mirror of
https://github.com/django/django.git
synced 2025-08-30 23:37:50 +00:00
Fixed #18029 -- Removed mod_python as of deprecation process. Thanks Aymeric Augustin for the review.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17835 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Claude Paroz
parent
23d3459761
commit
a1ffb02107
11 changed files with 46 additions and 205 deletions
|
|
@ -2,17 +2,10 @@
|
|||
Authenticating against Django's user database from Apache
|
||||
=========================================================
|
||||
|
||||
.. warning::
|
||||
|
||||
Support for mod_python has been deprecated within Django. At that
|
||||
time, this method of authentication will no longer be provided by
|
||||
Django. The community is welcome to offer its own alternate
|
||||
solutions using WSGI middleware or other approaches.
|
||||
|
||||
Since keeping multiple authentication databases in sync is a common problem when
|
||||
dealing with Apache, you can configuring Apache to authenticate against Django's
|
||||
:doc:`authentication system </topics/auth>` directly. For example, you
|
||||
could:
|
||||
:doc:`authentication system </topics/auth>` directly. This requires Apache
|
||||
version >= 2.2 and mod_wsgi >= 2.0. For example, you could:
|
||||
|
||||
* Serve static/media files directly from Apache only to authenticated users.
|
||||
|
||||
|
|
@ -22,106 +15,31 @@ could:
|
|||
* Allow certain users to connect to a WebDAV share created with mod_dav_.
|
||||
|
||||
.. _Subversion: http://subversion.tigris.org/
|
||||
.. _mod_dav: http://httpd.apache.org/docs/2.0/mod/mod_dav.html
|
||||
.. _mod_dav: http://httpd.apache.org/docs/2.2/mod/mod_dav.html
|
||||
|
||||
Configuring Apache
|
||||
==================
|
||||
|
||||
To check against Django's authorization database from a Apache configuration
|
||||
file, you'll need to use mod_python's ``PythonAuthenHandler`` directive along
|
||||
with the standard ``Auth*`` and ``Require`` directives:
|
||||
file, you'll need to set 'wsgi' as the value of ``AuthBasicProvider`` or
|
||||
``AuthDigestProvider`` directive and then use the ``WSGIAuthUserScript``
|
||||
directive to set the path to your authentification script:
|
||||
|
||||
.. code-block:: apache
|
||||
|
||||
<Location /example/>
|
||||
AuthType Basic
|
||||
AuthName "example.com"
|
||||
AuthBasicProvider wsgi
|
||||
WSGIAuthUserScript /usr/local/wsgi/scripts/auth.wsgi
|
||||
Require valid-user
|
||||
|
||||
SetEnv DJANGO_SETTINGS_MODULE mysite.settings
|
||||
PythonAuthenHandler django.contrib.auth.handlers.modpython
|
||||
</Location>
|
||||
|
||||
.. admonition:: Using the authentication handler with Apache 2.2
|
||||
Your auth.wsgi script will have to implement either a
|
||||
``check_password(environ, user, password)`` function (for ``AuthBasicProvider``)
|
||||
or a ``get_realm_hash(environ, user, realm)`` function (for ``AuthDigestProvider``).
|
||||
|
||||
If you're using Apache 2.2, you'll need to take a couple extra steps.
|
||||
See the `mod_wsgi documentation`_ for more details about the implementation
|
||||
of such a solution.
|
||||
|
||||
You'll need to ensure that ``mod_auth_basic`` and ``mod_authz_user``
|
||||
are loaded. These might be compiled statically into Apache, or you might
|
||||
need to use ``LoadModule`` to load them dynamically (as shown in the
|
||||
example at the bottom of this note).
|
||||
|
||||
You'll also need to insert configuration directives that prevent Apache
|
||||
from trying to use other authentication modules, as well as specifying
|
||||
the ``AuthUserFile`` directive and pointing it to ``/dev/null``. Depending
|
||||
on which other authentication modules you have loaded, you might need one
|
||||
or more of the following directives:
|
||||
|
||||
.. code-block:: apache
|
||||
|
||||
AuthBasicAuthoritative Off
|
||||
AuthDefaultAuthoritative Off
|
||||
AuthzLDAPAuthoritative Off
|
||||
AuthzDBMAuthoritative Off
|
||||
AuthzDefaultAuthoritative Off
|
||||
AuthzGroupFileAuthoritative Off
|
||||
AuthzOwnerAuthoritative Off
|
||||
AuthzUserAuthoritative Off
|
||||
|
||||
A complete configuration, with differences between Apache 2.0 and
|
||||
Apache 2.2 marked in bold, would look something like:
|
||||
|
||||
.. parsed-literal::
|
||||
|
||||
**LoadModule auth_basic_module modules/mod_auth_basic.so**
|
||||
**LoadModule authz_user_module modules/mod_authz_user.so**
|
||||
|
||||
...
|
||||
|
||||
<Location /example/>
|
||||
AuthType Basic
|
||||
AuthName "example.com"
|
||||
**AuthUserFile /dev/null**
|
||||
**AuthBasicAuthoritative Off**
|
||||
Require valid-user
|
||||
|
||||
SetEnv DJANGO_SETTINGS_MODULE mysite.settings
|
||||
PythonAuthenHandler django.contrib.auth.handlers.modpython
|
||||
</Location>
|
||||
|
||||
By default, the authentication handler will limit access to the ``/example/``
|
||||
location to users marked as staff members. You can use a set of
|
||||
``PythonOption`` directives to modify this behavior:
|
||||
|
||||
================================ =========================================
|
||||
``PythonOption`` Explanation
|
||||
================================ =========================================
|
||||
``DjangoRequireStaffStatus`` If set to ``on`` only "staff" users (i.e.
|
||||
those with the ``is_staff`` flag set)
|
||||
will be allowed.
|
||||
|
||||
Defaults to ``on``.
|
||||
|
||||
``DjangoRequireSuperuserStatus`` If set to ``on`` only superusers (i.e.
|
||||
those with the ``is_superuser`` flag set)
|
||||
will be allowed.
|
||||
|
||||
Defaults to ``off``.
|
||||
|
||||
``DjangoPermissionName`` The name of a permission to require for
|
||||
access. See :ref:`custom permissions
|
||||
<custom-permissions>` for more
|
||||
information.
|
||||
|
||||
By default no specific permission will be
|
||||
required.
|
||||
================================ =========================================
|
||||
|
||||
Note that sometimes ``SetEnv`` doesn't play well in this mod_python
|
||||
configuration, for reasons unknown. If you're having problems getting
|
||||
mod_python to recognize your ``DJANGO_SETTINGS_MODULE``, you can set it using
|
||||
``PythonOption`` instead of ``SetEnv``. Therefore, these two Apache directives
|
||||
are equivalent::
|
||||
|
||||
SetEnv DJANGO_SETTINGS_MODULE mysite.settings
|
||||
PythonOption DJANGO_SETTINGS_MODULE mysite.settings
|
||||
.. _mod_wsgi documentation: http://code.google.com/p/modwsgi/wiki/AccessControlMechanisms#Apache_Authentication_Provider
|
||||
|
|
|
|||
|
|
@ -11,7 +11,6 @@ ways to easily deploy Django:
|
|||
|
||||
wsgi/index
|
||||
fastcgi
|
||||
mod_python (deprecated) <modpython>
|
||||
|
||||
If you're new to deploying Django and/or Python, we'd recommend you try
|
||||
:doc:`mod_wsgi </howto/deployment/wsgi/modwsgi>` first. In most cases it'll be
|
||||
|
|
@ -22,6 +21,6 @@ the easiest, fastest, and most stable deployment choice.
|
|||
* `Chapter 12 of the Django Book (second edition)`_ discusses deployment
|
||||
and especially scaling in more detail. However, note that this edition
|
||||
was written against Django version 1.1 and has not been updated since
|
||||
:doc:`mod_python </howto/deployment/modpython>` was deprecated.
|
||||
`mod_python` was first deprecated, then completely removed in Django 1.5.
|
||||
|
||||
.. _chapter 12 of the django book (second edition): http://djangobook.com/en/2.0/chapter12/
|
||||
|
|
|
|||
|
|
@ -176,3 +176,24 @@ other approaches:
|
|||
|
||||
3. Copy the admin static files so that they live within your Apache
|
||||
document root.
|
||||
|
||||
If you get a UnicodeEncodeError
|
||||
===============================
|
||||
|
||||
If you're taking advantage of the internationalization features of Django (see
|
||||
:doc:`/topics/i18n/index`) and you intend to allow users to upload files, you must
|
||||
ensure that the environment used to start Apache is configured to accept
|
||||
non-ASCII file names. If your environment is not correctly configured, you
|
||||
will trigger ``UnicodeEncodeError`` exceptions when calling functions like
|
||||
``os.path()`` on filenames that contain non-ASCII characters.
|
||||
|
||||
To avoid these problems, the environment used to start Apache should contain
|
||||
settings analogous to the following::
|
||||
|
||||
export LANG='en_US.UTF-8'
|
||||
export LC_ALL='en_US.UTF-8'
|
||||
|
||||
Consult the documentation for your operating system for the appropriate syntax
|
||||
and location to put these configuration items; ``/etc/apache2/envvars`` is a
|
||||
common location on Unix platforms. Once you have added these statements
|
||||
to your environment, restart Apache.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue