JANUS WEB ALLOW
<section begin="desc" />WEB ALLOW<section end="desc" />
The JANUS WEB ALLOW command indicates that a request from a particular user or set of users can have access to any URL that matches a specified pattern (the url value).
Syntax
<section begin="syntax" /> JANUS WEB portname ALLOW [method] url - [USER user | USGROUP usgroup] - [IPADDR ipaddr | IPGROUP ipgroup] - [[NEWPASSF | NEWPASSF2] fieldname] <section end="syntax" />
JANUS WEB ALLOW command syntax
Portname, method, and url are explained in The JANUS WEB command. The remaining parameters for JANUS WEB ALLOW are described below.
If the JANUS WEB ALLOW command is specified with no optional parameters, it indicates that all users can have access to URLs that match the pattern in url, and that requests for such public URLs are to be run under the explicit or default WEBUSER value from the port definition.
For non-SSL ports, the default ALLOW/DISALLOW rule, which means that all URLs are public, is:
JANUS WEB portname ALLOW *
For SSL ports, the default ALLOW/DISALLOW rules are:
JANUS WEB portname DISALLOW * JANUS WEB portname ALLOW * USER user
where user is the userid of the user that defined the port.
In no case is there a default rule for the PUT method value, which means that a PUT is not allowed unless explicitly permitted with a JANUS WEB ALLOW rule.
- A forward slash (/) followed by a netmask (with no intervening
- A hyphen (-) followed by a number of bits in the subnet mask (with
- If the field is not present, it is considered a logon error,
- If the field is present, it is used as a new password for the user.
| USER user | Indicates that a user is allowed access to url if he or she provides a userid and corresponding password for a userid that matches the pattern in user. For example, if user is HOMER, a user that logs in as HOMER will be allowed access to url. If user is string "SIMP" will be allowed access to url. A user value of asterisk (*) indicates that any valid Model 204 login will allow access to url. This is particularly useful if url is processed by an APSY subsystem, in which case USER * forces a Model 204 login, but it leaves access decisions to APSY. The USER parameter cannot be specified if the USGROUP parameter is specified. It is valid to specify neither USER nor USGROUP. If neither is specified, and a user is allowed access to url on the basis of the rest of the ALLOW rule, the request runs under the WEBUSER userid taken from the port definition (see ). |
|---|---|
| USGROUP usgroup | Indicates that a user will be allowed access to url if he or she provides a userid and corresponding password for a user in the user group identified by usgroup. User groups are defined with the JANUS DEFINEUSGROUP command. .el command. The USGROUP parameter cannot be specified if the USER parameter is specified. It is valid to specify neither USER nor USGROUP. If neither is specified, and a user is allowed access to url on the basis of the rest of the ALLOW rule, the request runs under the WEBUSER userid taken from the port definition (see ). |
| IPADDR ipaddr | Indicates that a user on a machine with an IP address that matches ipaddr is allowed access to url. Ipaddr can be a simple IP address, or it can be a subnet. Subnets are indicated by an IP address followed by either of these: blanks) no intervening blanks) For example, :lit.198.244.244.97:elit. is a simple IP address that must be matched exactly. which is equivalent to :lit.198.242.244.0-24:elit., indicates that any machine on subnet 198.242.244.0 is to be allowed access to url. The IPADDR parameter cannot be specified if the IPGROUP parameter is specified. It is valid to specify neither IPADDR nor IPGROUP. If neither is specified, the rule makes no restrictions on the basis of IP address. If IPADDR and USER or USGROUP is specified, a user must satisfy both the IPADDR criterion and the USER or USGROUP criterion to be allowed access to url. |
| IPGROUP ipgroup | Indicates that a user on a machine with an IP address that is in ipgroup is allowed access to url. IP address groups are defined with the JANUS DEFINEIPGROUP command (). .do end .el command. The IPGROUP parameter cannot be specified if the IPADDR parameter is specified. It is valid to specify neither IPGROUP nor IPADDR. If neither is specified, the rule makes no restrictions on the basis of IP address. If IPGROUP and USER or USGROUP is specified, a user must satisfy both the IPGROUP criterion and the USER or USGROUP criterion to be allowed access to url. |
| NEWPASSF fieldname | NEWPASSF2 fieldname | Indicates that a POST for the specified URL will have its posted form fields scanned for a form field called fieldname: and Janus Web Server returns a standard error page to the browser, or it runs the LOGONERR JANUS WEB rule (described in JANUS WEB Exception rules). If the new password is accepted, Janus Web Server attempts to run the NEWPASSWORD JANUS WEB rule. If no such rule is present, it returns an "Unauthorized", unless the port is defined with a NEWPASSWORDC parameter (), in which case, processing simply continues for the posted URL. NEWPASSF and NEWPASSF2 are useful for providing a password change form to end-users, rather than depending on end-users entering oldpassword&thinsp.:newpassword in a logon pop-up window. The difference between NEWPASSF and NEWPASSF2 is that NEWPASSF2 requires :hp2.two:ehp2. occurrences of fieldname in the POST data with identical values. If both values are not provided or they are not identical, it is considered a logon error. NEWPASSF2 is useful if the users are to be required to enter a new password twice to ensure that a typo doesn't cause the end-user to change his or her password to something unintended (and unknown). If normal JANUS WEB ON rule processing continues for a URL with a NEWPASSF or NEWPASSF2 on the associated JANUS WEB ALLOW rule, the contents of fieldname are not available to the Janus Web Server application. |
References
See: List of Janus commands and List of JANUS WEB subcommands