=========================================================
Authenticating against Django's user database from Apache
=========================================================

Since keeping multiple authentication databases in sync is a common problem when
dealing with Apache, you can configuring Apache to authenticate against Django's
`authentication system`_ directly.  For example, you could:

    * Serve static/media files directly from Apache only to authenticated users.

    * Authenticate access to a Subversion_ repository against Django users with
      a certain permission.

    * Allow certain users to connect to a WebDAV share created with mod_dav_.

Configuring Apache
==================

To check against Django's authorization database from a Apache configuration
file, you'll need to use mod_python's ``PythonAuthenHandler`` directive along
with the standard ``Auth*`` and ``Require`` directives::

    <Location /example/>
        AuthType basic
        AuthName "example.com"
        Require valid-user

        SetEnv DJANGO_SETTINGS_MODULE mysite.settings
        PythonAuthenHandler django.contrib.auth.handlers.modpython
    </Location>

By default, the authentication handler will limit access to the ``/example/``
location to users marked as staff members.  You can use a set of
``PythonOption`` directives to modify this behavior:

    ================================  =========================================
    ``PythonOption``                  Explanation
    ================================  =========================================
    ``DjangoRequireStaffStatus``      If set to ``on`` only "staff" users (i.e.
                                      those with the ``is_staff`` flag set)
                                      will be allowed.

                                      Defaults to ``on``.

    ``DjangoRequireSuperuserStatus``  If set to ``on`` only superusers (i.e.
                                      those with the ``is_superuser`` flag set)
                                      will be allowed.

                                      Defaults to ``off``.

    ``DjangoPermissionName``          The name of a permission to require for
                                      access. See `custom permissions`_ for
                                      more information.

                                      By default no specific permission will be
                                      required.
    ================================  =========================================

Note that sometimes ``SetEnv`` doesn't play well in this mod_python
configuration, for reasons unknown. If you're having problems getting
mod_python to recognize your ``DJANGO_SETTINGS_MODULE``, you can set it using
``PythonOption`` instead of ``SetEnv``. Therefore, these two Apache directives
are equivalent::

    SetEnv DJANGO_SETTINGS_MODULE mysite.settings
    PythonOption DJANGO_SETTINGS_MODULE mysite.settings

.. _authentication system: ../authentication/
.. _Subversion: http://subversion.tigris.org/
.. _mod_dav: http://httpd.apache.org/docs/2.0/mod/mod_dav.html
.. _custom permissions: ../authentication/#custom-permissions