Apache HTTP Server Version 2.2
Apache HTTP Server Version 2.2
This document refers to a legacy release (2.2) of Apache httpd. The active release (2.4) is documented here. If you have not already upgraded, please follow this link for more information.
You may follow this link to go to the current version of this document.
| Description: | User Authorization |
|---|---|
| Status: | Base |
| Module Identifier: | authz_user_module |
| Source File: | mod_authz_user.c |
| Compatibility: | Available in Apache 2.1 and later |
This module provides authorization capabilities so that
authenticated users can be allowed or denied access to portions
of the web site. mod_authz_user grants
access if the authenticated user is listed in a Require user
directive. Alternatively Require valid-user can be used to
grant access to all successfully authenticated users.
| Description: | Sets whether authorization will be passed on to lower level modules |
|---|---|
| Syntax: | AuthzUserAuthoritative On|Off |
| Default: | AuthzUserAuthoritative On |
| Context: | directory, .htaccess |
| Override: | AuthConfig |
| Status: | Base |
| Module: | mod_authz_user |
Setting the AuthzUserAuthoritative
directive explicitly to Off allows for
user authorization to be passed on to lower level modules (as defined
in the modules.c files) if there is no
user matching the supplied userID.
By default, control is not passed on and an unknown user
will result in an Authentication Required reply. Not
setting it to Off thus keeps the system secure and forces
an NCSA compliant behaviour.
