ºÝºÝߣ

ºÝºÝߣShare a Scribd company logo
LDAP and the Central
Authorisation Service
Mark Cairney
UNIX Systems
IT Infrastructure
Authentication and Authorisation
? Authentication (AuthN) = ¡°Who are you?¡±
? Authorisation (AuthZ) = ¡°Do you have
permission to access this?¡±
These terms are often (incorrectly) used
interchangeably but there is a difference!
Authorisation- LDAP
? Lightweight Directory Access Protocol
? Standard API for interrogating LDAP directory
services available for most common languages
? University implementations include Central
Auth and Active Directory
LDAP directories
? What is a directory?
¨C Hierarchical ¡°tree¡± structure
¨C ¡°base¡± defines top (or bottom) of the tree
¨C ¡°organisational units¡± (OUs) create tree structure
¨C Objects e.g. users, groups exist within OUs
LDAP directories- objects
? Each Object has a full canonical ¡°distinguished name¡±
(DN)
? Object type defined by it¡¯s Objectclass(es)
? Objectclasses define what attributes an object
can have
¨C Defined in schema
¨C Can be hierarchical e.g. ¡°eduperson¡± is a
dependent on ¡°person¡±
LDAP directories- attributes
? Attributes are the contents of an object
? Can be numerical, string, binary blobs etc
? Single value and multi-value
? An object doesn¡¯t need to have every available
attribute defined
? Can be considered analogous to fields in a
database.
LDAP groups
? Groups are objects containing a list of
members
¨C ¡±members¡± DNs of user objects
¨C We use POSIX groups for UNIX compatibility
? these also have a GID number which should be unique
across groups and users (but this isn¡¯t enforced!)
? Grouper allocates these out the same pool as user¡¯s
UIDs
? Devolved units have their own reserved GID pools
LDAP groups
? OpenLDAP and AD both maintain a
¡°memberOf¡± attribute
¨C This references the group(s) a user object is a
member of
¨C This means we can check if a user is a member of
a group by looking up the user object, not the
group!
LDAP queries
? Simplest query:
? attribute=value
? E.g. edunicategory=201
¨C Search for all objects where the ¡°edunicategory¡±
attribute has the value ¡°201¡± i.e. all UG students.
? Wildcard symbol ¡°*¡±
? Can search for cases where attribute isn¡¯t
defined by not specifying a value
? E.g. (mail=)
LDAP queries- operators
? Boolean operators
¨C & AND
¨C | OR
¨C ! NOT
? Logical sections separated by ( )
? Logical sections can be nested
? Can use these simple rules to build some
highly complex queries!
LDAP queries
? (| (edunicategory=204)(edunicategory=501))
? (&
(edunicategory=101)(!(eduniIDstatus=300)))
LDAP- central auth
? Central Auth- OpenLDAP 2.4
? Allows anonymous bind from within EdLAN
? Some protected attributes only available to
particular accounts
? Uses SASL passthrough to EASE Kerberos for
passwords
? Base DN: dc=authorise,dc=ed,dc=ac,dc=uk
LDAP Applications
? LDAP is also a useful method to pull data
about a user into your Web App
? Still needs to be cosign-protected to provide
REMOTE_USER environment variable
? User information pulled from LDAP can then
be used to perform authorisation e.g. prevent
alumni from accessing site.
? Most common server-side languages will have
an LDAP library (client-side unlikely)
Authorisation-LDAP + Apache
? Apache also has modules for LDAP
AuthN/AuthZ
? LDAP AuthN possible but Cosign
recommended
? Use mod_authnz_ldap module in Apache for
AuthZ in conjunction with mod_cosign for
AuthN
? Can be included in conf files or in .htaccess
files
Central Authorisation Service
https://www.wiki.ed.ac.uk/display/AuthService
Contact IS.Helpline@ed.ac.uk in first instance.
Questions?

More Related Content

What's hot (9)

Java- Nested Classes
Java- Nested ClassesJava- Nested Classes
Java- Nested Classes
Prabhdeep Singh
?
power poitnt of oops
power poitnt of oopspower poitnt of oops
power poitnt of oops
Dhiraj Kumar
?
Index_2
Index_2Index_2
Index_2
Riteshkiit
?
GeekAustin PHP Class - Session 7
GeekAustin PHP Class - Session 7GeekAustin PHP Class - Session 7
GeekAustin PHP Class - Session 7
jimbojsb
?
[OOP - Lec 06] Classes and Objects
[OOP - Lec 06] Classes and Objects[OOP - Lec 06] Classes and Objects
[OOP - Lec 06] Classes and Objects
Muhammad Hammad Waseem
?
[ʥ˼԰][Java SE]Inner class
[ʥ˼԰][Java SE]Inner class[ʥ˼԰][Java SE]Inner class
[ʥ˼԰][Java SE]Inner class
ArBing Xie
?
Introduction to OOP with java
Introduction to OOP with javaIntroduction to OOP with java
Introduction to OOP with java
Sujit Kumar
?
Java Inner Class
Java Inner ClassJava Inner Class
Java Inner Class
DeeptiJava
?
Lec02 primitive types
Lec02   primitive typesLec02   primitive types
Lec02 primitive types
Asif Shahzad
?
GeekAustin PHP Class - Session 7
GeekAustin PHP Class - Session 7GeekAustin PHP Class - Session 7
GeekAustin PHP Class - Session 7
jimbojsb
?
[ʥ˼԰][Java SE]Inner class
[ʥ˼԰][Java SE]Inner class[ʥ˼԰][Java SE]Inner class
[ʥ˼԰][Java SE]Inner class
ArBing Xie
?
Introduction to OOP with java
Introduction to OOP with javaIntroduction to OOP with java
Introduction to OOP with java
Sujit Kumar
?
Lec02 primitive types
Lec02   primitive typesLec02   primitive types
Lec02 primitive types
Asif Shahzad
?

Similar to Itpfldap aug2016 (20)

Lucene intro
Lucene introLucene intro
Lucene intro
Cristian Vat
?
Preliminary committee presentation
Preliminary committee presentationPreliminary committee presentation
Preliminary committee presentation
Richard Drake
?
LDAP - Lightweight Directory Access Protocol
LDAP - Lightweight Directory Access ProtocolLDAP - Lightweight Directory Access Protocol
LDAP - Lightweight Directory Access Protocol
S. Hasnain Raza
?
Full Text Search with Lucene
Full Text Search with LuceneFull Text Search with Lucene
Full Text Search with Lucene
WO Community
?
Helberg acl-final
Helberg acl-finalHelberg acl-final
Helberg acl-final
Clay Helberg
?
Introduction to Solr
Introduction to SolrIntroduction to Solr
Introduction to Solr
Erik Hatcher
?
Chapter-OBDD.pptx
Chapter-OBDD.pptxChapter-OBDD.pptx
Chapter-OBDD.pptx
XanGwaps
?
m211c25.ppt
m211c25.pptm211c25.ppt
m211c25.ppt
HaymanotTadese
?
Wot¡¯s in a name
Wot¡¯s in a nameWot¡¯s in a name
Wot¡¯s in a name
SwiftConsortium
?
Chapter2 bag2
Chapter2 bag2Chapter2 bag2
Chapter2 bag2
teknik komputer ui
?
Android Database
Android DatabaseAndroid Database
Android Database
Dr Karthikeyan Periasamy
?
Jagatjyoti dash
Jagatjyoti dashJagatjyoti dash
Jagatjyoti dash
Jagatjyoti Dash
?
Schema and Identity for Linked Data
Schema and Identity for Linked DataSchema and Identity for Linked Data
Schema and Identity for Linked Data
National Institute of Informatics (NII)
?
Kubernetes Dashboard access using OKTA
Kubernetes Dashboard access using OKTAKubernetes Dashboard access using OKTA
Kubernetes Dashboard access using OKTA
HoseokSeo7
?
Lucene BootCamp
Lucene BootCampLucene BootCamp
Lucene BootCamp
GokulD
?
Roaring with elastic search sangam2018
Roaring with elastic search sangam2018Roaring with elastic search sangam2018
Roaring with elastic search sangam2018
Vinay Kumar
?
Aksum University digital libraries
Aksum University digital librariesAksum University digital libraries
Aksum University digital libraries
Eskinder Asmelash
?
Introduction to oracle database (basic concepts)
Introduction to oracle database (basic concepts)Introduction to oracle database (basic concepts)
Introduction to oracle database (basic concepts)
Bilal Arshad
?
SQLDay2013_Denny Cherry - Table indexing for the .NET Developer
SQLDay2013_Denny Cherry - Table indexing for the .NET DeveloperSQLDay2013_Denny Cherry - Table indexing for the .NET Developer
SQLDay2013_Denny Cherry - Table indexing for the .NET Developer
Polish SQL Server User Group
?
Introduction to oop and java fundamentals
Introduction to oop and java fundamentalsIntroduction to oop and java fundamentals
Introduction to oop and java fundamentals
AnsgarMary
?
Preliminary committee presentation
Preliminary committee presentationPreliminary committee presentation
Preliminary committee presentation
Richard Drake
?
LDAP - Lightweight Directory Access Protocol
LDAP - Lightweight Directory Access ProtocolLDAP - Lightweight Directory Access Protocol
LDAP - Lightweight Directory Access Protocol
S. Hasnain Raza
?
Full Text Search with Lucene
Full Text Search with LuceneFull Text Search with Lucene
Full Text Search with Lucene
WO Community
?
Chapter-OBDD.pptx
Chapter-OBDD.pptxChapter-OBDD.pptx
Chapter-OBDD.pptx
XanGwaps
?
Kubernetes Dashboard access using OKTA
Kubernetes Dashboard access using OKTAKubernetes Dashboard access using OKTA
Kubernetes Dashboard access using OKTA
HoseokSeo7
?
Lucene BootCamp
Lucene BootCampLucene BootCamp
Lucene BootCamp
GokulD
?
Roaring with elastic search sangam2018
Roaring with elastic search sangam2018Roaring with elastic search sangam2018
Roaring with elastic search sangam2018
Vinay Kumar
?
Aksum University digital libraries
Aksum University digital librariesAksum University digital libraries
Aksum University digital libraries
Eskinder Asmelash
?
Introduction to oracle database (basic concepts)
Introduction to oracle database (basic concepts)Introduction to oracle database (basic concepts)
Introduction to oracle database (basic concepts)
Bilal Arshad
?
SQLDay2013_Denny Cherry - Table indexing for the .NET Developer
SQLDay2013_Denny Cherry - Table indexing for the .NET DeveloperSQLDay2013_Denny Cherry - Table indexing for the .NET Developer
SQLDay2013_Denny Cherry - Table indexing for the .NET Developer
Polish SQL Server User Group
?
Introduction to oop and java fundamentals
Introduction to oop and java fundamentalsIntroduction to oop and java fundamentals
Introduction to oop and java fundamentals
AnsgarMary
?

Recently uploaded (20)

Enscape Latest 2025 Crack Free Download
Enscape Latest 2025  Crack Free DownloadEnscape Latest 2025  Crack Free Download
Enscape Latest 2025 Crack Free Download
rnzu5cxw0y
?
Minitool Partition Wizard Crack Free Download
Minitool Partition Wizard Crack Free DownloadMinitool Partition Wizard Crack Free Download
Minitool Partition Wizard Crack Free Download
v3r2eptd2q
?
SketchUp Pro Crack [2025]-Free Download?
SketchUp Pro Crack [2025]-Free Download?SketchUp Pro Crack [2025]-Free Download?
SketchUp Pro Crack [2025]-Free Download?
kiran10101khan
?
salesforce development services - Alt digital
salesforce development services - Alt digitalsalesforce development services - Alt digital
salesforce development services - Alt digital
Alt Digital Technologies
?
20 Excel Shortcuts That Will Instantly Save You Hours.pdf
20 Excel Shortcuts That Will Instantly Save You Hours.pdf20 Excel Shortcuts That Will Instantly Save You Hours.pdf
20 Excel Shortcuts That Will Instantly Save You Hours.pdf
mohammadasim74
?
Build the future with Agentforce and Mulesoft
Build the future with Agentforce and  MulesoftBuild the future with Agentforce and  Mulesoft
Build the future with Agentforce and Mulesoft
GiulioPicchi
?
AnyDesk Pro 3.7.0 Crack License Key Free Download 2025 [Latest]
AnyDesk Pro 3.7.0 Crack License Key Free Download 2025 [Latest]AnyDesk Pro 3.7.0 Crack License Key Free Download 2025 [Latest]
AnyDesk Pro 3.7.0 Crack License Key Free Download 2025 [Latest]
haroonsaeed605
?
Consequences and Principles of Software Quality v1.0
Consequences and Principles of Software Quality v1.0Consequences and Principles of Software Quality v1.0
Consequences and Principles of Software Quality v1.0
Yann-Ga?l Gu¨¦h¨¦neuc
?
SolidWorks 2025 Crack free Download updated
SolidWorks 2025 Crack  free Download updatedSolidWorks 2025 Crack  free Download updated
SolidWorks 2025 Crack free Download updated
sanasabaa73
?
Drawing Heighway¡¯s Dragon - Recursive Function Rewrite - From Imperative Styl...
Drawing Heighway¡¯s Dragon - Recursive Function Rewrite - From Imperative Styl...Drawing Heighway¡¯s Dragon - Recursive Function Rewrite - From Imperative Styl...
Drawing Heighway¡¯s Dragon - Recursive Function Rewrite - From Imperative Styl...
Philip Schwarz
?
Mastering Software Test Automation: A Comprehensive Guide for Beginners and E...
Mastering Software Test Automation: A Comprehensive Guide for Beginners and E...Mastering Software Test Automation: A Comprehensive Guide for Beginners and E...
Mastering Software Test Automation: A Comprehensive Guide for Beginners and E...
Shubham Joshi
?
Rise of the Phoenix: Lesson Learned Build an AI-powered Test Gen Engine
Rise of the Phoenix: Lesson Learned Build an AI-powered Test Gen EngineRise of the Phoenix: Lesson Learned Build an AI-powered Test Gen Engine
Rise of the Phoenix: Lesson Learned Build an AI-powered Test Gen Engine
stevebrudz1
?
Metaverse Meetup: Explore Mulesoft MAC Project
Metaverse Meetup: Explore  Mulesoft MAC ProjectMetaverse Meetup: Explore  Mulesoft MAC Project
Metaverse Meetup: Explore Mulesoft MAC Project
GiulioPicchi
?
AutoDesk Revit Crack | Revit Update 2025 free download
AutoDesk Revit Crack | Revit Update 2025 free downloadAutoDesk Revit Crack | Revit Update 2025 free download
AutoDesk Revit Crack | Revit Update 2025 free download
anamaslam971
?
How John started to like TDD (instead of hating it) - TED talk
How John started to like TDD (instead of hating it) - TED talkHow John started to like TDD (instead of hating it) - TED talk
How John started to like TDD (instead of hating it) - TED talk
Nacho Cougil
?
Carousel - Five Key FinTech Trends for 2025
Carousel - Five Key FinTech Trends for 2025Carousel - Five Key FinTech Trends for 2025
Carousel - Five Key FinTech Trends for 2025
Anadea
?
Code or No-Code Tests: Why Top Teams Choose Both
Code or No-Code Tests: Why Top Teams Choose BothCode or No-Code Tests: Why Top Teams Choose Both
Code or No-Code Tests: Why Top Teams Choose Both
Applitools
?
Elastic Search Engineer Certification - Virtual
Elastic Search Engineer Certification - VirtualElastic Search Engineer Certification - Virtual
Elastic Search Engineer Certification - Virtual
Gon?alo Pereira
?
A Brief Introduction About Raman Bhaumik
A Brief Introduction About Raman BhaumikA Brief Introduction About Raman Bhaumik
A Brief Introduction About Raman Bhaumik
Raman Bhaumik
?
ChatGPT and DeepSeek: Which AI Tool Delivers Better User Experience?
ChatGPT and DeepSeek: Which AI Tool Delivers Better User Experience?ChatGPT and DeepSeek: Which AI Tool Delivers Better User Experience?
ChatGPT and DeepSeek: Which AI Tool Delivers Better User Experience?
Ava Isley
?
Enscape Latest 2025 Crack Free Download
Enscape Latest 2025  Crack Free DownloadEnscape Latest 2025  Crack Free Download
Enscape Latest 2025 Crack Free Download
rnzu5cxw0y
?
Minitool Partition Wizard Crack Free Download
Minitool Partition Wizard Crack Free DownloadMinitool Partition Wizard Crack Free Download
Minitool Partition Wizard Crack Free Download
v3r2eptd2q
?
SketchUp Pro Crack [2025]-Free Download?
SketchUp Pro Crack [2025]-Free Download?SketchUp Pro Crack [2025]-Free Download?
SketchUp Pro Crack [2025]-Free Download?
kiran10101khan
?
salesforce development services - Alt digital
salesforce development services - Alt digitalsalesforce development services - Alt digital
salesforce development services - Alt digital
Alt Digital Technologies
?
20 Excel Shortcuts That Will Instantly Save You Hours.pdf
20 Excel Shortcuts That Will Instantly Save You Hours.pdf20 Excel Shortcuts That Will Instantly Save You Hours.pdf
20 Excel Shortcuts That Will Instantly Save You Hours.pdf
mohammadasim74
?
Build the future with Agentforce and Mulesoft
Build the future with Agentforce and  MulesoftBuild the future with Agentforce and  Mulesoft
Build the future with Agentforce and Mulesoft
GiulioPicchi
?
AnyDesk Pro 3.7.0 Crack License Key Free Download 2025 [Latest]
AnyDesk Pro 3.7.0 Crack License Key Free Download 2025 [Latest]AnyDesk Pro 3.7.0 Crack License Key Free Download 2025 [Latest]
AnyDesk Pro 3.7.0 Crack License Key Free Download 2025 [Latest]
haroonsaeed605
?
Consequences and Principles of Software Quality v1.0
Consequences and Principles of Software Quality v1.0Consequences and Principles of Software Quality v1.0
Consequences and Principles of Software Quality v1.0
Yann-Ga?l Gu¨¦h¨¦neuc
?
SolidWorks 2025 Crack free Download updated
SolidWorks 2025 Crack  free Download updatedSolidWorks 2025 Crack  free Download updated
SolidWorks 2025 Crack free Download updated
sanasabaa73
?
Drawing Heighway¡¯s Dragon - Recursive Function Rewrite - From Imperative Styl...
Drawing Heighway¡¯s Dragon - Recursive Function Rewrite - From Imperative Styl...Drawing Heighway¡¯s Dragon - Recursive Function Rewrite - From Imperative Styl...
Drawing Heighway¡¯s Dragon - Recursive Function Rewrite - From Imperative Styl...
Philip Schwarz
?
Mastering Software Test Automation: A Comprehensive Guide for Beginners and E...
Mastering Software Test Automation: A Comprehensive Guide for Beginners and E...Mastering Software Test Automation: A Comprehensive Guide for Beginners and E...
Mastering Software Test Automation: A Comprehensive Guide for Beginners and E...
Shubham Joshi
?
Rise of the Phoenix: Lesson Learned Build an AI-powered Test Gen Engine
Rise of the Phoenix: Lesson Learned Build an AI-powered Test Gen EngineRise of the Phoenix: Lesson Learned Build an AI-powered Test Gen Engine
Rise of the Phoenix: Lesson Learned Build an AI-powered Test Gen Engine
stevebrudz1
?
Metaverse Meetup: Explore Mulesoft MAC Project
Metaverse Meetup: Explore  Mulesoft MAC ProjectMetaverse Meetup: Explore  Mulesoft MAC Project
Metaverse Meetup: Explore Mulesoft MAC Project
GiulioPicchi
?
AutoDesk Revit Crack | Revit Update 2025 free download
AutoDesk Revit Crack | Revit Update 2025 free downloadAutoDesk Revit Crack | Revit Update 2025 free download
AutoDesk Revit Crack | Revit Update 2025 free download
anamaslam971
?
How John started to like TDD (instead of hating it) - TED talk
How John started to like TDD (instead of hating it) - TED talkHow John started to like TDD (instead of hating it) - TED talk
How John started to like TDD (instead of hating it) - TED talk
Nacho Cougil
?
Carousel - Five Key FinTech Trends for 2025
Carousel - Five Key FinTech Trends for 2025Carousel - Five Key FinTech Trends for 2025
Carousel - Five Key FinTech Trends for 2025
Anadea
?
Code or No-Code Tests: Why Top Teams Choose Both
Code or No-Code Tests: Why Top Teams Choose BothCode or No-Code Tests: Why Top Teams Choose Both
Code or No-Code Tests: Why Top Teams Choose Both
Applitools
?
Elastic Search Engineer Certification - Virtual
Elastic Search Engineer Certification - VirtualElastic Search Engineer Certification - Virtual
Elastic Search Engineer Certification - Virtual
Gon?alo Pereira
?
A Brief Introduction About Raman Bhaumik
A Brief Introduction About Raman BhaumikA Brief Introduction About Raman Bhaumik
A Brief Introduction About Raman Bhaumik
Raman Bhaumik
?
ChatGPT and DeepSeek: Which AI Tool Delivers Better User Experience?
ChatGPT and DeepSeek: Which AI Tool Delivers Better User Experience?ChatGPT and DeepSeek: Which AI Tool Delivers Better User Experience?
ChatGPT and DeepSeek: Which AI Tool Delivers Better User Experience?
Ava Isley
?

Itpfldap aug2016

  • 1. LDAP and the Central Authorisation Service Mark Cairney UNIX Systems IT Infrastructure
  • 2. Authentication and Authorisation ? Authentication (AuthN) = ¡°Who are you?¡± ? Authorisation (AuthZ) = ¡°Do you have permission to access this?¡± These terms are often (incorrectly) used interchangeably but there is a difference!
  • 3. Authorisation- LDAP ? Lightweight Directory Access Protocol ? Standard API for interrogating LDAP directory services available for most common languages ? University implementations include Central Auth and Active Directory
  • 4. LDAP directories ? What is a directory? ¨C Hierarchical ¡°tree¡± structure ¨C ¡°base¡± defines top (or bottom) of the tree ¨C ¡°organisational units¡± (OUs) create tree structure ¨C Objects e.g. users, groups exist within OUs
  • 5. LDAP directories- objects ? Each Object has a full canonical ¡°distinguished name¡± (DN) ? Object type defined by it¡¯s Objectclass(es) ? Objectclasses define what attributes an object can have ¨C Defined in schema ¨C Can be hierarchical e.g. ¡°eduperson¡± is a dependent on ¡°person¡±
  • 6. LDAP directories- attributes ? Attributes are the contents of an object ? Can be numerical, string, binary blobs etc ? Single value and multi-value ? An object doesn¡¯t need to have every available attribute defined ? Can be considered analogous to fields in a database.
  • 7. LDAP groups ? Groups are objects containing a list of members ¨C ¡±members¡± DNs of user objects ¨C We use POSIX groups for UNIX compatibility ? these also have a GID number which should be unique across groups and users (but this isn¡¯t enforced!) ? Grouper allocates these out the same pool as user¡¯s UIDs ? Devolved units have their own reserved GID pools
  • 8. LDAP groups ? OpenLDAP and AD both maintain a ¡°memberOf¡± attribute ¨C This references the group(s) a user object is a member of ¨C This means we can check if a user is a member of a group by looking up the user object, not the group!
  • 9. LDAP queries ? Simplest query: ? attribute=value ? E.g. edunicategory=201 ¨C Search for all objects where the ¡°edunicategory¡± attribute has the value ¡°201¡± i.e. all UG students. ? Wildcard symbol ¡°*¡± ? Can search for cases where attribute isn¡¯t defined by not specifying a value ? E.g. (mail=)
  • 10. LDAP queries- operators ? Boolean operators ¨C & AND ¨C | OR ¨C ! NOT ? Logical sections separated by ( ) ? Logical sections can be nested ? Can use these simple rules to build some highly complex queries!
  • 11. LDAP queries ? (| (edunicategory=204)(edunicategory=501)) ? (& (edunicategory=101)(!(eduniIDstatus=300)))
  • 12. LDAP- central auth ? Central Auth- OpenLDAP 2.4 ? Allows anonymous bind from within EdLAN ? Some protected attributes only available to particular accounts ? Uses SASL passthrough to EASE Kerberos for passwords ? Base DN: dc=authorise,dc=ed,dc=ac,dc=uk
  • 13. LDAP Applications ? LDAP is also a useful method to pull data about a user into your Web App ? Still needs to be cosign-protected to provide REMOTE_USER environment variable ? User information pulled from LDAP can then be used to perform authorisation e.g. prevent alumni from accessing site. ? Most common server-side languages will have an LDAP library (client-side unlikely)
  • 14. Authorisation-LDAP + Apache ? Apache also has modules for LDAP AuthN/AuthZ ? LDAP AuthN possible but Cosign recommended ? Use mod_authnz_ldap module in Apache for AuthZ in conjunction with mod_cosign for AuthN ? Can be included in conf files or in .htaccess files