Authentication verifies a client's identity. Authorization determines what an authenticated client may access or change. The Barracuda App Server (BAS) connects both controls to the Virtual File System (VFS), so one policy can protect a directory, its resources, and its child directories.
BAS decouples authentication logic from individual web pages by associating an authenticator with a VFS directory node. The authenticator acts as a security umbrella: requests for that directory and its child resources must pass the configured authentication check.
When a user is authenticated using one of the built-in BAS authenticators, the system automatically creates a session object. This session keeps track of the authenticated user and is maintained either through a session HTTP cookie or a session ID embedded in the URL. To strengthen security, both methods lock the session to the client's IP address, which helps prevent session hijacking. However, if your use case does not require session tracking or if you need more flexibility, such as allowing roaming IP addresses, you can create your own authentication mechanism. By implementing a custom directory function, you can enforce your own access control while still providing the same security umbrella as the built-in system. Any files or APIs inside the protected directory, including its subdirectories, will then be secured by your custom logic.
BAS supports standard Basic, Digest, and form-based authentication, as well as custom authentication such as bearer tokens. The server also provides straightforward integration with user/password databases.
| Method | Use and security boundary |
|---|---|
| Basic | Sends a Base64 encoding of the username and password. Use it only over TLS. |
| Digest | Uses an HTTP challenge-response exchange so the password is not sent directly. Digest does not encrypt the request or response and should still be used over TLS. BAS supports the RFC 2617 form of Digest authentication. |
| Form | Lets the application provide its own login and error pages and manage logout through the application session. Submit credentials only over TLS. |
| Default | Offers Basic, Digest, and form authentication so the client can select a supported method. |
| WebDAV | Supports Basic and Digest authentication plus compatibility handling for Microsoft WebDAV clients. Use TLS to protect credentials and file content. |
| Custom, SSO, RADIUS, and WebAuthn | Custom directory functions can validate bearer tokens or integrate an external identity provider. Properly configured WebAuthn uses origin-bound public-key credentials and is resistant to credential phishing. |
Basic, Digest, and form authentication identify a client in different ways, but none replaces TLS. TLS protects credentials, session cookies, request data, and response data while they cross the network.
In BAS, the VFS allows for the hierarchical organization of resources, with each directory node capable of having its own authenticator. This structure enables the implementation of distinct security realms within the application. For instance, a directory node handling sensitive data can be assigned a strict authenticator, while another node may permit public access.
By leveraging the VFS, you can define specific authentication and authorization policies for different sections of your application, ensuring that users have appropriate access based on their credentials and roles.
Beyond authentication, BAS provides mechanisms for user authorization, determining whether an authenticated user has permission to access or perform actions on specific resources. This is typically managed through the implementation of an authorizer, which evaluates user permissions based on factors such as URL paths and HTTP methods.
Implementing role-based access control (RBAC) allows for more granular authorization, where users are assigned roles that define their permissions within the application. This approach enhances security by ensuring users can only access resources and perform actions pertinent to their roles.
A login tracker can be associated with an authenticator as an optional security enhancement. A login tracker keeps track of failed and successful logins and their IP addresses.
A login tracker helps limit dictionary and brute-force attacks. It keeps a configurable-size RAM database of login attempts and their source IP addresses. The application can temporarily ban a user or source after too many failed attempts. This reduces automated guessing but does not replace strong credentials, TLS, or monitoring.
A login tracker can be associated with an authenticator created by Lua code, but the actual login tracker code must be initialized by the C/C++ startup code. A C/C++ developer can either create a customized login tracker by using the provided login tracker APIs, or use the default login tracker. The default login tracker adds Lua bindings for fetching login tracker information.
| Example | What it demonstrates |
|---|---|
| Authentication examples | Basic, Digest, and form authentication; login and logout; sessions; and protected application areas. |
| JSON File Server | Authentication plus Access Control List (ACL) authorization applied to a Web File Server object. Compare it with the Secure Photo Album C example. |
| Dynamic Navigation Menu | Server-generated navigation plus a seeded hash-based form exchange. Deploy it with TLS to protect the session and application traffic. |
| Light Dashboard | A device-management interface with protected routes and a user database based on ba.tpm.jsonuser(). Review the softTPM assumptions before deployment. |
| Microsoft Entra SSO | Delegating login to an external identity provider. Production deployment requires customer-owned identity configuration and validation of the documented security properties. |
| WebAuthn | Registration, authentication, and session handling with origin-bound public-key credentials. See the WebAuthn introduction. |
| RADIUS | Delegating credential validation to an external RADIUS server. |
| OAuth 2.0 example | Obtaining user authorization and using an access token to call the GitHub API. This example is an authorization-client flow, not a general BAS login system. |
The BAS Authentication and Authorization Skill collects design patterns for VFS protection, user databases, authenticators, authorizers, login tracking, WebDAV, Web File Server, single sign-on, and WebAuthn. It can be used as a checklist by developers or supplied to an AI assistant.