recognizes two arguments for the <code class="directive"><a href="../mod/core.html#require">Require</a></code> directive, <code>file-owner</code> and
<code>file-group</code>, as follows:</p>
<dl>
<dt><code>file-owner</code></dt>
<dd>The supplied web-username must match the system's name for the
owner of the file being requested. That is, if the operating system
says the requested file is owned by <code>jones</code>, then the
username used to access it through the web must be <code>jones</code>
as well.</dd>
<dt><code>file-group</code></dt>
<dd>The name of the system group that owns the file must be present
in a group database, which is provided, for example, by <code class="module"><a href="../mod/mod_authz_groupfile.html">mod_authz_groupfile</a></code> or <code class="module"><a href="../mod/mod_authz_dbm.html">mod_authz_dbm</a></code>,
and the web-username must be a member of that group. For example, if
the operating system says the requested file is owned by (system)
group <code>accounts</code>, the group <code>accounts</code> must
appear in the group database and the web-username used in the request
must be a member of that group.</dd>
</dl>
<div class="note"><h3>Note</h3>
<p>If <code class="module"><a href="../mod/mod_authz_owner.html">mod_authz_owner</a></code> is used in order to authorize
a resource that is not actually present in the filesystem
(<em>i.e.</em> a virtual resource), it will deny the access.</p>
<p>Particularly it will never authorize <a href="../content-negotiation.html#multiviews">content negotiated
<p>Consider a system similar to the one described above, but with
some users that share their project files in
<code>~/public_html/project-foo</code>. The files are owned by the
system group <code>foo</code> and there is a single <code class="directive"><a href="../mod/mod_authz_dbm.html#authdbmgroupfile">AuthDBMGroupFile</a></code> database that
contains all of the web-usernames and their group membership,
<em>i.e.</em> they must be at least member of a group named
<code>foo</code>. So if <code>jones</code> and <code>smith</code>
are both member of the group <code>foo</code>, then both will be
authorized to access the <code>project-foo</code> directories of
<p>Setting the <code class="directive">AuthzOwnerAuthoritative</code>
directive explicitly to <code>Off</code> allows for
user authorization to be passed on to lower level modules (as defined
in the <code>modules.c</code> files) if:</p>
<ul>
<li>in the case of <code>file-owner</code> the file-system owner does not
match the supplied web-username or could not be determined, or</li>
<li>in the case of <code>file-group</code> the file-system group does not
contain the supplied web-username or could not be determined.</li>
</ul>
<p>Note that setting the value to <code>Off</code> also allows the
combination of <code>file-owner</code> and <code>file-group</code>, so
access will be allowed if either one or the other (or both) match.</p>
<p>By default, control is not passed on and an authorization failure
will result in an "Authentication Required" reply. Not
setting it to <code>Off</code> thus keeps the system secure and forces
an NCSA compliant behaviour.</p>
</div>
</div>
<div class="bottomlang">
<p><span>Available Languages: </span><a href="../en/mod/mod_authz_owner.html" title="English"> en </a> |
<a href="../ja/mod/mod_authz_owner.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> |
<a href="../ko/mod/mod_authz_owner.html" hreflang="ko" rel="alternate" title="Korean"> ko </a></p>
</div><div id="footer">
<p class="apache">Copyright 2007 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
