Initial documentation
[hcoop/zz_old/modwaklog.git] / README
cc810c13 1INTRO
3mod_waklog is an Apache module that provides aklog-like semantics
4for the web. mod_waklog will acquire (and store in the kernel) an
5AFS credential when a connection is opened, use the credential for
6the duration of the connection, and will remove the credential when
7the connection is closed.
9mod_waklog allows you to permit directories using AFS ACLs, and access
10them via a web browser. An ACL of "umweb:servers rl" is required for
11each mod_waklog-protected directory.
13mod_waklog allows scripts to run as you. Programs which use AFS
14credentials to authenticate themselves do so as you.
16mod_waklog often is used with mod_cosign, and uses the cosign-provided
17krbtgt to acquire an AFS credential; this extends single signon to AFS
18via the web.
22Apache processes a request in multiple phases.
24mod_waklog runs at phase 0 to acquire credentials via a keytab, and
25runs at phase 2 to remove the credentials.
27mod_waklog runs at phase 7 to acquire credentials of whatever krbtgt
28is referenced via KRB5CCNAME (e.g., set by mod_cosign).
30mod_waklog runs at connection termination to remove the credentials
31it acquired at phase 0 or phase 7.
33Apache calls stat() between phase 1 and phase 2 to determine if it
34has access to the directory; if it doesn't have read access at that
35point, it won't try to read it again, even if later phases would
36acquire credentials which would allow it to do so. mod_waklog
37acquires an afs credential for a principal in the pts group
38umweb:servers at phase 0, and removes this credential at phase 2;
39directories permitted "umweb:servers rl" will allow the stat() call
40to succeed.