WebAuth 4.2.0

This is the Apache 2.4 support release. This release will build with either Apache 2.2 or Apache 2.4. The changes for mod_webauth and mod_webkdc were relatively straightforward, but mod_webauthldap required somewhat more work.

The old AuthType StanfordAuth group support in mod_webauthldap, where one could use require group with a privgroup name, will no longer work in Apache 2.4, so this seemed like a good release in which to deprecate StanfordAuth support. This was for backward-compatibility with WebAuth 2.5, which was never released outside of Stanford, so it shouldn't be too widely used. All StanfordAuth support will work in this release when built with Apache 2.2, and everything except the group support in mod_webauthldap will work with Apache 2.4. This support will be removed in a subsequent release.

Benjamin Coddington contributed support for using Kerberos keyring caches for passing delegated credentials to CGI and embedded code.

Merging of mod_webkdc directives have been fixed in some corner cases, and signal handling in WebLogin has been improved in the hope that this will solve some problems with runaway scripts under FastCGI.

Both the Perl API and the libwebauth API have changed considerably. The Perl API is now much more object-oriented, and all the Perl modules have documentation. Many APIs and some modules have been removed, and several new ones have been added. All the libwebauth key and keyring functions are now APR-aware. There are too many changes to list here; see the release notes for all the details.

You can get the latest release from the official WebAuth distribution site or from my WebAuth distribution pages.