RealServer can store an encrypted password file for verifying usernames and passwords supplied by users. It can thereby validate file requests or any other operation requiring authentication parameters. When communicating through RTSP, RealSystem can transmit passwords securely over the network. This section discusses supported authorization types and explains how to add authentication functionality to a RealSystem plug-in.
![]() |
Additional Information |
---|
You also need to set RealServer's authentication parameters as described in "Authentication Parameters". See "Handling Password Authentication" for information on how the RealSystem client gathers a username and password from the user. |
RealSystem authentication involves the following interfaces:
IRMAAuthenticator
. Header file: rmaauth.h
. The authenticator object, which performs the password validation, implements this interface. The response interface is IRMAAuthenticatorResponse
.
IRMAAuthenticatorRequest
. Header file: rmaauth.h
. The object that has access to the parameters to be authenticated implements this interface.
IRMAAuthenticatorResponse
. Header file: rmaauth.h
. The object that receives notice whether the authentication succeeded or failed implements this interface.
IRMAAuthenticationManager
. Header file: rmaauth.h
. The RealSystem top-level client implements this interface to receive notice from the client core that it should gather a username and password.
IRMAAuthenticationManagerResponse
. Header file: rmaauth.h
. The RealSystem client core implements this interface to receive usernames and passwords from the top-level client.
IRMAFileAuthenticator
. Header file: rmafiles.h
. File objects implement this interface to become associated with authenticator objects.
IRMAPassword
. Header file: rmaauth.h
. RealSystem implements this interface to provide a means for the client to transmit encrypted or unencrypted passwords.
Any plug-in that needs to perform password authorization can compare username/password values sent in by a user against those stored in RealServer's encrypted password file. As the following examples illustrate, RealSystem's structure of authenticator object, authentication request object, and authentication response object provides a flexible means of implementing authentication under different circumstances.
The most common use of authentication is a file system plug-in that performs password validation for a file requested by a RealSystem client. This process works as follows:
IRMACommonClassFactory
. It identifies itself as the authentication request object by calling IRMAAuthenticator::InitAuthenticator
.
![]() |
Additional Information |
---|
See "Chapter 7: File System Plug-In". |
IRMAFileAuthenticator::SetAuthenticator
on the file object to associate it with the IRMAAuthenticator
interface.
IRMAAuthenticator::Authenticate
, identifying itself as the response object that implements IRMAAuthenticatorResponse
.
Optionally, the IRMAAuthenticator::Authenticate
call can include a pointer to an IRMAValues
interface that contains a value for AuthType. A value of 1
instructs RealServer to use basic authorization for an HTTP connection. A value of 2
tells it to use DIGEST
authorization (which is always used on an RTSP connection). If this information is not included, RealServer determines the authorization type as described below.
IRMAAuthenticatorRequest:::GetAuthValues
to get from the authentication request object (RealServer) the username and password to be authenticated. This method passes along the IRMAValues
interface that sets the authorization type.
HTTPAuthType
variable to determine whether to use basic or DIGEST
authorization for an HTTP connection. It always uses DIGEST
authorization for an RTSP connection.
![]() |
Additional Information |
---|
See "Authentication Parameters". |
The authentication request object calls IRMAAuthenticator::AuthValuesReady
to pass the authenticator object a pointer to an IRMAValues
interface that contains the Username
and Password
values to be authenticated. The values interface also contains the AuthType
value.
![]() |
Additional Information |
---|
See "Handling Password Authentication" for information on how the client gathers passwords. |
IRMAAuthenticatorResponse::AuthenticateDone
to pass the file object a status code of PNR_OK
or PNR_NOT_AUTHORIZED
. The call includes a pointer to an IRMAValues
interface that contains Username
and Password
.
![]() |
Additional Information |
---|
See "Status Codes". |
PNR_OK
through IRMAFileResponse::InitDone
. If authorization fails, it passes along PNR_NOT_AUTHORIZED
.
Because it has access to the username and password in the IRMAValues
interface it receives, the file object can perform its own authorization checking to narrow the scope of valid users.
Suppose that users Blakes7 and RedDwarf are validated by RealServer's password file, but only Blakes7 should have access to files served by this file system plug-in. The plug-in can implement its own user list that its file object accesses after a successful system validation. This prevents RedDwarf from accessing the file even though RealServer's authenticator object returned PNR_OK
.
RealSystem can perform password authorization on actions other than file requests. A monitor plug-in, for example, may validate passwords when a client connects to RealServer. In this example, the monitor plug-in implements both IRMAAuthenticatorRequest
and IRMAAuthenticatorResponse
, supplying the values to be authenticated and receiving the authentication results:
![]() |
Additional Information |
---|
See "Chapter 14: Network Services". |
IRMAValues
interface under Username
and Password
.
IRMACommonClassFactory
to instantiate an authenticator object.
IRMAAuthenticator::InitAuthenticator
to identify itself as the authentication request object.
IRMAAuthenticator::Authenticate
, identifying itself as the authentication response object.
IRMAAuthenticatorRequest:::GetAuthValues
to get from the plug-in the username and password to be authenticated.
IRMAAuthenticator::AuthValuesReady
to pass the authenticator object a pointer to the IRMAValues
interface that contains the Username
and Password
values.
IRMAAuthenticatorResponse::AuthenticateDone
to pass the plug-in a status code of PNR_OK
or PNR_NOT_AUTHORIZED
.
![]() |
Additional Information |
---|
See "Status Codes". |
RealSystem supports two authorization types:
PN_AUTH_BASIC
HTTP 1.0, Netscape Navigator 3.0, and Internet Explorer 3.0 support basic authorization, which uses unencrypted usernames and passwords. The client uses IRMAPassword::Crypt
to encode two strings for the username and password in base-64 for transmission to RealServer or an HTTP server.
PN_AUTH_DIGEST
RTSP and HTTP 1.1 support the DIGEST
type of secure password authorization. (Not all browsers support it, however.) The authorization type contains strings for Nonce, URL, Realm, and Opaque, as described in RFC 2069. The client uses IRMAPassword::Crypt
to encrypt those four values along with the username and password. RealServer stores the encrypted string in IRMAValues
for comparison against its password file.
RTSP communication between RealServer and the client uses DIGEST
authorization. The RealServer configuration parameter HTTPAuthType
determines whether HTTP communication between RealServer and a client uses basic or DIGEST
authentication.
![]() |
Additional Information |
---|
See "Authentication Parameters". |
The mkpnpass program adds username and password combinations to the RealServer password file, which is defined by the RealServer configuration file. Windows and UNIX executables are provided in the utilities directory of the SDK. You can invoke mkpnpass from a CGI script or run it from the command line with the following syntax:
% mkpnpass <username
> <realm
>
The realm is a required parameter. It is used with DIGEST
authorization and is also specified in the RealServer configuration file. After you specify the username and realm, the program prompts you to enter and then confirm the password. The username and password combination work for either basic or DIGEST
authorization.
The RealSystem SDK includes a sample authentication plug-in in /samples/intermed/exauth/exauth.cpp
. This plug-in implements a simple authentication protocol as described in the HTTP/1.1 standard (rfc2068). Follow the instructions in the source file to test the sample or use it as the basis for your own plug-in.