Bug 165780 - htaccess AuthType Basic breaks when loading mod_auth_mysql.so
htaccess AuthType Basic breaks when loading mod_auth_mysql.so
Product: Fedora
Classification: Fedora
Component: httpd (Show other bugs)
All Linux
medium Severity low
: ---
: ---
Assigned To: Joe Orton
Depends On:
  Show dependency treegraph
Reported: 2005-08-11 20:29 EDT by Matt Olson
Modified: 2007-11-30 17:11 EST (History)
0 users

See Also:
Fixed In Version: mod_auth_mysql-3.0.0-3.1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-01-23 15:36:37 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Matt Olson 2005-08-11 20:29:14 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (compatible; Konqueror/3.4; Linux) KHTML/3.4.0 (like Gecko)

Description of problem:
When mod_auth_mysql.so module is loaded, .htaccess option of 'Auth Type Basic' 
will no longer use file based password lists.  Every auth attempt is forced to 
use mysql.  httpd.  From ssl.conf: 
<Directory "/var/www/cgi-bin"> 
    AllowOverride All 
    SSLOptions +StdEnvVars 
This was working fine under FC3.  Maybe this is a planned change in behavior 
for the new mod_auth_mysql??  This is a problem when you have multiple 
(apache) virtual hosts using both file based authentication _and_ mysql 

Version-Release number of selected component (if applicable):
mod_auth_mysql-2.6.1-4 httpd-2.0.54-10

How reproducible:

Steps to Reproduce:
1.  Create .htaccess file, e.g.:   
AuthName TestSite   
AuthType Basic   
require group TestSite   
AuthUserFile /var/www/auth/.htpasswd   
AuthGroupFile /var/www/auth/.htgroup   
2. Create .htpasswd and .htgroup files with a test user.   
3. Make sure mod_auth_mysql RPM is loaded.  It drops a conf file  
into /etc/httpd/conf.d and is enabled as soon as it is installed.  
4. Try to auth against test server with browser.  
5. Check /var/log/httpd/ssl_error_log if you want to see the error.  

Actual Results:  Unable to login to secured site.    

Expected Results:  AuthType Basic method should still work with mod_auth_mysql module loaded.   

Additional info:

Just fixed it . . . must include additional directive in .htaccess when   
mod_auth_mysql module is loaded:   
AuthMySQLEnable Off   
Maybe mark this as 'not-a-bug' but make it searchable in the history for  
others.  I think it's silly that the _default_ is 'On' and breaks the legacy  
auth mechanism.  What were the mod_auth_mysql authors thinking?  One database  
to rule them all?  PostgreSQL is a better database anyway.   
--Matt Olson 
Comment 1 Christian Iseli 2007-01-22 06:48:21 EST
This report targets the FC3 or FC4 products, which have now been EOL'd.

Could you please check that it still applies to a current Fedora release, and
either update the target product or close it ?

Comment 2 Matt Olson 2007-01-23 14:19:56 EST
Re-tested (minimally) on FC6 and it seems to be working as desired. 
mod_auth_mysql no longer acts as the default auth mechanism when loaded.  

I had discovered a while back that this is an upstream problem as I was seeing
on Debian as well. 

Comment 3 Matt Olson 2007-01-23 15:36:37 EST
Closing with CURRENTRELEASE.  This bug may have actually been fixed in a prior
release of mod_auth_mysql.  'Fixed in version' referenced is the version tested.  

Note You need to log in before you can comment on or make changes to this bug.