
LoadModule auth_tkt_module modules/mod_auth_tkt.so

# Test secret
TKTAuthSecret "This is my shiny test secret"
TKTAuthSecretOld "This is my older less-shiny test secret"
TKTAuthDigestType "MD5"

# secret_basic - minimal config
<Location /secret_basic>
  AuthType None
  require valid-user
  TKTAuthLoginURL http://localhost/pub/login.cgi
  TKTAuthDebug 2
</Location>

# secret_relative_url - test relative URL expansion
<Location /secret_relative_url>
  AuthType None
  require valid-user
  TKTAuthLoginURL /pub/login.cgi
</Location>

# secret_ignore_ip - ignore ip testing
<Location /secret_ignore_ip>
  AuthType None
  require valid-user
  TKTAuthLoginURL http://localhost/pub/login.cgi
  TKTAuthIgnoreIP on
</Location>

# secret_tokens - token testing
<Location /secret_tokens>
  AuthType None
  require valid-user
  TKTAuthLoginURL http://localhost/pub/login.cgi
  TKTAuthToken finance
  TKTAuthToken admin
</Location>

# secret_guest - guest testing (uses a CGI)
<Location /secret_guest>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
</Location>

# secret_guest_nocookie - guest testing, no cookies (uses a CGI)
<Location /secret_guest_nocookie>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie off
</Location>

# secret_guest_nocookie2 - guest testing, no cookies (uses a CGI)
<Location /secret_guest_nocookie2>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
</Location>

# secret_guest_empty - empty guest testing (uses a CGI)
<Location /secret_guest_empty>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestEmpty on
</Location>

# secret_guest_user - guest user testing (uses a CGI)
<Location /secret_guest_user>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthGuestUser aguestbyanyothername
  TKTAuthCookieExpires 86400
</Location>

# secret_guest_user_uuid1 - simple guest user uuid testing (uses a CGI)
<Location /secret_guest_user_uuid1>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthGuestUser guest-%U
</Location>

# secret_guest_user_uuid2 - guest user size-limited uuid testing (uses a CGI)
<Location /secret_guest_user_uuid2>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthGuestUser guest-12U
  TKTAuthCookieExpires 86400
</Location>

# secret_guest_user_uuid3 - guest user size-limited uuid testing (uses a CGI)
<Location /secret_guest_user_uuid3>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthGuestUser guest-%12U
  TKTAuthCookieExpires 86400
</Location>

# secret_guest_user_uuid4 - guest user size-limited uuid testing (uses a CGI)
<Location /secret_guest_user_uuid4>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthGuestUser guest-%0U
  TKTAuthCookieExpires 86400
</Location>

# secret_guest_user_uuid5 - guest user size-limited uuid testing (uses a CGI)
<Location /secret_guest_user_uuid5>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthGuestUser guest-%1U
  TKTAuthCookieExpires 86400
</Location>

# secret_guest_user_uuid6 - guest user size-limited uuid testing (uses a CGI)
<Location /secret_guest_user_uuid6>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthGuestUser guest-%24U
  TKTAuthCookieExpires 86400
</Location>

# secret_guest_user_uuid7 - guest user size-limited uuid testing (uses a CGI)
<Location /secret_guest_user_uuid7>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthGuestUser guest-%36U
  TKTAuthCookieExpires 86400
</Location>

# secret_guest_user_uuid8 - guest user size-limited uuid testing (uses a CGI)
<Location /secret_guest_user_uuid8>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthGuestUser guest-%50U
  TKTAuthCookieExpires 86400
</Location>

# secret_cookie_expiry1
<Location /secret_cookie_expiry1>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthCookieExpires 86400
</Location>

# secret_cookie_expiry2
<Location /secret_cookie_expiry2>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthCookieExpires 86400s
</Location>

# secret_cookie_expiry3
<Location /secret_cookie_expiry3>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthCookieExpires 120m
</Location>

# secret_cookie_expiry4
<Location /secret_cookie_expiry4>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthCookieExpires 3h
</Location>

# secret_cookie_expiry5
<Location /secret_cookie_expiry5>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthCookieExpires 2d
</Location>

# secret_cookie_expiry6
<Location /secret_cookie_expiry6>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthCookieExpires 3w
</Location>

# secret_cookie_expiry7
<Location /secret_cookie_expiry7>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthCookieExpires 3M
</Location>

# secret_cookie_expiry8
<Location /secret_cookie_expiry8>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthCookieExpires 1y
</Location>

# secret_cookie_expiry9
<Location /secret_cookie_expiry9>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthCookieExpires 2y 1M 3w 4d
</Location>

# secret_cookie_secure1
<Location /secret_cookie_secure1>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthCookieSecure on
</Location>

# secret_cookie_secure2
<Location /secret_cookie_secure2>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  TKTAuthCookieSecure off
</Location>

# secret_noguest - guest exclusion testing (uses a CGI)
<Location /secret_noguest>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthLoginURL http://localhost/pub/login.cgi
  TKTAuthGuestLogin on
  TKTAuthGuestCookie on
  # Allow only tickets with a 'user' token i.e. no guests
  TKTAuthToken user
</Location>

# secret_timeout - timeout testing
<Location /secret_timeout>
  AuthType None
  require valid-user
  TKTAuthLoginURL http://localhost/pub/login.cgi
  TKTAuthTimeoutURL http://localhost/pub/timeout.cgi
  TKTAuthPostTimeoutURL http://localhost/pub/timeout.cgi?post=1
  TKTAuthTimeout 60
  TKTAuthTimeoutRefresh 0
</Location>

# secret_timeout_refresh - timeout refresh testing
<Location /secret_timeout_refresh>
  AuthType None
  require valid-user
  TKTAuthLoginURL http://localhost/pub/login.cgi
  TKTAuthTimeoutURL http://localhost/pub/timeout.cgi
  TKTAuthTimeout 1m
  # with 20s sleeps and a 1 minute, timeout refresh should be > .66
  TKTAuthTimeoutRefresh .75
</Location>

# secret_timeout_guest_fallback - timeout testing with guest fallback on (CGI)
<Location /secret_timeout_guest_fallback>
  AddHandler cgi-script .cgi
  Options +ExecCGI
  AuthType None
  require valid-user
  TKTAuthLoginURL http://localhost/pub/login.cgi
  TKTAuthTimeoutURL http://localhost/pub/timeout.cgi
  TKTAuthPostTimeoutURL http://localhost/pub/timeout.cgi?post=1
  TKTAuthTimeout 60
  TKTAuthTimeoutRefresh 0
  TKTAuthGuestLogin on
  TKTAuthGuestCookie off
  TKTAuthGuestFallback on
</Location>

# secret_back_explicit - explicit TKTAuthBackArgName
<Location /secret_back_explicit>
  AuthType None
  require valid-user
  TKTAuthLoginURL http://localhost/pub/login.cgi
  TKTAuthBackArgName redirect_to
  TKTAuthDebug 2
</Location>

# secret_back_none - null TKTAuthBackArgName
<Location /secret_back_none>
  AuthType None
  require valid-user
  TKTAuthLoginURL http://localhost/pub/login.cgi
  TKTAuthBackArgName None
  TKTAuthDebug 2
</Location>

# virtual host testing - with per-host secret
<VirtualHost VHostLocalSecret>
  DocumentRoot @documentroot@/vhost_local_secret
  TKTAuthSecret "vhostlocalsecret"
  <Location />
    AuthType None
    require valid-user
    TKTAuthLoginURL http://localhost/pub/login.cgi
#   TKTAuthDebug 3
  </Location>
</VirtualHost>

# virtual host testing - with global secret
<VirtualHost VHostGlobalSecret>
  DocumentRoot @documentroot@/vhost_global_secret
  <Location />
    AuthType None
    require valid-user
    TKTAuthLoginURL http://localhost/pub/login.cgi
#   TKTAuthDebug 3
  </Location>
</VirtualHost>

# secret_htaccess - config via .htaccess file
<Directory @documentroot@/secret_htaccess>
  AllowOverride AuthConfig
</Directory>

