Apache HTTP Server Version 2.5

Apache > HTTP Server > Documentation > Version 2.5 > Modules

# Apache Module mod_autht_core

Description: | Core Token Handling
Status: | Base
Module Identifier: | autht_core_module
Source File: | mod_autht_core.c
Compatibility: | Available in Apache 2.5 and later

### Summary

This module provides core token handling capabilities to allow or deny access to portions of the web site. `mod_autht_core` provides directives that are common to all token providers.

### Topics

- Creating Token Provider Aliases

### Directives

### Bugfix checklist

- httpd changelog
- Known issues
- Report a bug

## Creating Token Provider Aliases ¶

Extended token providers can be created within the configuration file and assigned an alias name. The alias providers can then be referenced through the `AuthBearerProvider` directive in the same way as a base token provider. Besides the ability to create and alias an extended provider, it also allows the same extended token provider to be reference by multiple locations.

### Examples

This example checks for JWT token signatures in two different secret files.

### Checking multiple sources for JWT tokens

    # Check here first
    <AuthtProviderAlias jwt jwt1>
        AuthtJwtVerify hs256 file "/www/conf/realm1.secret"
    </AuthtProviderAlias>

    # Then check here
    <AuthtProviderAlias jwt jwt2>
        AuthtJwtVerify hs256 file "/www/conf/realm2.secret"
    </AuthtProviderAlias>

    <Directory "/var/web/pages/secure">
        AuthBearerProvider jwt1 jwt2

        AuthType Basic
        AuthName "Protected Area"
        Require valid-user
    </Directory>

## <AuthtProviderAlias> Directive ¶

Description: | Enclose a group of directives that represent an extension of a base token provider and referenced by the specified alias
Syntax: | `<AuthtProviderAlias baseProvider Alias> ... </AuthtProviderAlias>`
Context: | server config
Status: | Base
Module: | mod_autht_core

`<AuthtProviderAlias>` and `</AuthtProviderAlias>` are used to enclose a group of authentication directives that can be referenced by the alias name using the `AuthBearerProvider`.

This directive has no affect on authentication or authorization, even for modules that provide both authentication and authorization in addition to token handling.