Apache::AuthenSecurID::Auth - Authentication handler for Apache::AuthenSecurID


 # Configuration in httpd.conf  

<Location /path/of/authentication/handler> SetHandler perl-script PerlHandler Apache::AuthenSecurID::Auth

   PerlSetVar AuthCryptKey Encryption_Key
   PerlSetVar AuthCookie Name_of_Authentication_Cookie
   PerlSetVar AuthUserCookie Name_of_Username_Authentication_Cookie
   PerlSetVar AuthCookiePath /path/of/authentication/cookie
   PerlSetVar AuthApacheCookie Apache_Cookie
   PerlSetVar ace_initd_server
   PerlSetVar ace_initd_port 1969


This module allows authentication against a SecurID server. A request is redirected to this handler if the authentication cookie does not exist or is no longer valid. The handler will prompt for username and passcode. It will then construct and encrypt a UDP packet and send it to the Ace request daemon. This is necessary since libsdiclient.a needs to persist for NEXT TOKEN MODE and SET PIN MODE. If the authentication is valid an encrypted Authentication Cookie is set and the request is redirected to the originating URI. If the user needs to enter NEXT TOKEN or set their PIN they will be prompted to do so and if valid the request is then redirected to the originating URI.


  • AuthCryptKey

    The Blowfish key used to encrypt and decrypt the authentication cookie. It defaults to my secret if this variable is not set.

  • AuthCookie

    The name of the of cookie to be set for the authentication token. It defaults to SecurID if this variable is not set.

  • AuthUserCookie

    The name of the of cookie that contains the value of the persons username in plain text. This is checked against the contents of the encrypted cookie to verify user. The cookie is set of other applications can identify authorized users. It defaults to SecurID_User if this variable is not set.

  • AuthCookiePath

    The path of the of cookie to be set for the authentication token. It defaults to / if this variable is not set.

  • AuthApacheCookie

    The name of the mod_usertrack cookie. The mod_usertrack module must be compile and enabled in order to track user sessions. This is set by the CookieName directive in httpd.conf. It defaults to Apache if this variable is not set.

  • ace_initd_server

    The name of the server running the ACE request daemon. This daemon is the actual process that communicates with the ACE Server. If the user is in NEXT TOKEN MODE due to repeated failures or SET PIN MODE the Authen::ACE object must persist beyond the initial request. A request packet is constructed with a random number, type of transaction, username, passcode and session identifier. The request packet is then encrypted using Blowfish and sent to the ACE request daemon. The ACE request daemon decrypts and parses the packet. The request if forwarded to the ACE server and the response is sent back to the handler. The random number originally sent is returned to prevent attacks. It defaults to localhost if this variable is not set.

  • ace_initd_port

    The port the that the Ace request daemon listens on. It defaults to 1969 if this variable is not set.


The module should be loaded upon startup of the Apache daemon. Add the following line to your httpd.conf:

 PerlModule Apache::AuthenSecurID::Auth


For AuthenSecurID::Auth you need to enable the appropriate call-back hook when making mod_perl:

  perl Makefile.PL PERL_AUTHEN=1

AuthenSecurID::Auth requires Crypt::Blowfish and Crypt::CBC.

For AuthenSecurID::Auth to properly track users mod_usertrack must be compiled and enabled.


Apache, mod_perl, Authen::ACE Apache::AuthenSecurID::Auth


  • mod_perl by Doug MacEachern <>

  • Authen::ACE by Dave Carrigan <>

  • Apache::AuthenSecurID by David Berk <>

  • Apache::AuthenSecurID::Auth by David Berk <>


The Apache::AuthenSecurID::Auth module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

4 POD Errors

The following errors were encountered while parsing the POD:

Around line 571:

'=item' outside of any '=over'

Around line 627:

You forgot a '=back' before '=head1'

Around line 653:

'=item' outside of any '=over'

Around line 665:

You forgot a '=back' before '=head1'