Member Avatar for Samyx

Hi guys,

I am trying to create a login page using apache mod_auth_form to authenticate users. Once the user is authenticated he/she should be able to access the main page.

# my public directory: #
C:/webroot/
regtrack_newSG.php

# my protected directory: #
C:/webroot/myapp/
regtrack_studysiteone.php

# my password file:
C:/Apache24/passwd/passwords

# .htaccess file under the protected directory: #

    AuthFormProvider file
    AuthUserFile "C:\Apache24\passwd\passwords" 
    AuthFormLoginRequiredLocation /regtrack_newSG.php
    AuthFormLoginSuccessLocation /myapp/regtrack_studysiteone.php
    AuthType form
    AuthName realm
    Session On
    SessionCookieName session path=/
    SessionCryptoPassphrase secret
    Require valid-user

# httpd config: #

    LoadModule auth_form_module modules/mod_auth_form.so

    DocumentRoot "c:/webroot"
    <Directory "c:/webroot">
        Options Indexes FollowSymLinks
        AllowOverride AuthConfig
        Order allow,deny
        Allow from all

    </Directory>

    <Directory "c:/webroot/myapp">
      Options FollowSymlinks
      AllowOverride AuthConfig
      Order allow,deny
      Allow from all
    </Directory>

    <Location /dologin>
        SetHandler form-login-handler
        AuthFormProvider file
        AuthUserFile "C:/Apache24/passwd/passwords" 
        AuthFormLoginRequiredLocation /regtrack_newSG.php
        AuthFormLoginSuccessLocation /myapp/regtrack_studysiteone.php
        AuthType form
        AuthName realm
        Session On
        SessionCookieName session path=/
        SessionCryptoPassphrase secret    
    </Location>


# my login page (regtrack_newSG.php): #

    <html>
    <form method="POST" action="/dologin">
    <b>Username:</b>  <input type="text" name="httpd_username" value="" /><br>
    <b>Password:</b>  <input type="password" name="httpd_password" value="" /><br>
    </TD></TR>
    <TR><TD align=center>
    <input type="submit" name="login" value="Login" /> 
    </form>
    </html>

## When entering an invalid user, it gives me this message: ##

"This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required."

## When entering a valid user, it gives me this message: ##

"The connection to the server was reset while the page was loading..."

# Apache Error log: #

[Fri Feb 13 08:46:59.346701 2015] [ssl:warn] [pid 7456:tid 440] AH01909: RSA certificate configured for OC.lacrn.LOCAL:8801 does NOT include an ID which matches the server name
[Fri Feb 13 08:46:59.487327 2015] [ssl:warn] [pid 7456:tid 440] AH01909: RSA certificate configured for OC.lacrn.LOCAL:8801 does NOT include an ID which matches the server name
[Fri Feb 13 08:46:59.491164 2015] [mpm_winnt:notice] [pid 7456:tid 440] AH00354: Child: Starting 64 worker threads.

I have no clue why it is happening. Can anyone help me?

Thank you.

Edited by Dani because: Formatting fixed
  • 2 Contributors
  • 3 Replies
  • 2K Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by cereal

Dani AI

Generated

the symptoms you describe usually happen when form auth tries to set/read the session but the needed modules are not actually loaded. is spot on; make sure these are enabled, then restart httpd:

LoadModule authn_file_module modules/mod_authn_file.so
LoadModule authz_core_module modules/mod_authz_core.so
LoadModule authz_user_module modules/mod_authz_user.so
LoadModule session_module modules/mod_session.so
LoadModule session_cookie_module modules/mod_session_cookie.so
LoadModule session_crypto_module modules/mod_session_crypto.so
LoadModule request_module modules/mod_request.so
LoadModule auth_form_module modules/mod_auth_form.so

The session directives you use (Session On, SessionCookieName, SessionCryptoPassphrase) come from the session modules; without them, login will break. Request bodies are handled by request_module. (httpd.apache.org)

Two small config fixes often missed:

  • Use Apache 2.4 authz syntax everywhere. Replace legacy 2.2 lines like Order allow,deny / Allow from all with Require all granted to avoid odd merges. Mixing old and new is discouraged. (httpd.apache.org)
  • In your protected directory, the directive is Require valid-user (with a hyphen), not Require valid user. That provider is implemented by mod_authz_user. (httpd.apache.org)

A minimal 2.4-style access stanza for your docroot can look like:

<Directory "c:/webroot">
    Require all granted
</Directory>

Quick diagnostics:

  • Verify modules are really loaded: httpd -M (look for session*, request, authz*). (httpd.apache.org)
  • Temporarily increase logging for these modules to see what fails on POST:
    LogLevel auth_form:trace3 session:trace3 request:trace3 (per-module log levels are supported in 2.4). (httpd.apache.org)
  • After changing session settings, clear the browser cookie named by SessionCookieName to avoid stale encrypted session data. (httpd.apache.org)

Apply the above, then retest your valid user. If it still resets, paste the new error log lines with trace output and we can drill in further.

Recommended Answers

All 3 Replies

Member Avatar for Samyx

I removed the .htaccess file alltogether and placed the instruction in a Directory in the httpd config file.

<Directory "c:/webroot/myapp">
AuthFormProvider file
...
Require valid user
</Directory>

Now, when I try an unauthorized user it redirects me to the login page like it supposed to. But when I try to login with a valid user name and password it still gives me the error msg: "The connection to the server was reset while the page was loading..." and the same error msg from the log as posted previously.

To answer your question, yes, the passwords have been encoded using the htpasswd. I checked the password file and the contents are as expected (username: encryption)

The apache login used to work when using the 'AuthType Basic', now with my custom login page form it doesn't.

Edited by Samyx
Member Avatar for cereal

Your configuration works fine for me, just make sure to enable all the modules requested by this procedure, I did a fresh install of Apache and I had to enable these modules:

  • session
  • session_cookie
  • session_crypto
  • request
  • auth_form

After that everything worked fine. For example by using AuthFormProvider file Apache requires the authn_file module which is usually enabled by default, but make sure it is on.

Edited by cereal
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.