the random thoughts of a programmer

I’ve been working on switching over a bunch of my Apache web servers to run lighttpd and ran into a small problem with authentication. Lighttpd supports Apache style htpasswd files for authentication, but the catch is that it doesn’t come with any tool to manipulate them like Apache does. They do offer a Perl script on their site that will do basic htpasswd file manipulation but I’m no big fan of Perl and I’m always up for a challenge. So I set forth to write a Python clone of the htpasswd tool.

About half-way through writing my new htpasswd tool I got the bright idea to break out the functionality into a library called apachelib. Since I was striving for a feature-complete htpasswd clone I wanted to be sure to implement every function. Well, that’s fine and easy until I got to the MD5 hashing. Apache takes a, shall we say, “unique” approach to generating its MD5 hashes. Well after some quality time with the APR C code I’ve duplicated Apache’s MD5 hashing routine in Python. Check it out in my subversion repository. I’m still working on the front-end to htpasswd but all the back-end code is in there and complete. Just import apachelib.htpasswd or apachelib.md5.

I’m also considering writing a class wrapper for htpasswd files so that they can be easily manipulated in Python. I’ll probably do that at some time and incorporate it into apachelib. I can imagine how it would be useful to integrate a real user-manager into Trac, since it relies on the web server for authentication and the web server relies on htpasswd files. Anyhow, more on that later when it materializes.