| 994 | }; |
| 995 | |
| 996 | static authz_status fcgi_authz_check(request_rec *r, |
| 997 | const char *require_line, |
| 998 | const void *parsed_require_line) |
| 999 | { |
| 1000 | const char *fn = "fcgi_authz_check"; |
| 1001 | const char *prov = apr_table_get(r->notes, AUTHZ_PROVIDER_NAME_NOTE); |
| 1002 | const fcgi_provider_conf *conf; |
| 1003 | |
| 1004 | ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, |
| 1005 | APLOGNO(02527) "%s(%s)", fn, require_line); |
| 1006 | |
| 1007 | if (!prov) { |
| 1008 | ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, |
| 1009 | APLOGNO(02528) "%s: provider note isn't set", fn); |
| 1010 | return AUTHZ_GENERAL_ERROR; |
| 1011 | } |
| 1012 | |
| 1013 | conf = apr_hash_get(fcgi_authz_providers, prov, APR_HASH_KEY_STRING); |
| 1014 | if (!conf) { |
| 1015 | ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r, |
| 1016 | APLOGNO(02529) "%s: can't find config for provider %s", |
| 1017 | fn, prov); |
| 1018 | return AUTHZ_GENERAL_ERROR; |
| 1019 | } |
| 1020 | |
| 1021 | if (APLOGrdebug(r)) { |
| 1022 | log_provider_info(conf, r); |
| 1023 | } |
| 1024 | |
| 1025 | if (!r->user) { |
| 1026 | return AUTHZ_DENIED_NO_USER; |
| 1027 | } |
| 1028 | |
| 1029 | if (conf->is_authn) { |
| 1030 | /* combined authn/authz phase, so app won't be invoked for authz |
| 1031 | * |
| 1032 | * If the provider already successfully authorized this request, |
| 1033 | * success. |
| 1034 | */ |
| 1035 | fcgi_request_notes *rnotes = ap_get_module_config(r->request_config, |
| 1036 | &authnz_fcgi_module); |
| 1037 | if (rnotes |
| 1038 | && rnotes->successful_authnz_provider |
| 1039 | && !strcmp(rnotes->successful_authnz_provider, conf->name)) { |
| 1040 | return AUTHZ_GRANTED; |
| 1041 | } |
| 1042 | else { |
| 1043 | return AUTHZ_DENIED; |
| 1044 | } |
| 1045 | } |
| 1046 | else { |
| 1047 | req_rsp(r, conf, NULL, AP_FCGI_APACHE_ROLE_AUTHORIZER_STR, NULL, NULL); |
| 1048 | |
| 1049 | if (r->status == HTTP_OK) { |
| 1050 | return AUTHZ_GRANTED; |
| 1051 | } |
| 1052 | else if (r->status == HTTP_INTERNAL_SERVER_ERROR) { |
| 1053 | return AUTHZ_GENERAL_ERROR; |
nothing calls this directly
no test coverage detected