Authentication

The authentication provides a mechanism to restrict the access of some resources as directories, extensions or predefined requests. The authentication modules receive the name of Validators, and each one of them implements a different authentication mechanism. The scope of a validator is local to a directory, extension definition or request entry, inside of an Auth clause.

There are two kinds of authentications:

• Basic authentication: This method sends the user and password pair clear over the network, so it isn't a very safe method. It could represent a security problem is the connection isn't encrypted (HTTPS connection are completely safe though). This method is very easy to implement, so most of the programs supports it.

• Digest authentication: It is by far much more secure, but it is also more complex. If the clients of the server are modern browsers they won't have any problem to use this authentication method: More information

Cherokee distributes a number of validators: htpasswd, htdigest, PAM, and a Plain text file validator. Some of these validators are only suitable for certain authentication methods:

User restriction

One of the common features for all the validator is the user basedrestrictions. Basically, it is possible to specify a list of users who are allowed to authenticate with the validator.

Example

The only users allowed to access to the directory /secret are alo and root, it doesn't matter is the systems has a hundred users.

Directory /secret {
    Auth Basic, Digest {
        Method pam
        User alo, root
    }
}