thirdparty/google_appengine/lib/django/docs/apache_auth.txt
author Lennard de Rijk <ljvderijk@gmail.com>
Mon, 16 Feb 2009 20:38:35 +0000
changeset 1364 b2709805fafe
parent 109 620f9b141567
permissions -rw-r--r--
Update org bulk accept script. The script now: 1) leaves correctly control to the browser to update the GUI of the progress bar during ajax communication. 2) Displays an error if something went wrong (I've tried in my box stopping the server while doing the requests), and show a retry button to fetch again the list of the applications that are still not accepted and iterate over them again (seems to recover correctly restarting the server after the error in my box) 3) doesn't display any text at the beginning, and the button has the correct CSS class assigned 4) Check if there are applications to accept, if not displays a message stating that there are no orgs to accept. Patch by: Mario Ferraro Reviewed by: Lennard de Rijk

=========================================================
Authenticating against Django's user database from Apache
=========================================================

Since keeping multiple authentication databases in sync is a common problem when
dealing with Apache, you can configuring Apache to authenticate against Django's
`authentication system`_ directly.  For example, you could:

    * Serve static/media files directly from Apache only to authenticated users.

    * Authenticate access to a Subversion_ repository against Django users with
      a certain permission.

    * Allow certain users to connect to a WebDAV share created with mod_dav_.

Configuring Apache
==================

To check against Django's authorization database from a Apache configuration
file, you'll need to use mod_python's ``PythonAuthenHandler`` directive along
with the standard ``Auth*`` and ``Require`` directives::

    <Location /example/>
        AuthType basic
        AuthName "example.com"
        Require valid-user

        SetEnv DJANGO_SETTINGS_MODULE mysite.settings
        PythonAuthenHandler django.contrib.auth.handlers.modpython
    </Location>

By default, the authentication handler will limit access to the ``/example/``
location to users marked as staff members.  You can use a set of
``PythonOption`` directives to modify this behavior:

    ================================  =========================================
    ``PythonOption``                  Explanation
    ================================  =========================================
    ``DjangoRequireStaffStatus``      If set to ``on`` only "staff" users (i.e.
                                      those with the ``is_staff`` flag set)
                                      will be allowed.

                                      Defaults to ``on``.

    ``DjangoRequireSuperuserStatus``  If set to ``on`` only superusers (i.e.
                                      those with the ``is_superuser`` flag set)
                                      will be allowed.

                                      Defaults to ``off``.

    ``DjangoPermissionName``          The name of a permission to require for
                                      access. See `custom permissions`_ for
                                      more information.

                                      By default no specific permission will be
                                      required.
    ================================  =========================================

Note that sometimes ``SetEnv`` doesn't play well in this mod_python
configuration, for reasons unknown. If you're having problems getting
mod_python to recognize your ``DJANGO_SETTINGS_MODULE``, you can set it using
``PythonOption`` instead of ``SetEnv``. Therefore, these two Apache directives
are equivalent::

    SetEnv DJANGO_SETTINGS_MODULE mysite.settings
    PythonOption DJANGO_SETTINGS_MODULE mysite.settings

.. _authentication system: ../authentication/
.. _Subversion: http://subversion.tigris.org/
.. _mod_dav: http://httpd.apache.org/docs/2.0/mod/mod_dav.html
.. _custom permissions: ../authentication/#custom-permissions