docs/manual/mod/mod_auth_basic.html.en - httpd - Git at Google

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
 <meta content="text/html; charset=UTF-8" http-equiv="Content-Type" />
 <!--
         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
               This file is generated from xml source: DO NOT EDIT
         XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
       -->
 <title>mod_auth_basic - Apache HTTP Server Version 2.4</title>
 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" />
 <script src="../style/scripts/prettify.min.js" type="text/javascript">
 </script>

 <link href="../images/favicon.ico" rel="shortcut icon" /></head>
 <body>
 <div id="page-header">
 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
 <p class="apache">Apache HTTP Server Version 2.4</p>
 <img alt="" src="../images/feather.png" /></div>
 <div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="../images/left.gif" /></a></div>
 <div id="path">
 <a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="../">Version 2.4</a> &gt; <a href="./">Modules</a></div>
 <div id="page-content">
 <div id="preamble"><h1>Apache Module mod_auth_basic</h1>
 <div class="toplang">
 <p><span>Available Languages: </span><a href="../en/mod/mod_auth_basic.html" title="English">&nbsp;en&nbsp;</a> |
 <a href="../fr/mod/mod_auth_basic.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a> |
 <a href="../ja/mod/mod_auth_basic.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
 <a href="../ko/mod/mod_auth_basic.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a></p>
 </div>
 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Basic HTTP authentication</td></tr>
 <tr><th><a href="module-dict.html#Status">Status:</a></th><td>Base</td></tr>
 <tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>auth_basic_module</td></tr>
 <tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_auth_basic.c</td></tr>
 <tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.1 and later</td></tr></table>
 <h3>Summary</h3>

     <p>This module allows the use of HTTP Basic Authentication to
     restrict access by looking up users in the given providers.
     HTTP Digest Authentication is provided by
     <code class="module"><a href="../mod/mod_auth_digest.html">mod_auth_digest</a></code>.  This module should
     usually be combined with at least one authentication module
     such as <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code> and one authorization
     module such as <code class="module"><a href="../mod/mod_authz_user.html">mod_authz_user</a></code>.</p>
 </div>
 <div id="quickview"><a href="https://www.apache.org/foundation/contributing.html" class="badge"><img src="https://www.apache.org/images/SupportApache-small.png" alt="Support Apache!" /></a><h3 class="directives">Directives</h3>
 <ul id="toc">
 <li><img alt="" src="../images/down.gif" /> <a href="#authbasicauthoritative">AuthBasicAuthoritative</a></li>
 <li><img alt="" src="../images/down.gif" /> <a href="#authbasicfake">AuthBasicFake</a></li>
 <li><img alt="" src="../images/down.gif" /> <a href="#authbasicprovider">AuthBasicProvider</a></li>
 <li><img alt="" src="../images/down.gif" /> <a href="#authbasicusedigestalgorithm">AuthBasicUseDigestAlgorithm</a></li>
 </ul>
 <h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&amp;list_id=144532&amp;product=Apache%20httpd-2&amp;query_format=specific&amp;order=changeddate%20DESC%2Cpriority%2Cbug_severity&amp;component=mod_auth_basic">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&amp;component=mod_auth_basic">Report a bug</a></li></ul><h3>See also</h3>
 <ul class="seealso">
 <li><code class="directive"><a href="../mod/mod_authn_core.html#authname">AuthName</a></code></li>
 <li><code class="directive"><a href="../mod/mod_authn_core.html#authtype">AuthType</a></code></li>
 <li><code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code></li>
 <li><a href="../howto/auth.html">Authentication howto</a></li>
 <li><a href="#comments_section">Comments</a></li></ul></div>

 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="AuthBasicAuthoritative" id="AuthBasicAuthoritative">AuthBasicAuthoritative</a> <a name="authbasicauthoritative" id="authbasicauthoritative">Directive</a></h2>
 <table class="directive">
 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets whether authorization and authentication are passed to
 lower level modules</td></tr>
 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicAuthoritative On|Off</code></td></tr>
 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicAuthoritative On</code></td></tr>
 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
 </table>
     <p>Normally, each authorization module listed in <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code> will attempt
     to verify the user, and if the user is not found in any provider,
     access will be denied. Setting the
     <code class="directive">AuthBasicAuthoritative</code> directive explicitly
     to <code>Off</code> allows for both authentication and
     authorization to be passed on to other non-provider-based modules
     if there is <strong>no userID</strong> or <strong>rule</strong>
     matching the supplied userID.  This should only be necessary when
     combining <code class="module"><a href="../mod/mod_auth_basic.html">mod_auth_basic</a></code> with third-party modules
     that are not configured with the <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code>
     directive.  When using such modules, the order of processing
     is determined in the modules' source code and is not configurable.</p>

 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="AuthBasicFake" id="AuthBasicFake">AuthBasicFake</a> <a name="authbasicfake" id="authbasicfake">Directive</a></h2>
 <table class="directive">
 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Fake basic authentication using the given expressions for
 username and password</td></tr>
 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicFake off|<var>username</var> [<var>password</var>]</code></td></tr>
 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.4.5 and later</td></tr>
 </table>
     <p>The username and password specified are combined into an
     Authorization header, which is passed to the server or service
     behind the webserver. Both the username and password fields are
     interpreted using the <a href="../expr.html">expression parser</a>,
     which allows both the username and password to be set based on
     request parameters.</p>

     <p>If the password is not specified, the default value "password"
     will be used. To disable fake basic authentication for an URL
     space, specify "AuthBasicFake off".</p>

     <p>In this example, we pass a fixed username and password to a
     backend server.</p>

     <div class="example"><h3>Fixed Example</h3><pre class="prettyprint lang-config">&lt;Location "/demo"&gt;
     AuthBasicFake demo demopass
 &lt;/Location&gt;</pre>
 </div>

     <p>In this example, we pass the email address extracted from a client
     certificate, extending the functionality of the FakeBasicAuth option
     within the <code class="directive"><a href="../mod/mod_ssl.html#ssloptions">SSLOptions</a></code>
     directive. Like the FakeBasicAuth option, the password is set to the
     fixed string "password".</p>

     <div class="example"><h3>Certificate Example</h3><pre class="prettyprint lang-config">&lt;Location "/secure"&gt;
     AuthBasicFake "%{SSL_CLIENT_S_DN_Email}"
 &lt;/Location&gt;</pre>
 </div>

     <p>Extending the above example, we generate a password by hashing the
     email address with a fixed passphrase, and passing the hash to the
     backend server. This can be used to gate into legacy systems that do
     not support client certificates.</p>

     <div class="example"><h3>Password Example</h3><pre class="prettyprint lang-config">&lt;Location "/secure"&gt;
     AuthBasicFake "%{SSL_CLIENT_S_DN_Email}" "%{sha1:passphrase-%{SSL_CLIENT_S_DN_Email}}"
 &lt;/Location&gt;</pre>
 </div>

     <div class="example"><h3>Exclusion Example</h3><pre class="prettyprint lang-config">&lt;Location "/public"&gt;
     AuthBasicFake off
 &lt;/Location&gt;</pre>
 </div>


 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="AuthBasicProvider" id="AuthBasicProvider">AuthBasicProvider</a> <a name="authbasicprovider" id="authbasicprovider">Directive</a></h2>
 <table class="directive">
 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the authentication provider(s) for this location</td></tr>
 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicProvider <var>provider-name</var>
 [<var>provider-name</var>] ...</code></td></tr>
 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicProvider file</code></td></tr>
 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
 </table>
     <p>The <code class="directive">AuthBasicProvider</code> directive sets
     which provider is used to authenticate the users for this location.
     The default <code>file</code> provider is implemented
     by the <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code> module.  Make sure
     that the chosen provider module is present in the server.</p>
     <div class="example"><h3>Example</h3><pre class="prettyprint lang-config">&lt;Location "/secure"&gt;
     AuthType basic
     AuthName "private area"
     AuthBasicProvider  dbm
     AuthDBMType        SDBM
     AuthDBMUserFile    "/www/etc/dbmpasswd"
     Require            valid-user
 &lt;/Location&gt;</pre>
 </div>
     <p> Providers are queried in order until a provider finds a match
     for the requested username, at which point this sole provider will
     attempt to check the password.  A failure to verify the password does
     not result in control being passed on to subsequent providers.</p>

     <p>Providers are implemented by <code class="module"><a href="../mod/mod_authn_dbm.html">mod_authn_dbm</a></code>,
     <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code>, <code class="module"><a href="../mod/mod_authn_dbd.html">mod_authn_dbd</a></code>,
     <code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> and <code class="module"><a href="../mod/mod_authn_socache.html">mod_authn_socache</a></code>.</p>

 </div>
 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
 <div class="directive-section"><h2><a name="AuthBasicUseDigestAlgorithm" id="AuthBasicUseDigestAlgorithm">AuthBasicUseDigestAlgorithm</a> <a name="authbasicusedigestalgorithm" id="authbasicusedigestalgorithm">Directive</a></h2>
 <table class="directive">
 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Check passwords against the authentication providers as if
 Digest Authentication was in force instead of Basic Authentication.
 </td></tr>
 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicUseDigestAlgorithm MD5|Off</code></td></tr>
 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicUseDigestAlgorithm Off</code></td></tr>
 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
 <tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.4.7 and later</td></tr>
 </table>
     <p>Normally, when using Basic Authentication, the providers listed in
     <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code>
     attempt to verify a user by checking their data stores for
     a matching username and associated password.  The stored passwords
     are usually encrypted, but not necessarily so; each provider may
     choose its own storage scheme for passwords.</p>

     <p>When using <code class="directive"><a href="../mod/mod_auth_digest.html#authdigestprovider">AuthDigestProvider</a></code> and Digest
     Authentication, providers perform a similar check to find a matching
     username in their data stores.  However, unlike in the Basic
     Authentication case, the value associated with each stored username
     must be an encrypted string composed from the username, realm name,
     and password.  (See
     <a href="http://tools.ietf.org/html/rfc2617#section-3.2.2.2">
     RFC 2617, Section 3.2.2.2</a> for more details on the format used
     for this encrypted string.)</p>

     <p>As a consequence of the difference in the stored values between
     Basic and Digest Authentication, converting from Digest
     Authentication to Basic Authentication generally requires that all
     users be assigned new passwords, as their existing passwords cannot
     be recovered from the password storage scheme imposed on those
     providers which support Digest Authentication.</p>

     <p>Setting the <code class="directive">AuthBasicUseDigestAlgorithm</code> directive
     to <code>MD5</code> will cause the user's Basic Authentication password
     to be checked using the same encrypted format as for Digest
     Authentication.  First a string composed from the username, realm name,
     and password is hashed with MD5; then the username and this encrypted
     string are passed to the providers listed in
     <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code>
     as if
     <code class="directive"><a href="../mod/mod_authn_core.html#authtype">AuthType</a></code>
     was set to <code>Digest</code> and Digest Authentication was in force.
     </p>

     <p>Through the use of <code class="directive">AuthBasicUseDigestAlgorithm</code>
     a site may switch from Digest to Basic Authentication without
     requiring users to be assigned new passwords.</p>

     <div class="note">
       The inverse process of switching from Basic to Digest
       Authentication without assigning new passwords is generally
       not possible.  Only if the Basic Authentication passwords
       have been stored in plain text or with a reversible encryption
       scheme will it be possible to recover them and generate a
       new data store following the Digest Authentication password
       storage scheme.
     </div>

     <div class="note">
       Only providers which support Digest Authentication will be able
       to authenticate users when <code class="directive">AuthBasicUseDigestAlgorithm</code>
       is set to <code>MD5</code>.  Use of other providers will result
       in an error response and the client will be denied access.
     </div>

 </div>
 </div>
 <div class="bottomlang">
 <p><span>Available Languages: </span><a href="../en/mod/mod_auth_basic.html" title="English">&nbsp;en&nbsp;</a> |
 <a href="../fr/mod/mod_auth_basic.html" hreflang="fr" rel="alternate" title="Français">&nbsp;fr&nbsp;</a> |
 <a href="../ja/mod/mod_auth_basic.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
 <a href="../ko/mod/mod_auth_basic.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a></p>
 </div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Libera.chat, or sent to our <a href="https://httpd.apache.org/lists.html">mailing lists</a>.</div>
 <script type="text/javascript"><!--//--><![CDATA[//><!--
 var comments_shortname = 'httpd';
 var comments_identifier = 'http://httpd.apache.org/docs/2.4/mod/mod_auth_basic.html';
 (function(w, d) {
     if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
         d.write('<div id="comments_thread"><\/div>');
         var s = d.createElement('script');
         s.type = 'text/javascript';
         s.async = true;
         s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
         (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
     }
     else {
         d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
     }
 })(window, document);
 //--><!]]></script></div><div id="footer">
 <p class="apache">Copyright 2022 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
 if (typeof(prettyPrint) !== 'undefined') {
     prettyPrint();
 }
 //--><!]]></script>
 </body></html>
	<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
	<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
	<meta content="text/html; charset=UTF-8" http-equiv="Content-Type" />
	<!--
	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	This file is generated from xml source: DO NOT EDIT
	XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
	-->
	<title>mod_auth_basic - Apache HTTP Server Version 2.4</title>
	<link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
	<link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
	<link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" />
	<script src="../style/scripts/prettify.min.js" type="text/javascript">
	</script>

	<link href="../images/favicon.ico" rel="shortcut icon" /></head>
	<body>
	<div id="page-header">
	<p class="menu"><a href="../mod/">Modules</a> \| <a href="../mod/directives.html">Directives</a> \| <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> \| <a href="../glossary.html">Glossary</a> \| <a href="../sitemap.html">Sitemap</a></p>
	<p class="apache">Apache HTTP Server Version 2.4</p>
	<img alt="" src="../images/feather.png" /></div>
	<div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div>
	<div id="path">
	<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.4</a> > <a href="./">Modules</a></div>
	<div id="page-content">
	<div id="preamble"><h1>Apache Module mod_auth_basic</h1>
	<div class="toplang">
	<p><span>Available Languages: </span><a href="../en/mod/mod_auth_basic.html" title="English"> en </a> \|
	<a href="../fr/mod/mod_auth_basic.html" hreflang="fr" rel="alternate" title="Français"> fr </a> \|
	<a href="../ja/mod/mod_auth_basic.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> \|
	<a href="../ko/mod/mod_auth_basic.html" hreflang="ko" rel="alternate" title="Korean"> ko </a></p>
	</div>
	<table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Basic HTTP authentication</td></tr>
	<tr><th><a href="module-dict.html#Status">Status:</a></th><td>Base</td></tr>
	<tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>auth_basic_module</td></tr>
	<tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_auth_basic.c</td></tr>
	<tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available in Apache 2.1 and later</td></tr></table>
	<h3>Summary</h3>

	<p>This module allows the use of HTTP Basic Authentication to
	restrict access by looking up users in the given providers.
	HTTP Digest Authentication is provided by
	<code class="module"><a href="../mod/mod_auth_digest.html">mod_auth_digest</a></code>. This module should
	usually be combined with at least one authentication module
	such as <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code> and one authorization
	module such as <code class="module"><a href="../mod/mod_authz_user.html">mod_authz_user</a></code>.</p>
	</div>
	<div id="quickview"><a href="https://www.apache.org/foundation/contributing.html" class="badge"><img src="https://www.apache.org/images/SupportApache-small.png" alt="Support Apache!" /></a><h3 class="directives">Directives</h3>
	<ul id="toc">
	<li><img alt="" src="../images/down.gif" /> <a href="#authbasicauthoritative">AuthBasicAuthoritative</a></li>
	<li><img alt="" src="../images/down.gif" /> <a href="#authbasicfake">AuthBasicFake</a></li>
	<li><img alt="" src="../images/down.gif" /> <a href="#authbasicprovider">AuthBasicProvider</a></li>
	<li><img alt="" src="../images/down.gif" /> <a href="#authbasicusedigestalgorithm">AuthBasicUseDigestAlgorithm</a></li>
	</ul>
	<h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&list_id=144532&product=Apache%20httpd-2&query_format=specific&order=changeddate%20DESC%2Cpriority%2Cbug_severity&component=mod_auth_basic">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&component=mod_auth_basic">Report a bug</a></li></ul><h3>See also</h3>
	<ul class="seealso">
	<li><code class="directive"><a href="../mod/mod_authn_core.html#authname">AuthName</a></code></li>
	<li><code class="directive"><a href="../mod/mod_authn_core.html#authtype">AuthType</a></code></li>
	<li><code class="directive"><a href="../mod/mod_authz_core.html#require">Require</a></code></li>
	<li><a href="../howto/auth.html">Authentication howto</a></li>
	<li><a href="#comments_section">Comments</a></li></ul></div>

	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="directive-section"><h2><a name="AuthBasicAuthoritative" id="AuthBasicAuthoritative">AuthBasicAuthoritative</a> <a name="authbasicauthoritative" id="authbasicauthoritative">Directive</a></h2>
	<table class="directive">
	<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets whether authorization and authentication are passed to
	lower level modules</td></tr>
	<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicAuthoritative On\|Off</code></td></tr>
	<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicAuthoritative On</code></td></tr>
	<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
	<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
	<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
	<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
	</table>
	<p>Normally, each authorization module listed in <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code> will attempt
	to verify the user, and if the user is not found in any provider,
	access will be denied. Setting the
	<code class="directive">AuthBasicAuthoritative</code> directive explicitly
	to <code>Off</code> allows for both authentication and
	authorization to be passed on to other non-provider-based modules
	if there is <strong>no userID</strong> or <strong>rule</strong>
	matching the supplied userID. This should only be necessary when
	combining <code class="module"><a href="../mod/mod_auth_basic.html">mod_auth_basic</a></code> with third-party modules
	that are not configured with the <code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code>
	directive. When using such modules, the order of processing
	is determined in the modules' source code and is not configurable.</p>

	</div>
	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="directive-section"><h2><a name="AuthBasicFake" id="AuthBasicFake">AuthBasicFake</a> <a name="authbasicfake" id="authbasicfake">Directive</a></h2>
	<table class="directive">
	<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Fake basic authentication using the given expressions for
	username and password</td></tr>
	<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicFake off\|<var>username</var> [<var>password</var>]</code></td></tr>
	<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>none</code></td></tr>
	<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
	<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
	<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
	<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
	<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.4.5 and later</td></tr>
	</table>
	<p>The username and password specified are combined into an
	Authorization header, which is passed to the server or service
	behind the webserver. Both the username and password fields are
	interpreted using the <a href="../expr.html">expression parser</a>,
	which allows both the username and password to be set based on
	request parameters.</p>

	<p>If the password is not specified, the default value "password"
	will be used. To disable fake basic authentication for an URL
	space, specify "AuthBasicFake off".</p>

	<p>In this example, we pass a fixed username and password to a
	backend server.</p>

	<div class="example"><h3>Fixed Example</h3><pre class="prettyprint lang-config"><Location "/demo">
	AuthBasicFake demo demopass
	</Location></pre>
	</div>

	<p>In this example, we pass the email address extracted from a client
	certificate, extending the functionality of the FakeBasicAuth option
	within the <code class="directive"><a href="../mod/mod_ssl.html#ssloptions">SSLOptions</a></code>
	directive. Like the FakeBasicAuth option, the password is set to the
	fixed string "password".</p>

	<div class="example"><h3>Certificate Example</h3><pre class="prettyprint lang-config"><Location "/secure">
	AuthBasicFake "%{SSL_CLIENT_S_DN_Email}"
	</Location></pre>
	</div>

	<p>Extending the above example, we generate a password by hashing the
	email address with a fixed passphrase, and passing the hash to the
	backend server. This can be used to gate into legacy systems that do
	not support client certificates.</p>

	<div class="example"><h3>Password Example</h3><pre class="prettyprint lang-config"><Location "/secure">
	AuthBasicFake "%{SSL_CLIENT_S_DN_Email}" "%{sha1:passphrase-%{SSL_CLIENT_S_DN_Email}}"
	</Location></pre>
	</div>

	<div class="example"><h3>Exclusion Example</h3><pre class="prettyprint lang-config"><Location "/public">
	AuthBasicFake off
	</Location></pre>
	</div>


	</div>
	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="directive-section"><h2><a name="AuthBasicProvider" id="AuthBasicProvider">AuthBasicProvider</a> <a name="authbasicprovider" id="authbasicprovider">Directive</a></h2>
	<table class="directive">
	<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets the authentication provider(s) for this location</td></tr>
	<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicProvider <var>provider-name</var>
	[<var>provider-name</var>] ...</code></td></tr>
	<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicProvider file</code></td></tr>
	<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
	<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
	<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
	<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
	</table>
	<p>The <code class="directive">AuthBasicProvider</code> directive sets
	which provider is used to authenticate the users for this location.
	The default <code>file</code> provider is implemented
	by the <code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code> module. Make sure
	that the chosen provider module is present in the server.</p>
	<div class="example"><h3>Example</h3><pre class="prettyprint lang-config"><Location "/secure">
	AuthType basic
	AuthName "private area"
	AuthBasicProvider dbm
	AuthDBMType SDBM
	AuthDBMUserFile "/www/etc/dbmpasswd"
	Require valid-user
	</Location></pre>
	</div>
	<p> Providers are queried in order until a provider finds a match
	for the requested username, at which point this sole provider will
	attempt to check the password. A failure to verify the password does
	not result in control being passed on to subsequent providers.</p>

	<p>Providers are implemented by <code class="module"><a href="../mod/mod_authn_dbm.html">mod_authn_dbm</a></code>,
	<code class="module"><a href="../mod/mod_authn_file.html">mod_authn_file</a></code>, <code class="module"><a href="../mod/mod_authn_dbd.html">mod_authn_dbd</a></code>,
	<code class="module"><a href="../mod/mod_authnz_ldap.html">mod_authnz_ldap</a></code> and <code class="module"><a href="../mod/mod_authn_socache.html">mod_authn_socache</a></code>.</p>

	</div>
	<div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
	<div class="directive-section"><h2><a name="AuthBasicUseDigestAlgorithm" id="AuthBasicUseDigestAlgorithm">AuthBasicUseDigestAlgorithm</a> <a name="authbasicusedigestalgorithm" id="authbasicusedigestalgorithm">Directive</a></h2>
	<table class="directive">
	<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Check passwords against the authentication providers as if
	Digest Authentication was in force instead of Basic Authentication.
	</td></tr>
	<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>AuthBasicUseDigestAlgorithm MD5\|Off</code></td></tr>
	<tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>AuthBasicUseDigestAlgorithm Off</code></td></tr>
	<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
	<tr><th><a href="directive-dict.html#Override">Override:</a></th><td>AuthConfig</td></tr>
	<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
	<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_auth_basic</td></tr>
	<tr><th><a href="directive-dict.html#Compatibility">Compatibility:</a></th><td>Apache HTTP Server 2.4.7 and later</td></tr>
	</table>
	<p>Normally, when using Basic Authentication, the providers listed in
	<code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code>
	attempt to verify a user by checking their data stores for
	a matching username and associated password. The stored passwords
	are usually encrypted, but not necessarily so; each provider may
	choose its own storage scheme for passwords.</p>

	<p>When using <code class="directive"><a href="../mod/mod_auth_digest.html#authdigestprovider">AuthDigestProvider</a></code> and Digest
	Authentication, providers perform a similar check to find a matching
	username in their data stores. However, unlike in the Basic
	Authentication case, the value associated with each stored username
	must be an encrypted string composed from the username, realm name,
	and password. (See
	<a href="http://tools.ietf.org/html/rfc2617#section-3.2.2.2">
	RFC 2617, Section 3.2.2.2</a> for more details on the format used
	for this encrypted string.)</p>

	<p>As a consequence of the difference in the stored values between
	Basic and Digest Authentication, converting from Digest
	Authentication to Basic Authentication generally requires that all
	users be assigned new passwords, as their existing passwords cannot
	be recovered from the password storage scheme imposed on those
	providers which support Digest Authentication.</p>

	<p>Setting the <code class="directive">AuthBasicUseDigestAlgorithm</code> directive
	to <code>MD5</code> will cause the user's Basic Authentication password
	to be checked using the same encrypted format as for Digest
	Authentication. First a string composed from the username, realm name,
	and password is hashed with MD5; then the username and this encrypted
	string are passed to the providers listed in
	<code class="directive"><a href="#authbasicprovider">AuthBasicProvider</a></code>
	as if
	<code class="directive"><a href="../mod/mod_authn_core.html#authtype">AuthType</a></code>
	was set to <code>Digest</code> and Digest Authentication was in force.
	</p>

	<p>Through the use of <code class="directive">AuthBasicUseDigestAlgorithm</code>
	a site may switch from Digest to Basic Authentication without
	requiring users to be assigned new passwords.</p>

	<div class="note">
	The inverse process of switching from Basic to Digest
	Authentication without assigning new passwords is generally
	not possible. Only if the Basic Authentication passwords
	have been stored in plain text or with a reversible encryption
	scheme will it be possible to recover them and generate a
	new data store following the Digest Authentication password
	storage scheme.
	</div>

	<div class="note">
	Only providers which support Digest Authentication will be able
	to authenticate users when <code class="directive">AuthBasicUseDigestAlgorithm</code>
	is set to <code>MD5</code>. Use of other providers will result
	in an error response and the client will be denied access.
	</div>

	</div>
	</div>
	<div class="bottomlang">
	<p><span>Available Languages: </span><a href="../en/mod/mod_auth_basic.html" title="English"> en </a> \|
	<a href="../fr/mod/mod_auth_basic.html" hreflang="fr" rel="alternate" title="Français"> fr </a> \|
	<a href="../ja/mod/mod_auth_basic.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> \|
	<a href="../ko/mod/mod_auth_basic.html" hreflang="ko" rel="alternate" title="Korean"> ko </a></p>
	</div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Libera.chat, or sent to our <a href="https://httpd.apache.org/lists.html">mailing lists</a>.</div>
	<script type="text/javascript"><!--//--><![CDATA[//><!--
	var comments_shortname = 'httpd';
	var comments_identifier = 'http://httpd.apache.org/docs/2.4/mod/mod_auth_basic.html';
	(function(w, d) {
	if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
	d.write('<div id="comments_thread"><\/div>');
	var s = d.createElement('script');
	s.type = 'text/javascript';
	s.async = true;
	s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
	(d.getElementsByTagName('head')[0] \|\| d.getElementsByTagName('body')[0]).appendChild(s);
	}
	else {
	d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
	}
	})(window, document);
	//--><!]]></script></div><div id="footer">
	<p class="apache">Copyright 2022 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
	<p class="menu"><a href="../mod/">Modules</a> \| <a href="../mod/directives.html">Directives</a> \| <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> \| <a href="../glossary.html">Glossary</a> \| <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
	if (typeof(prettyPrint) !== 'undefined') {
	prettyPrint();
	}
	//--><!]]></script>
	</body></html>