Friday, August 22, 2008

Apache 2.2 Authentication with PostgreSQL

This is just a quick transcript of my attempts at trying to set up Apache authentication against a PostgreSQL database. I started by following the mod_auth_pgsql instructions. After doing that, I got the error:
Internal error: pcfg_openfile() called with NULL filename
(9)Bad file descriptor: Could not open password file: (null)
It looks like Apache is still trying to authenticate against an htpasswd file. I added "AuthBasicAuthoritative off" to the Apache config so that a failed file authentication passes through to the auth_pgsql authentication. That worked, but now I get
[mod_auth_pgsql.c] - ERROR - PG user admin: password mismatch
I know the password I entered was right. After reading the source code for mod_auth_pgsql, I realized that the MD5 passwords it supports are not the same as Apache's MD5 format. They're just a straight MD5 hash of the password and therefore not as secure as I might like (since they can be searched in an MD5 database). I proceeded to investigate the mod_authn_dbd instructions. I hoped that it would be able to authenticate against Apache's $apr1$ MD5 password format. After getting it set up, I got the message:
Invalid command 'DBDriver', perhaps misspelled or defined
by a module not included in the server configuration
Oops, I forgot to load mod_dbd. After loading that module, I get:
Unknown Authn provider: dbd
Oops, I forgot to load mod_authn_dbd. After loading that module, I get:
AuthDBDUserPWQuery takes one argument,
Query used to fetch password for user
Oops, I had a trailing ; after my query string. Removing the semicolon, I get:
(22)Invalid argument: DBD: failed to initialise
Based on reading the source, that looks like something to do with threads. I'll save the remaining debugging for another day. Maybe this transcript will be useful to someone out there.

2 comments:

Jackson said...

Thanks, "AuthBasicAuthoritative off" saved me a lot of trouble.

Another thing to look out for is that Auth_PG_gid_field has been renamed Auth_PG_grp_group_field - but the docs on the mod_auth_pgsql website still list the old directive.

graz said...

Works for me as well, apache 2.2.14.
I used htpasswd to generate the passwd to populate pgsql with, haven't seen any issues so far.