#authorization
Posts
-
Digging into MariaDB's Source 7: Preparation — Checking Privileges, Opening Tables, Resolving Names
We follow, in the source, the three things the server does with the parser's LEX before it plans anything. In mysql_execute_command()'s big switch, check_table_access() checks privileges; open_and_lock_tables() takes metadata locks and pulls TABLE_SHARE and TABLE out of their caches; JOIN::prepare() binds column names to Field objects. We watch column-privilege errors 1142 and 1143, Opened_tables and Table_open_cache_hits moving, an ALTER TABLE waiting behind an open transaction with a plain SELECT queued behind it, and the call stack that raises errors 1054 and 1052.
-
Digging into Apache httpd's Source 13: Authentication and Authorization — How a Require Line Is Decided
We follow what AuthType Basic, AuthUserFile, Require valid-user and <RequireAll> in httpd.conf actually do in the source. Why "who are you" (authentication) and "may you come in" (authorization) live in separate modules, providers that are swapped in by name, the Require tree and its GRANTED, DENIED and NEUTRAL results, and the order in request.c that runs the same decision twice — all checked against the real source and example output.
-
Digging into Tomcat's Source 14: Authentication and Realms — How security-constraint Is Enforced
We follow how web.xml's security-constraint and login-config, server.xml's Realm and tomcat-users.xml connect in the source. Where the Authenticator valve is plugged in when a web app starts, the order of checks in AuthenticatorBase.invoke(), the four searches that pick the constraints for a URL, how BASIC and FORM differ, and what the Realm and the CredentialHandler do — all checked against the real source and real 401, 403 and 303 responses.