q about LWP:UserAgent credentials()

[dan baker]

I have figured out how to use LWP:UserAgent and authorization_basic()
to enable POSTing from one script to another under htaccess (in the
same directory on the same server)... However this requires passing
the user's password in clear text, which means I have to have all the
passwords stored in clear text on the server, which I'm not crazy
about for security.

what I'd really like to be able to do is grab the credentials of
whomever is logged in running the first script, and allow them to run
the second script via the UserAgent.

Is this possible?
are the credentials() or get_basic_credentials() the methods to use to
do this?

I've read the docs on these methods, but could not find any real
details or examples about what they do or how to use them. Does anyone
know of a tutorial or example on what these methods can be used for?

thanks,

D

 

[Brian McCauley]

I have figured out how to use LWP:UserAgent and authorization_basic()
to enable POSTing from one script to another under htaccess (in the
same directory on the same server)... However this requires passing
the user's password in clear text, which means I have to have all the
passwords stored in clear text on the server, which I'm not crazy
about for security.

what I'd really like to be able to do is grab the credentials of
whomever is logged in running the first script, and allow them to run
the second script via the UserAgent.

Is this possible?

Are you talking about CGI here?

On some servers HTTP it is possible to configure them to include the
plaintext basic authorization credentials in the CGI environment.

How to do this, of course, has nothing to do with Perl. (On at least
one release of IIS this was the default - which, of course, is not
good).

are the credentials() or get_basic_credentials() the methods to use to
do this?

Not as far as I can see - these are for manipulating the HTTP::Request
objects that exist within Perl (LWP) is acting as an HTTP client.

--
\\ ( )
. _\\__[oo
.__/ \\ /\@
. l___\\
# ll l\\
###LL LL\\

 

[gnari]

Not as far as I can see - these are for manipulating the HTTP::Request
objects that exist within Perl (LWP) is acting as an HTTP client.

actually, I interpreted the OP's question as that he intented to
call a HTTP::Request to the second script from within the processing
of the first. his problem was that he had not figured a way to
extract the credentials info from his CGI environment.

if he controls the second script he can just do any necessary
changes to it to allow the first script to call it directly.

if he cannot do that, he can make a variant of the second script
to do the same, or just emulate the CGI environment when he call it.

gnari

 

[Brian McCauley]

actually, I interpreted the OP's question as that he intented to
call a HTTP::Request to the second script from within the processing
of the first.

So did I.

his problem was that he had not figured a way to
extract the credentials info from his CGI environment.

That's what I thought too.

if he controls the second script he can just do any necessary
changes to it to allow the first script to call it directly.

You are right, this smells of an XY problem. I only addresed the Y.
You have a offered better solution to what we guess is his X.

A better solution to X is to rip the guts of the second script out
into a module that is used by both scripts - this completely elminates
the need to spawn a separate process.

if he cannot do that, he can make a variant of the second script
to do the same,

Bad idea - that way lies a maintainance headache every time the second
script changes.

or just emulate the CGI environment when he call it.

"or just"? This is not trivial - but I think there may be a module to
do it.

--
\\ ( )
. _\\__[oo
.__/ \\ /\@
. l___\\
# ll l\\
###LL LL\\

 

[dan baker]

his problem was that he had not figured a way to
extract the credentials info from his CGI environment.

-------
exactly... I want to simply pass along whatever I need to allow the
second script to run with the same (already logged in) user that is
running the first script.

I CAN load and pass the RemoteUser and Password using
authorization_basic(), but I dont WANT to store the clear text
passwords on the server if I can help it.

d