topic Re: CSWS authentication in URL ? in Operating System - OpenVMS

CSWS authentication in URL ?

Willem Grooters — Wed, 01 Apr 2009 18:46:12 GMT

Situation: CSWWS 1.3; CGI script, directoryis defined:

Options Indexes FollowSymLinks Multiviews
Order allow,deny
AllowOverride ALL

AuthType Basic
AuthName "Whatever"
AuthOpenVMSuser On
Require valid-user

Mapping of this directory is /wg/cgi/.

The URL http://server:port/wg/cgi/... requests login, under CSWS control.
However, a non-VMS program wants to access this script over the (internal) network, passing username and password in the URL-header, so the interactive login-sequence by CSWS is bypassed; still, MOD_AUTH_OPENVMS should still check the credentials with VMS. The script and accompanying software will do it's own checks, but only if the user is validated against VMS.

I'm told it should be possible with this setup, but I couldn't find how to specify username and password in the URL.

My question is how do I specify these credentials?

(I know http will send data without encryption, but for the moment, this is no issue (closed network). In the future, we'll use https for transport, but for clearity we would do without to start with)

Re: CSWS authentication in URL ?

Cass Witkowski — Wed, 01 Apr 2009 22:08:54 GMT

http:/username password/server:port/wg/cpi/

Re: CSWS authentication in URL ?

Willem Grooters — Thu, 02 Apr 2009 04:52:38 GMT

That doesn't work, at leastr, not using a browser (used to test)

Re: CSWS authentication in URL ?

Bojan Nemec — Thu, 02 Apr 2009 05:35:05 GMT

Willem,

The right syntax for defining username and password in URL is:

http://username:password@hostname:port/

See specification at page 17 of the RFC.

http://www.ietf.org/rfc/rfc1738.txt

Bojan

Re: CSWS authentication in URL ?

Willem Grooters — Thu, 02 Apr 2009 06:30:02 GMT

Thanks Bojan, just a minor (?) issue. It works for Mozilla, but not in IE6 (and that's what is used in environment)

Re: CSWS authentication in URL ?

Willem Grooters — Thu, 02 Apr 2009 07:17:22 GMT

I may have found the IE6 issue: For a change, IE seems to adhere to a standard. This RFC states for HTTP:
[quote]
An HTTP URL takes the form:

http://:/?

where and are as described in Section 3.1. If : is omitted, the port defaults to 80. No user name or password is allowed.
[/quote]

Anyway, since it works using FireFox, I can work with it :)

Re: CSWS authentication in URL ?

Martin Vorlaender — Thu, 02 Apr 2009 07:22:32 GMT

Willem,

>>>
It works for Mozilla, but not in IE6
<<<

IMHO, http://www.end6.org/

cu,
Martin

Re: CSWS authentication in URL ?

Bojan Nemec — Thu, 02 Apr 2009 08:54:03 GMT

Willem,

Microsoft explanation:

http://support.microsoft.com/kb/834489

Bojan

Re: CSWS authentication in URL ?

Willem Grooters — Thu, 02 Apr 2009 10:10:21 GMT

That explains it.

Re: CSWS authentication in URL ?

Willem Grooters — Thu, 02 Apr 2009 10:13:07 GMT

See discussion