CONTROLLING ACCESSES


In order to control the access to a file, you must add the security in the directory you would like to protect. The security file itself is a XML file but in order to be used by MyServer it should not have any extension specified (the file name has to be simply "security").

The syntax of the file is:

<?xml version="1.0"?>
<SECURITY>
<HTTP TRACE="ON" />
<AUTH TYPE="Basic" />

<ACTION name="Host" value="localhost">ALLOW</ACTION>
<USER NAME="God" PASS="godpassword" READ="TRUE" WRITE="TRUE" BROWSE="TRUE" EXECUTE="TRUE" />
<!--This is the setting for the user-->
<USER NAME="Guest" PASS="" READ="TRUE" BROWSE="TRUE"/>
<!--The guest user-->
<USER NAME="Tim" PASS="Tom" READ="TRUE" EXECUTE="TRUE" BROWSE="TRUE"/>
<!--Another user-->
<ITEM FILE="file1" READ="TRUE" WRITE="FALSE" EXECUTE="FALSE">
<ACTION name="Host" value="remote">DENY</ACTION>
<!--Define a file and its permissions-->
<USER NAME="Jim" PASS="Morrison" READ="TRUE" WRITE="FALSE" EXECUTE="FALSE" />
<!--Define the user permissions for the file-->
<USER NAME="Bob" PASS="Marley" READ="TRUE" WRITE="FALSE" EXECUTE="TRUE" />
<ACTION name="Host" value="localhost">DENY</ACTION>
<!--Another user permissions for the file-->
</ITEM>
<--End of the file block-->
</SECURITY>


The line <HTTP TRACE="ON" /> is optional, and is described in the Virtual Hosts section of this guide. Please, go to that link if you want to understand about that line.

The line <AUTH TYPE="Basic" />, optional, selects the authentication scheme to be used for your site. Its default value is "Basic", but you can also use "Digest", so it will look like this:

<AUTH TYPE="Digest" />
if the line isn't in the file, the default "Basic" will be used.
The "Digest" schema is safer, as the passwords aren't transferred open through the net.

The engine first checks to see if the user has permissions in the file block:
<USER NAME="Bob" PASS="Marley" READ="TRUE" WRITE="FALSE" EXECUTE="TRUE" />

If there are no permissions defined, the engine tries to use the permissions that are defined for the file:
<ITEM FILE="file1" READ="TRUE" WRITE="FALSE" EXECUTE="FALSE">

If the engine cannot find any file permissions, it then uses the general settings for the user:

<USER NAME="Guest" PASS="" READ="TRUE" BROWSE="TRUE"/>

If the user is not defined, the engine will send an error to the user.



The <ACTION> lines above define if a resource will be allowed to be accessed or not, depending on the conditions. For example, the line


<ACTION name="Host" value="remote">DENY</ACTION>

means the file "file1" will be denied if the Host used to access the file is "remote" as hostname. But if there were others maps to the file in other hostnames, for example "localhost", it can be accessed, execpt by user Bob, as specified by the line below:

<ACTION name="Host" value="localhost">DENY</ACTION>


If the security file is not present, the directory tree will be upper visited until a security file is not found, if the host directory is reached a default security file will be used. The default security file is located in the system directory.