These are the command line options for both the UNIX inetd(8)
system utility based daemon, wnd, and the stand-alone
daemon, wnsd.
-a numeric_uid -- Set
trusted numeric uid for authentication
The server will only allow Authorization" lines must
occur in the index.wn file
of each directory you want to protect. Of course, these lines can all be
identical for different directories if you use the:
Authorization-module=~/cgi-bin/wnauth ~/dir/wnpasswd
form to specify locations relative to your WN root.
There is also support for a "group" file with
authentication. This feature is invoked by using the -g and
-G options with the wnauth authentication
module. The line:
Authorization-module=wnauth -g grpname -G foo -P wnpasswd
means to use the group name "grpname" and the group file
"foo". The group file is a file in the format of a UNIX group(5)
configuration file. That is, it has lines of the form:
grpname:*:99:user1,user3,user5
where the fields are separated by colons, the first field is a group
name, and the fourth field is a comma separated list of user names. wnauth will ignore the
second and third fields. If the line above is in the file
foo and wnauth is invoked as
above then a user will be granted access provided the supplied password
matches that in the wnpasswd file and the user's username is
in the list after the second ':' in the line starting with
the group name. Thus, in this example users user1,
user3, and user5 will be given access if they
provide valid passwords and other users will not.
The format of a group file used by Apache is also supported. This format has lines of the form:
grpname: user1 user3 user5
which is the group name, a single colon and a space separated list of user names.
It is possible to specify a custom error message to be sent when password authentication fails because of an incorrect password or username as in:
Auth-denied-file=~/dir/foo.html
This specifies that any request for a document in this directory which is
denied because of an authorization module restriction results in the file
~/dir/foo.html being sent instead. A default value for all
directories can be set by uncommenting the #define AUTH_DENIED_FILE"
line in config.h and
recompiling. Note that this is not a URL but the name of a file whose
content is to be sent as error text when authentication is denied. If
the file name starts with '~/' as above it is assumed to be
relative to the WN root directory. Otherwise it is assumed to
be a path relative to the directory containing the index.wn file.
The "Basic" authentication scheme is flawed in that it involves the transmission of essentially unencoded passwords over the network. It is relatively easy for unscrupulous people to obtain "sniffer" software which allows eavesdropping on all local network traffic. This means, in particular, that it is possible to intercept passwords.
This particular problem is remedied by the HTTP/1.1 Digest Authentication scheme. Digest authentication is supported experimentally by WN, but has the rather severe drawback that no publicly available clients currently support it. It is experimental, because I have no client to test it and hence it has barely been tested.