#authentication
Posts
-
Digging into MariaDB's Source 4: Connections and Threads — One Thread per Connection, and the Thread Pool
We follow the source from the moment mariadbd's main thread accepts a connection with poll() and wraps it in a CONNECT, to the point where it hands it to the scheduler (a bundle of function pointers) chosen by thread_handling. We look at the default one-thread-per-connection mode and its thread cache, the login step that creates the THD and authenticates, and how the thread pool — thread groups, a listener, workers and a timer_thread — detaches idle connections from threads, checking each step with ps, information_schema and gdb, and comparing it with httpd's MPMs and Tomcat's endpoint.
-
Digging into Apache httpd's Source 13: Authentication and Authorization — How a Require Line Is Decided
We follow what AuthType Basic, AuthUserFile, Require valid-user and <RequireAll> in httpd.conf actually do in the source. Why "who are you" (authentication) and "may you come in" (authorization) live in separate modules, providers that are swapped in by name, the Require tree and its GRANTED, DENIED and NEUTRAL results, and the order in request.c that runs the same decision twice — all checked against the real source and example output.
-
Digging into Tomcat's Source 14: Authentication and Realms — How security-constraint Is Enforced
We follow how web.xml's security-constraint and login-config, server.xml's Realm and tomcat-users.xml connect in the source. Where the Authenticator valve is plugged in when a web app starts, the order of checks in AuthenticatorBase.invoke(), the four searches that pick the constraints for a URL, how BASIC and FORM differ, and what the Realm and the CredentialHandler do — all checked against the real source and real 401, 403 and 303 responses.