Icecast Server/2.5 Authentication - Revision history

Phschafft: /* Overview */ Update: Linked docu on headers

2023-03-11T16:16:41Z

Overview: Update: Linked docu on headers

← Older revision		Revision as of 16:16, 11 March 2023
Line 19:		Line 19:
	\| <code><<nowiki />option /></code> \|\| Options passed to the used [[#Backends\|backend]].		\| <code><<nowiki />option /></code> \|\| Options passed to the used [[#Backends\|backend]].
	\|-		\|-
	\| <code><<nowiki />http-headers /></code> \|\| Standard HTTP headers block. Is used if the ''role'' matches.		\| <code><<nowiki />http-headers /></code> \|\| [[Icecast Server/Custom HTTP Headers\|Standard HTTP headers block]]. Is used if the ''role'' matches.
	\|-		\|-
	\| <code><<nowiki />acl /></code> \|\| Experimental. Do not use.		\| <code><<nowiki />acl /></code> \|\| Experimental. Do not use.

Phschafft: /* Options */ Update: Completed list of options.

2023-03-11T15:34:31Z

Options: Update: Completed list of options.

← Older revision		Revision as of 15:34, 11 March 2023
Line 183:		Line 183:
	\| <code>action_remove</code> \|\| no \|\| string \|\| <code>listener_remove</code> \|\| Value for the <code>action</code>-parameter sent as part of backend requests when clients disconnect.		\| <code>action_remove</code> \|\| no \|\| string \|\| <code>listener_remove</code> \|\| Value for the <code>action</code>-parameter sent as part of backend requests when clients disconnect.
	\|-		\|-
	\| <code>auth_header</code> \|\| no \|\| ? \|\| ? \|\| Legacy. Use <code>header_auth</code> instead.		\| <code>auth_header</code> \|\| no \|\| string \|\| <code>icecast-auth-user: 1\r\n</code> \|\| Legacy. Use <code>header_auth</code> instead.
	\|-		\|-
	\| <code>timelimit_header</code> \|\| no \|\| ? \|\| ? \|\| Legacy. Use <code>header_timelimit</code> instead.		\| <code>timelimit_header</code> \|\| no \|\| string \|\| <code>icecast-auth-timelimit:</code> \|\| Legacy. Use <code>header_timelimit</code> instead.
	\|-		\|-
	\| <code>header_auth</code> \|\| ? \|\| token \|\| ? \|\| ?		\| <code>header_auth</code> \|\| no \|\| token \|\| <code>x-icecast-auth-result</code> \|\| Header used to transport the backends result for the given credentials. Might be one of <code>ok</code>, <code>failed</code>, or <code>no match</code>.
	\|-		\|-
	\| <code>header_timelimit</code> \|\| ? \|\| token \|\| ? \|\| ?		\| <code>header_timelimit</code> \|\| no \|\| token \|\| <code>x-icecast-auth-timelimit</code> \|\| Header used to transport how long a client may stay connected. In seconds. If the header is absent the client is allowed to stay connected indefinitely.
	\|-		\|-
	\| <code>header_message</code> \|\| ? \|\| token \|\| ? \|\| ?		\| <code>header_message</code> \|\| no \|\| token \|\| <code>x-icecast-auth-message</code> \|\| Header used to transport a message that is logged when login failed.
	\|-		\|-
	\| <code>header_alter_action</code> \|\| no \|\| token \|\| <code>x-icecast-auth-alter-action</code> \|\| Alter ''action'' used. When no such header is returned no client altering will be performed. See [[#Client altering\|altering]].		\| <code>header_alter_action</code> \|\| no \|\| token \|\| <code>x-icecast-auth-alter-action</code> \|\| Alter ''action'' used. When no such header is returned no client altering will be performed. See [[#Client altering\|altering]].

Phschafft: /* Backends */ Feature: Wrote on backend options

2023-03-11T14:00:51Z

Backends: Feature: Wrote on backend options

@@ Line 132: / Line 132: @@
 === Backend <code>anonymous</code> ===
 This backend matches all client requests. It is used to implement catch all rules. This is most prominently used at the end of an <code><<nowiki />authentication /></code> block to stop processing and applying defaults. [[#Matching|Matching]] still applies.
 === Backend <code>static</code> ===
 This backend is used to match a client by username and check for a static provided password. This is the 2.5.x variant of defining e.g. global admin accounts and similar.
 === Backend <code>legacy-password</code> ===
 Do not use. This backend is used internally as part of the ICY emulation. ICY emulation by itself is deprecated.
 === Backend <code>url</code> ===
 The URL backend is used to query a backend server (normally via HTTP or HTTPS) about the status of the used credentials.
 === Backend <code>htpasswd</code> ===
 The htpasswd backend compares the user and password against a flat file database. This is syntactically compatible with most ".htpasswd" implementations. However supported algorithms might differ. Therefore management of those files is best done via Icecast admin interface and/or API.
 === Backend <code>enforce-auth</code> ===
 The authentication enforcement backend will reject any client that does not pass credentials. The only use of this is to be placed in front of a mandatory <code>url</code> backend. This allows the <code>url</code> backend to skip negotiation requests and therefor reduce the load on the backend.

Phschafft: /* Backends */ Feature: Basic infos on each backend

2023-03-11T13:26:55Z

Backends: Feature: Basic infos on each backend

← Older revision		Revision as of 13:26, 11 March 2023
Line 129:		Line 129:
	\|}		\|}
	Note: More backends may be added in later versions.		Note: More backends may be added in later versions.

			=== Backend <code>anonymous</code> ===
			This backend matches all client requests. It is used to implement catch all rules. This is most prominently used at the end of an <code><<nowiki />authentication /></code> block to stop processing and applying defaults. [[#Matching\|Matching]] still applies.

			=== Backend <code>static</code> ===
			This backend is used to match a client by username and check for a static provided password. This is the 2.5.x variant of defining e.g. global admin accounts and similar.

			=== Backend <code>legacy-password</code> ===
			Do not use. This backend is used internally as part of the ICY emulation. ICY emulation by itself is deprecated.

			=== Backend <code>url</code> ===
			The URL backend is used to query a backend server (normally via HTTP or HTTPS) about the status of the used credentials.

			=== Backend <code>htpasswd</code> ===
			The htpasswd backend compares the user and password against a flat file database. This is syntactically compatible with most ".htpasswd" implementations. However supported algorithms might differ. Therefore management of those files is best done via Icecast admin interface and/or API.

			=== Backend <code>enforce-auth</code> ===
			The authentication enforcement backend will reject any client that does not pass credentials. The only use of this is to be placed in front of a mandatory <code>url</code> backend. This allows the <code>url</code> backend to skip negotiation requests and therefor reduce the load on the backend.

Phschafft: Update: Moved backends block to the end of the page

2023-03-11T13:16:21Z

Update: Moved backends block to the end of the page

@@ Line 31: / Line 31: @@
 | <code><<nowiki />on-deny-argument /></code> || Experimental. Do not use. See [[#Client altering|altering]].
 |}
 == Common properties ==
@@ Line 129: / Line 110: @@
 | <code>send_error</code> || a valid and known UUID || Sends the client one of the stock error messages.
 |}

Phschafft: /* Overview */ Feature: Added infos on what sub tags might be used

2023-03-11T13:15:21Z

Overview: Feature: Added infos on what sub tags might be used

@@ Line 12: / Line 12: @@
 # Client is rejected.
 Note: More steps may be added in later versions.
 == Backends ==

Phschafft: /* Common options */ Update: Renamed to Common properties to avoid confusion with

2023-03-11T13:06:58Z

Common options: Update: Renamed to Common properties to avoid confusion with <option />

← Older revision		Revision as of 13:06, 11 March 2023
Line 32:		Line 32:
	Note: More backends may be added in later versions.		Note: More backends may be added in later versions.

	== Common ~~options~~ ==		== Common properties ==
	All roles support the following common ~~options~~. They are passed as XML properties on the role's tag.		All roles support the following common properties. They are passed as XML properties on the role's tag.
	{\| class="wikitable"		{\| class="wikitable"
	! Property !! Description		! Property !! Description

Phschafft: /* Common options */ Update: Updated list some more

2023-03-11T13:03:58Z

Common options: Update: Updated list some more

← Older revision		Revision as of 13:03, 11 March 2023
Line 49:		Line 49:
	\| <code>nomatch-method</code> \|\| See [[#Matching\|matching]].		\| <code>nomatch-method</code> \|\| See [[#Matching\|matching]].
	\|-		\|-
	\| <code>match-web</code> \|\| See [[#Matching\|matching]].		\| <code>match-web</code> \|\| May be set to <code>*</code> to match all ''web/'' domain clients (default). See [[#Matching\|matching]].
	\|-		\|-
	\| <code>nomatch-web</code> \|\| See [[#Matching\|matching]].		\| <code>nomatch-web</code> \|\| May be set to <code>*</code> to not match all ''web/'' domain clients. See [[#Matching\|matching]].
	\|-		\|-
	\| <code>match-admin</code> \|\| See [[#Matching\|matching]].		\| <code>match-admin</code> \|\| See [[#Matching\|matching]].
Line 61:		Line 61:
	\| <code>nomatch-origin</code> \|\| See [[#Matching\|matching]].		\| <code>nomatch-origin</code> \|\| See [[#Matching\|matching]].
	\|-		\|-
	\| <code>may-alter</code> \|\| See [[#Client altering\|altering]].		\| <code>may-alter</code> \|\| List of ''actions'' the backend is allowed to use. Or <code>*</code> to allow all. See [[#Client altering\|altering]].
	\|-		\|-
	\| <code>may-not-alter</code> \|\| See [[#Client altering\|altering]].		\| <code>may-not-alter</code> \|\| List of ''actions'' the backend is denied to use. Or <code>*</code> to deny all. See [[#Client altering\|altering]].
	\|-		\|-
	\| <code>allow-method</code> \|\| List of allowed HTTP methods commands. Can be set to <code>*</code> to set the policy to allow.		\| <code>allow-method</code> \|\| List of allowed HTTP methods commands. Can be set to <code>*</code> to set the policy to allow.

Phschafft: Feature: Added stub about matching

2023-03-11T12:53:46Z

Feature: Added stub about matching

← Older revision		Revision as of 12:53, 11 March 2023
Line 45:		Line 45:
	\| <code>method</code> \|\| Obsolete. Use ''match-method''.		\| <code>method</code> \|\| Obsolete. Use ''match-method''.
	\|-		\|-
	\| <code>match-method</code> \|\| See matching.		\| <code>match-method</code> \|\| See [[#Matching\|matching]].
	\|-		\|-
	\| <code>nomatch-method</code> \|\| See matching.		\| <code>nomatch-method</code> \|\| See [[#Matching\|matching]].
	\|-		\|-
	\| <code>match-web</code> \|\| See matching.		\| <code>match-web</code> \|\| See [[#Matching\|matching]].
	\|-		\|-
	\| <code>nomatch-web</code> \|\| See matching.		\| <code>nomatch-web</code> \|\| See [[#Matching\|matching]].
	\|-		\|-
	\| <code>match-admin</code> \|\| See matching.		\| <code>match-admin</code> \|\| See [[#Matching\|matching]].
	\|-		\|-
	\| <code>nomatch-admin</code> \|\| See matching.		\| <code>nomatch-admin</code> \|\| See [[#Matching\|matching]].
	\|-		\|-
	\| <code>match-origin</code> \|\| See matching.		\| <code>match-origin</code> \|\| See [[#Matching\|matching]].
	\|-		\|-
	\| <code>nomatch-origin</code> \|\| See matching.		\| <code>nomatch-origin</code> \|\| See [[#Matching\|matching]].
	\|-		\|-
	\| <code>may-alter</code> \|\| See [[#Client altering\|altering]].		\| <code>may-alter</code> \|\| See [[#Client altering\|altering]].
Line 85:		Line 85:
	\| <code>connection-duration</code> \|\| Maximum time a connection is allowed to continue in seconds or <code>*</code> for unlimited. This might not be supported for connections other than listeners.		\| <code>connection-duration</code> \|\| Maximum time a connection is allowed to continue in seconds or <code>*</code> for unlimited. This might not be supported for connections other than listeners.
	\|}		\|}

			== Matching ==
			Matching is performed before the backend is asked to check a specific client. While matching a client is checked to have certain features (e.g. to use a specific HTTP method). If it does, the backend is consulted. If not a ''no-match'' is returned and the next role is tried.

	== Client altering ==		== Client altering ==

Phschafft: /* Client altering */ Feature: Added list of actions

2023-03-11T12:49:32Z

Client altering: Feature: Added list of actions

← Older revision		Revision as of 12:49, 11 March 2023
Line 87:		Line 87:

	== Client altering ==		== Client altering ==
	Client altering is a way of altering the request or client state of a client. This is most commonly used to redirect the client to another resource.		Client altering is a way of altering the request or client state of a client. This is most commonly used to redirect the client to another resource. Each ''action'' may take an ''argument''.

			The following actions are defined:
			{\| class="wikitable"
			! Action !! Argument type !! Description
			\|-
			\| <code>noop</code> \|\| none \|\| Do not alter the client at all. This is the default.
			\|-
			\| <code>rewrite</code> \|\| a valid URL \|\| Reroute the client to a different mount point. This may skip additional authentication or lead to unexpected results. It is recommended to use <code>redirect</code> when possible.
			\|-
			\| <code>redirect</code> \|\| a valid URL \|\| Generic redirect. Redirects the client by sending a (HTTP) redirect. On success the client will come back on the corresponding new mount point. This can also be used to redirect a client to a different server.
			\|-
			\| <code>redirect_see_other</code> \|\| a valid URL \|\| Redirects the client with a "See other" status. Otherwise same as <code>redirect</code>.
			\|-
			\| <code>redirect_temporary</code> \|\| a valid URL \|\| Redirects the client with a temporary redirect status. Otherwise same as <code>redirect</code>.
			\|-
			\| <code>redirect_permanent</code> \|\| a valid URL \|\| Redirects the client with a permanent redirect status. In addition to redirecting the client for this request it asks the client to follow the same redirect again for any future request. Otherwise same as <code>redirect</code>.
			\|-
			\| <code>send_error</code> \|\| a valid and known UUID \|\| Sends the client one of the stock error messages.
			\|}