
[0236]
[0237]
[0238]
[0239]
[0240]
[0241]
[0242]
[0243]
[0244]
[0245]
[0246]
[0247]
[0248]
[0249]
[0250]
[0251]
[0252]
[0253]
[0254]
[0255]
[0256]
[0257]
[0258]
[0259]
[0260]
[0261]
[0262]
[0263]
[0264]
[0265]
[0266]
[0267]
[0268]
[0269]
[0270]
[0271]
[0272]
[0273]
[0274]
[0275]
[0276]
[0277]
[0278]
[0279]
[0280]
[0281]
[0282]
[0283]
[0284]
[0285]
[0286]
[0287]
[0288]
[0289]
[0290]
[0291]
[0292]
[0293]
[0294]
[0295]
[0296]
[0297]
[0298]
[0299]
[0300]
[0301]
[0302]
[0303]
[0304]
[0305]
[0306]
[0307]
[0308]
[0309]
[0310]
[0311]
[0312]
[0313]
[0314]
[0315]
[0316]
[0317]
[0318]
[0319]
[0320]
[0321]
[0322]
[0323]
[0324]
[0325]
[0326]
[0327]
[0328]
[0329]
[0330]
[0331]
[0332]
[0333]
[0334]
[0335]
[0336]
[0337]
[0338]
[0339]
[0340]
[0341]
[0342]
[0343]
[0344]
[0345]
[0346]
[0347]
[0348]
[0349]
[0350]
[0351]
[0352]
[0353]
[0354]
[0355]
[0356]
[0357]
[0358]
[0359]
[0360]
[0361]
[0362]
[0363]
[0364]
[0365]
[0366]
[0367]
[0368]
[0369]
[0370]
[0371]
[0372]
[0373]
[0374]
[0375]
[0376]
[0377]
[0378]
[0379]
[0380]
[0381]
[0382]
[0383]
[0384]
[0385]
[0386]
[0387]
[0388]
[0389]
[0390]
[0391]
[0392]
[0393]
[0394]
[0395]
[0396]
[0397]
[0398]
[0399]
[0400]
[0401]
[0402]
[0403]
[0404]
[0405]
[0406]
[0407]
[0408]
[0409]
[0410]
[0411]
[0412]
[0413]
[0414]
[0415]
[0416]
[0417]
[0418]
[0419]
[0420]
[0421]
[0422]
[0423]
[0424]
[0425]
[0426]
[0427]
[0428]
[0429]
[0430]
[0431]
[0432]
[0433]
[0434]
[0435]
[0436]
[0437]
[0438]
[0439]
[0440]
[0441]
[0442]
[0443]
[0444]
[0445]
[0446]
[0447]
[0448]
[0449]
[0450]
[0451]
[0452]
[0453]
[0454]
[0455]
[0456]
[0457]
[0458]
[0459]
[0460]
[0461]
[0462]
[0463]
[0464]
[0465]
[0466]
[0467]
[0468]
[0469]
[0470]
[0471]
[0472]
[0473]
[0474]
[0475]
[0476]
[0477]
[0478]
[0479]
[0480]
[0481]
[0482]
[0483]
[0484]
[0485]
[0486]
[0487]
[0488]
[0489]
[0490]
[0491]
[0492]
[0493]
[0494]
[0495]
[0496]
[0497]
[0498]
[0499]
[0500]
[0501]
[0502]
[0503]
[0504]
[0505]
[0506]
[0507]
[0508]
[0509]
[0510]
[0511]
[0512]
[0513]
[0514]
[0515]
[0516]
[0517]
[0518]
[0519]
[0520]
[0521]
[0522]
[0523]
[0524]
[0525]
[0526]
[0527]
[0528]
[0529]
[0530]
[0531]
[0532]
[0533]
[0534]
[0535]
[0536]
[0537]
[0538]
[0539]
[0540]
[0541]
[0542]
[0543]
[0544]
[0545]
[0546]
[0547]
[0548]
[0549]
[0550]
[0551]
[0552]
[0553]
[0554]
[0555]
[0556]
[0557]
[0558]
[0559]
[0560]
[0561]
[0562]
[0563]
[0564]
[0565]
[0566]
[0567]
[0568]
[0569]
[0570]
[0571]
[0572]
[0573]
[0574]
[0575]
[0576]
[0577]
[0578]
[0579]
[0580]
[0581]
[0582]
[0583]
[0584]
[0585]
[0586]
[0587]
[0588]
[0589]
[0590]
[0591]
[0592]
[0593]
[0594]
[0595]
[0596]
[0597]
[0598]
[0599]
[0600]
[0601]
[0602]
[0603]
[0604]
[0605]
[0606]
[0607]
[0608]
[0609]
[0610]
[0611]
[0612]
[0613]
[0614]
[0615]
[0616]
[0617]
[0618]
[0619]
[0620]
[0621]
[0622]
[0623]
[0624]
[0625]
[0626]
[0627]
[0628]
[0629]
[0630]
[0631]
[0632]
[0633]
[0634]
[0635]
[0636]
[0637]
[0638]
[0639]
[0640]
[0641]
[0642]
[0643]
[0644]
[0645]
[0646]
[0647]
[0648]
[0649]
[0650]
[0651]
[0652]
[0653]
[0654]
[0655]
[0656]
[0657]
[0658]
[0659]
[0660]
[0661]
[0662]
[0663]
[0664]
[0665]
[0666]
[0667]
[0668]
[0669]
[0670]
[0671]
[0672]
[0673]
[0674]
[0675]
[0676]
/*****************************************************************************/
/*
authagent_example.c
Example authentication agent CGIplus script, using the callout mechanism.
For some in-built usernames and passwords that can be used for
experimentation/demonstration see AuthenticateUser() structure array
UserNamePasswordPairs[].
This example can be used in four ways.
1. As a realm authenticator.
Here the agent is simply used to authenticate the user password for the realm.
["Authentication Agent test 1"=AUTHAGENT_EXAMPLE=agent]
/some/path/or/other/*
Load the new authorization and access the path (for username/password details
see AuthenticateUser() below). Of course processing can be WATCHed.
2. For determining group membership.
["Authentication Agent test 2"=AUTHAGENT_EXAMPLE=agent;AUTHAGENT_EXAMPLE=agent]
/some/path/or/other/*
Now group membership must be determined before access is granted (the agent is
used twice, first for authentication then for group membership). Note that in
MemberOfGroup() only "moe", "larry" and "curly" are group members, "mark" is
not and so should be refused access.
3. As a complete authenticator/authorizor.
Using the path, query string, remote host, etc., CGI variables, along with
authentication-specific ones, the agent can assume the role of complete
authenticator with any and all checks and processing desired. To provide
per-path information to such an authenticator the "param=" authorization
keyword allows any parameter(s) required (they can be placed in single or
double quotes if required). Typically this might be the source of the
authentication. The third example demonstrates this.
["Authentication Agent test 3"=AUTHAGENT_EXAMPLE=agent]
/some/path/or/other/* param=WASD_ROOT:[SRC.CGIPLUS]AUTHAGENT_EXAMPLE.LIS
4. As a non-username/password authenticator
Normally an agent uses the WWW_REMOTE_USER and WWW_AUTH_PASSWORD, or the
WWW_HTTP_AUTHORIZATION, CGI variables to obtain authorization information
supplied in the request header. These are initially requested by the server
automatically generating a 401/WWW-Authorize: response when there are none
present. Of course it is possible for an agent to perform authorization
outside of this mechanism (examples implemented internally by the WASD server
include SSL X.509 client certificate, and the RFC1413 identification protocol).
To suppress the automatic requesting of a username/password by the server make
the first portion of the agent parameter "/NO401". The server detects this and
suppresses it's initial 401 response. For example
["Authentication Agent test 4"=AUTHAGENT_EXAMPLE=agent]
/some/path/or/other/* param="/NO401 ANY-OTHER-PARAMETER"
GENERAL GUIDELINES
------------------
The CGI variable WWW_AUTH_AGENT will *only* exist for authentication agents and
may be used to verify the HTTPd invoked the script, not a user. If this
variable does not exist the authentication agent should immediately exit. The
agent should also check that it is executing within the CGIplus environment and
also immediately exit if not. All normal CGI/CGIplus variables are available
for use if desired (.e.g WWW_PATH_INFO, WWW_QUERY_STRING, etc.)
The server processes records, hence each "line" of output must be fflush()ed so
as not to be buffered by the CRTL.
The authentication agent may request the server to directly output an error
message. The response line must begin "500 ", with any text following the
status code being output as the error message. Generally this would not be
necessary as the server will generate an appropriate message for authentication
or group membership failure.
The WATCH facility is a valuable adjunct in understanding/debugging agent
script behaviour. Response lines beginning "000 " are ignored and may be used
to provide WATCHable debug information (remembering all I/O adds to overhead in
production scripts).
(Debug) may also be turned on. Although this will prevent the script engaging
in a dialog with the server it will output the debug information directly to
the browser, which may provide further information when developing/debugging.
AUTHENTICATING A USERNAME/PASSWORD
----------------------------------
The transaction details are found in the following CGI variables.
WWW_AUTH_AGENT .................. "REALM" or other parameter
WWW_AUTH_PASSWORD ............... user supplied case-sensitive password
WWW_AUTH_REALM .................. realm name (same as agent name)
WWW_AUTH_REALM_DESCRIPTION ...... realm description user is prompted with
WWW_REMOTE_USER ................. case-sensitive username
The WWW_AUTH_AGENT variable indicates whether authentication ("REALM") or group
membership ("GROUP") is being requested. The realm description could be used
to differentiate multiple authentication realms to the one script (as
WWW_AUTH_REALM is always set to the name of the agent script).
Return a response (digits and 'access' are mandatory, other text is optional -
although can provide valuable development/debugging information):
'000 any text' ........... ignored by the server, provides WATCHable debug info
'100 AUTHAGENT-CALLOUT' .. server abort if the agent is being run as a script
'100 LIFETIME integer' ... set script's CGIplus lifetime (zero makes infinite)
'100 NOCACHE' ............ do not cache the results of this authorization
'100 REASON any text' .... reason for the authentication being denied
'100 REMOTE-USER name .... provide user name (authenticated some non-401 way)
'100 VMS-USER name ....... this username is a VMS username, treat it as such
'100 SET-COOKIE cookie' .. RFC2109 cookie (generates "Set-Cookie:" header)
'100 USER any text' ...... provide user details (only after 200 response)
'200 access' ............. the username/password verified
access: "READ", "WRITE", "READ+WRITE", "FULL"
'401 reason' ............. username/password did not verify
'401 "realm"' ............ did not verify, (quoted) browser prompt string
'403 reason' ............. access is forbidden
'500 description' ........ script error to be reported via server
VMS-USER issues: when a VMS-USER is passed back to the server the username
undergoes all VMS authorization processing (e.g. ID, prime days, etc) - except
password checking, it is assumed the agent has authenticated the username. The
access level (R, R+W, etc.) is derived from the SYSUAF information - unless the
agent *subsequently* provides a "200 access" callout. The user details come
from the SYSUAF - unless the agent *subsequently* provides a "100 USER details"
callout.
ESTABLISHING GROUP MEMBERSHIP
-----------------------------
The transaction details are found in the following CGI variables.
WWW_AUTH_AGENT .................. "GROUP"
WWW_AUTH_GROUP .................. name of group
WWW_REMOTE_USER ................. case-sensitive username
Valid responses (digits are mandatory, other text is optional):
'000 any text' ........... ignored by the server, provides WATCHable debug info
'100 LIFETIME integer' ... set script's CGIplus lifetime (zero makes infinite)
'100 NOCACHE' ............ do not cache the results of this authorization
'100 REASON any text' .... reason for the authentication being denied
'100 SET-COOKIE cookie' .. RFC2109 cookie (generates "Set-Cookie:" header)
'200 any text' ........... indicates group membership
'403 reason' ............. indicates not a group member
'500 description' ........ script error to be reported via server
LOGICAL NAMES
-------------
AUTHAGENT_EXAMPLE_NO401 see above
AUTHAGENT_EXAMPLE$DBUG turns on all "if (Debug)" statements
AUTHAGENT_EXAMPLE$WATCH turns on agent "000 message" WATCH statements
Debug statements do not work very well inside authentication agent scripts.
Use the WATCH statements using the server WATCH facility to observe script
processing (for debug purposes).
BUILD DETAILS
-------------
Compile then link:
$ @BUILD_AUTHAGENT_EXAMPLE
To just link:
$ @BUILD_AUTHAGENT_EXAMPLE LINK
COPYRIGHT
---------
Copyright (C) 1999-2021 Mark G.Daniel
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
VERSION HISTORY (update SOFTWAREVN as well)
---------------
10-JUN-2021 MGD v2.0.0, minimal changes for WASD v12... agent requirements
11-MAY-2007 MGD v1.6.2, belt-and-braces
23-DEC-2003 MGD v1.6.1, minor conditional mods to support IA64
08-MAR-2003 MGD v1.6.0, add '100 REASON text' for username/password failure
28-FEB-2001 MGD v1.5.0, example of /NO401 functionality
01-FEB-2001 MGD v1.4.0, add VMS-USER and demonstration capability
18-JAN-2001 MGD v1.3.0, an agent can now '100 REMOTE-USER username'
06-DEC-2000 MGD v1.2.0, an agent can now '100 SET-COOKIE rfc2109-cookie'
28-OCT-2000 MGD v1.1.0, use CGILIB object module
06-SEP-1999 MGD v1.0.0, initial development
*/
/*****************************************************************************/
#define SOFTWAREVN "2.0.0"
#define SOFTWARENM "AUTHAGENT_EXAMPLE"
#ifdef __ALPHA
# define SOFTWAREID SOFTWARENM " AXP-" SOFTWAREVN
#endif
#ifdef __ia64
# define SOFTWAREID SOFTWARENM " IA64-" SOFTWAREVN
#endif
#ifdef __x86_64
# define SOFTWAREID SOFTWARENM " X86-" SOFTWAREVN
#endif
/* standard C header files */
#include <ctype.h>
#include <errno.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
/* VMS related header files */
#include <descrip.h>
#include <ssdef.h>
#include <stsdef.h>
/* application header files */
#include <cgilib.h>
#define VMSok(x) ((x) & STS$M_SUCCESS)
#define VMSnok(x) !(((x) & STS$M_SUCCESS))
#define boolean int
#define true 1
#define false 0
/******************/
/* global storage */
/******************/
char Utility [] = "AUTHAGENT_EXAMPLE";
int CgiPlusUsageCount;
boolean Debug,
DebugWatch;
char SoftwareId [64];
/*****************************************************************************/
/*
*/
main ()
{
int status;
char *cptr;
/*********/
/* begin */
/*********/
sprintf (SoftwareId, "%s (%s)", SOFTWAREID, CgiLibEnvironmentVersion());
Debug = (getenv ("AUTHAGENT_EXAMPLE$DBUG") != NULL);
DebugWatch = (getenv ("AUTHAGENT_EXAMPLE$WATCH") != NULL);
CgiLibEnvironmentSetDebug (Debug);
CgiLibEnvironmentInit (0, NULL, false);
/* MUST only be executed in a CGIplus environment! */
if (!CgiLibEnvironmentIsCgiPlus ())
{
CgiLibResponseHeader (502, "text/plain");
fputs ("CGIplus!\n", stdout);
exit (SS$_NORMAL);
}
for (;;)
{
/* block waiting for the next request */
CgiLibVar ("");
CgiPlusUsageCount++;
if (cptr = CgiLibVarNull("REQUEST_METHOD"))
if (!*cptr)
{
/* proctored into existance */
CgiLibResponseHeader (204, "application/proctor");
CgiLibCgiPlusEOF ();
continue;
}
CgiLibCgiPlusCallout ("!AGENT-BEGIN: %s (%s) usage:%d",
SoftwareId, CgiLibEnvironmentVersion(),
CgiPlusUsageCount);
ProcessRequest ();
CgiLibCgiPlusCallout ("!AGENT-END:");
CgiLibCgiPlusEOF ();
}
}
/*****************************************************************************/
/*
Main authentication request processing function.
*/
ProcessRequest ()
{
int status;
char *AllowedClientPtr,
*AuthAgentPtr,
*PasswordPtr,
*RemoteAddrPtr,
*UserNamePtr;
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "ProcessRequest()\n");
/* provide the server attention "escape" sequence record */
if (!Debug) CgiLibCgiPlusESC ();
/* ensure this is being invoked by the server */
if ((AuthAgentPtr = CgiLibVarNull ("WWW_AUTH_AGENT")) == NULL)
exit (SS$_ABORT);
/* belt and braces */
fprintf (stdout, "100 AUTHAGENT-CALLOUT\n");
fflush (stdout);
if (DebugWatch)
{
/* just a comment that can be WATCHed */
fprintf (stdout, "000 [%d] %s\n", __LINE__, SoftwareId);
fflush (stdout);
}
if (strsame (AuthAgentPtr, "REALM", -1))
{
/* "standard" use of agent to authenticate user */
UserNamePtr = CgiLibVar ("WWW_REMOTE_USER");
PasswordPtr = CgiLibVar ("WWW_AUTH_PASSWORD");
AuthenticateUser (UserNamePtr, PasswordPtr);
}
else
if (strsame (AuthAgentPtr, "GROUP", -1))
{
/* "standard" use of agent to authorize group membership */
UserNamePtr = CgiLibVar ("WWW_REMOTE_USER");
MemberOfGroup (UserNamePtr);
}
else
if (strsame (AuthAgentPtr, "/NO401", 6))
{
/* non-user/pass authorization (example based on client IP address) */
AllowedClientPtr = getenv ("AUTHAGENT_EXAMPLE_NO401");
RemoteAddrPtr = CgiLibVar ("WWW_REMOTE_ADDR");
if (AllowedClientPtr == NULL ||
!strsame (AllowedClientPtr, RemoteAddrPtr, -1))
{
/* logical name not defined or not the same as client IP address */
fprintf (stdout, "403 Not %s\n",
AllowedClientPtr == NULL ? "defined!" : AllowedClientPtr);
fflush (stdout);
}
else
{
/* logical name is the same as client IP address */
fprintf (stdout, "200 READ+WRITE\n");
fflush (stdout);
}
}
else
{
/* HTTPD$AUTH "param=" used to pass authentication source file name */
UserNamePtr = CgiLibVar ("WWW_REMOTE_USER");
PasswordPtr = CgiLibVar ("WWW_AUTH_PASSWORD");
AuthenticateFromList (AuthAgentPtr, UserNamePtr, PasswordPtr);
}
/* provide the "escape" end-of-text sequence record */
if (!Debug) CgiLibCgiPlusEOT ();
}
/*****************************************************************************/
/*
Example username/password verification function.
*/
AuthenticateUser
(
char *UserNamePtr,
char *PasswordPtr
)
{
static struct
{
char *UserName;
char *Password;
char *Details;
boolean ReturnCookie;
boolean VmsUser;
} UserNamePasswordPairs [] =
{
{ "username", "password", "(just to show which is which)", false, false },
{ "mark", "daniel", "Mark Daniel, +61 8 82596031", false, false },
{ "daniel", "daniel", "Mark Daniel (VMS-USER)", false, true },
{ "no-such-user", "no-such-user", "fails (VMS-USER)", false, true },
{ "moe", "howard", "Moses Horwitz", true, false },
{ "larry", "fine", "Larry Fine", true, false },
{ "curly", "howard", "Jakob Horwitz", true, false },
{ NULL, NULL }
};
int idx;
char *cptr;
/*********/
/* begin */
/*********/
if (Debug)
fprintf (stdout, "AuthenticateUser() |%s|%s|\n",
UserNamePtr, PasswordPtr);
if (DebugWatch)
{
/* just a comment that can be WATCHed */
fprintf (stdout, "000 [%d] authenticating \"%s\"\n",
__LINE__, UserNamePtr);
fflush (stdout);
}
cptr = NULL;
for (idx = 0; UserNamePasswordPairs[idx].UserName != NULL; idx++)
{
if (!strsame (UserNamePtr, UserNamePasswordPairs[idx].UserName, -1))
continue;
cptr = "Password validation failure";
if (!strsame (PasswordPtr, UserNamePasswordPairs[idx].Password, -1))
continue;
cptr = NULL;
/* both the string and the status code are valid here */
fprintf (stdout, "200 READ+WRITE\n");
fflush (stdout);
/* supply an informational - the user's details */
fprintf (stdout, "100 USER %s\n", UserNamePasswordPairs[idx].Details);
fflush (stdout);
if (UserNamePasswordPairs[idx].VmsUser)
{
/* force this to be a VMS user (just for demonstration purposes) */
fprintf (stdout, "100 VMS-USER %s\n",
UserNamePasswordPairs[idx].UserName);
fflush (stdout);
}
if (UserNamePasswordPairs[idx].ReturnCookie)
{
/* supply a cookie (just for demonstration purposes) */
fprintf (stdout, "100 SET-COOKIE AUTHAGENT_EXAMPLE=\"%s\"\n",
SoftwareId);
fflush (stdout);
}
return;
}
if (!cptr) cptr = "Username unknown";
/* doesn't matter what the string is, only the status code is checked */
fprintf (stdout, "100 REASON %s\n", cptr);
fflush (stdout);
fprintf (stdout, "401 NOT authenticated\n");
fflush (stdout);
}
/*****************************************************************************/
/*
Example group membership function.
*/
MemberOfGroup (char *UserNamePtr)
{
static char *ThreeStooges [] = { "moe", "larry", "curly", NULL };
int idx;
/*********/
/* begin */
/*********/
if (Debug) fprintf (stdout, "MemberOfGroup() |%s|\n", UserNamePtr);
if (DebugWatch)
{
/* just a comment that can be WATCHed */
fprintf (stdout, "000 [%d] checking group membership of \"%s\"\n",
__LINE__, UserNamePtr);
fflush (stdout);
}
for (idx = 0; ThreeStooges[idx] != NULL; idx++)
{
if (!strsame (UserNamePtr, ThreeStooges[idx], -1)) continue;
/* doesn't matter what the string is, only the status code is checked */
fprintf (stdout, "200 YES\n");
fflush (stdout);
return;
}
/* doesn't matter what the string is, only the status code is checked */
fprintf (stdout, "403 NO\n");
fflush (stdout);
}
/*****************************************************************************/
/*
Example authentication from list kept in external file function.
'ListFileNamePtr' ("WWW_AUTH_AGENT", from "param=") contains the file name.
This simple example just looks for the user name and compares any plain-text
password it finds equated to it (e.g. "mark=daniel"). Any text that follows
the white-space delimited password is used as the user detail (.e.g
"mark=daniel Mark Daniel, Mark.Daniel@dsto.defence.gov.au").
*/
AuthenticateFromList
(
char *ListFileNamePtr,
char *UserNamePtr,
char *PasswordPtr
)
{
register char *sptr, *cptr;
boolean EndOfFile;
int idx;
char Line [256];
FILE *ListFile;
/*********/
/* begin */
/*********/
if (Debug)
fprintf (stdout, "AuthenticateFromList() |%s|%s|%s|\n",
ListFileNamePtr, UserNamePtr, PasswordPtr);
if (DebugWatch)
{
/* just a comment that can be WATCHed */
fprintf (stdout, "000 [%d] authenticating \"%s\" from \"%s\"\n",
__LINE__, UserNamePtr, ListFileNamePtr);
fflush (stdout);
}
if (!ListFileNamePtr[0])
{
/* error string will be reported by the server */
fprintf (stdout, "500 Database not specified.\n");
return;
}
if ((ListFile = fopen (ListFileNamePtr, "r", "shr=get")) == NULL)
{
/* error string will be reported by the server */
fprintf (stdout, "500 Database open error %%X%08.08X\n", vaxc$errno);
return;
}
while (EndOfFile = (fgets (Line, sizeof(Line), ListFile) != NULL))
{
if (Debug) fprintf (stdout, "|%s|\n", Line);
/* skip leading white-space */
for (cptr = Line; *cptr && isspace(*cptr); cptr++);
/* ignore comment lines */
if (*cptr == '#' || *cptr == '!') continue;
/* case sensitive comparison of user names */
sptr = UserNamePtr;
while (*cptr && *cptr != '=' && !isspace(*cptr) && *sptr)
{
if (*cptr != *sptr) break;
cptr++;
sptr++;
}
if (Debug) fprintf (stdout, "|%s|%s|\n", cptr, sptr);
/* if not matched, continue */
if (!*cptr || *cptr != '=' || *sptr) continue;
/* case sensitive comparison of passwords */
cptr++;
sptr = PasswordPtr;
while (*cptr && !isspace(*cptr) && *sptr)
{
if (*cptr != *sptr) break;
cptr++;
sptr++;
}
if (Debug) fprintf (stdout, "|%s|%s|\n", cptr, sptr);
/* password verification succeeded! */
if ((!*cptr || isspace(*cptr)) && !*sptr)
{
/* both the string and the status code are valid here */
fprintf (stdout, "200 READ+WRITE\n");
fflush (stdout);
/* use anything that follows as the user detail */
while (*cptr && isspace(*cptr)) cptr++;
if (*cptr)
{
/* supply an informational - the user's details */
for (sptr = cptr; *sptr && *sptr != '\n'; sptr++);
*sptr = '\0';
fprintf (stdout, "100 USER %s\n", cptr);
fflush (stdout);
}
break;
}
/* doesn't matter what the string is, only the status code is checked */
fprintf (stdout, "401 \"%s\" NOT authenticated\n", UserNamePtr);
fflush (stdout);
break;
}
EndOfFile = !EndOfFile;
if (EndOfFile)
{
/* no such user name found */
/* doesn't matter what the string is, only the status code is checked */
fprintf (stdout, "401 \"%s\" NOT found\n", UserNamePtr);
fflush (stdout);
}
fclose (ListFile);
}
/****************************************************************************/
/*
Does a case-insensitive, character-by-character string compare and returns
true if two strings are the same, or false if not. If a maximum number of
characters are specified only those will be compared, if the entire strings
should be compared then specify the number of characters as 0.
*/
boolean strsame
(
char *sptr1,
char *sptr2,
int count
)
{
while (*sptr1 && *sptr2)
{
if (toupper (*sptr1++) != toupper (*sptr2++)) return (false);
if (count)
if (!--count) return (true);
}
if (*sptr1 || *sptr2)
return (false);
else
return (true);
}
/*****************************************************************************/