Check Authorization / WWW-Authenticate headers
Hi. I am trying to make sure that the user what is trying to/has authenticated to a site w/ Basic Auth matches a user in a list. However, I cannot force the server to prompt if the user/pass is not accepted by the web server. It just responds with the Access is Denied message. I only want the check to take place if the web server allows the auth. Any ideas? Thanks.
if { ([HTTP::header value Authorization] ne "") } { Format should be: Basic dXNlcm5hbWU6cGFzc3dvcmQ= where the token is a base64 encoding of user:pass
set basicuserid [string tolower [getfield [b64decode [lindex [HTTP::header Authorization] 1]] ":" 1]] if the basic auth user is not in our list ($UserList) then drop request
if { [lsearch $UserList $basicuserid] equals -1 } { ACCESS::session remove HTTP::respond 200 content "Access is Denied!" reject } }