Debug Apache 2.4 PerlAuthenHandler - apache

Question

I am trying to debug a problem that occured after an apache upgrade. I want to integrate redmine into my apache authentification/access control.
Here is my apache config:
<Location "/git/">
AuthType Basic
AuthName "Git Access"
Require valid-user
Order deny,allow
Allow from all
PerlAccessHandler Apache::Authn::Redmine::access_handler
PerlAuthenHandler Apache::Authn::Redmine::authen_handler
...
And this is the access/authen handler:
sub access_handler {
my $r = shift;
unless ($r->some_auth_required) {
$r->log_reason("No authentication has been configured");
return FORBIDDEN;
}
return OK unless request_is_read_only($r);
my $project_id = get_project_identifier($r);
$r->log_error("Setting Auth to OK") if is_public_project($project_id, $r) && anonymous_role_allows_browse_repository($r);
$r->log_error("Content: " . $r->get_handlers("PerlAuthenHandler"));
$r->set_handlers(PerlAuthenHandler => [\&ok_authen_handler])
if is_public_project($project_id, $r) && anonymous_role_allows_browse_repository($r);
return OK
}
sub ok_authen_handler {
my $r = shift;
$r->log_error("ok_authen_handler()...");
my ($res, $redmine_pass) = $r->get_basic_auth_pw();
return OK;
}
sub authen_handler {
my $r = shift;
$r->log_error("authen_handler() ...");
my ($res, $redmine_pass) = $r->get_basic_auth_pw();
return $res unless $res == OK;
if (is_member($r->user, $redmine_pass, $r)) {
$r->log_error("Auth succeeded");
return OK;
} else {
$r->log_error("Auth failed...");
$r->note_auth_failure();
return DECLINED;
}
}
As you can see, the access handler resets the auth handler to some dummy method in case the authentication is not needed. In theory, this allows for selective anonymous access.
In practice, though apache 2.4 yields an error:
AH00027: No authentication done but request not allowed without authentication for $PATH. Authentication not configured?
I already nailed the problem to the hack in the access handler, if I uncomment the set_handlers statement, I can authenticate against redmine. So I guess there is something wrong in this "hack". Unfortunately I am not really a perl guy, so I have no idea how to investigate the issue any further.
Is there any way to figure out what is the important difference between the "hacked" control flow (i.e. setting the auth handler programmatically) and the normal one?

Answer 1

A little bit dirty workaround is to always set the "user" (REMOTE_USER) variable even in anonymous mode, so "Require valid-user" seems happy,
$r->user("");
return Apache2::Const::OK;
We had this problem to implement lazy authentication (Shibboleth style).

Answer 2

I recently upgraded from 2.3 to 2.5.1. Now i get the same strange behavior as long as the project is public. I have some projects, where others need access without registration on the redmine site. So i need a quick solution. But i have also no idea how to solve it. Therefore i created a bug report at the redmine project side:
http://www.redmine.org/issues/16948