o(ther)l/log

This works nicely on the provided web server, first because web management is integrated in the GUI system administration console, but also because Apple developed a few OS X specific modules, to handle Zeroconf discovery, MacBinary support ... and OpenDirectory authentication. The only drawback here is that the default web server is apache 1, and even if Apple does ship an optional Apache 2, it is not supported in the GUI console (no big deal) and does not have apache2 versions of the apple-specific modules (more annoying).

So, how can we enable OpenDirectory authentication on apache 2 or apache 2.2 ? The first solution would be to port the mod_auth_apple authentication module to Apache 2. Which, like most of OS X BSD layer, is opensource and available in Darwin Server source code.

Another solution, maybe less elegant but totally functional is to use PAM authentication. Since 10.2, pam is supported in OS X and bridges authentication to OpenDirectory (and is actually used by some services in the OS, look in /etc/pam.d. Thus the only missing part of the equation is a way to authenticate Apache with PAM. Which is quite easy to find: mod_auth_pam provides pluggable authentication module for Apache 1.3 or 2.0. And works almost out of the box (you just need to fix a pam header from #include <security/pam_appl.h> to #include <pam/pam_appl.h>).

Apache 2.2 changed slightly the authentication and authorization modules, but another project, mod_auth implements several modules for the new architecture, including a mod_authn_pam which works just fine, with the same small header fix.

Porting the mod_auth_apple could be a good exercice though (side note: the ADC has an example of down-to-the-metal OpenDirectory authentication, replacing crypt use )