Overview

There are two sides to managing access to server resources: the outside and the inside. You need to control who (and how many) entities from outside the system can get at what's on the inside in what way. This brings up the issues of user identification, either anonymously (people coming from particular subnets or domains) or identifiably (through some kind of authentication procedure).

Presented with a URL by the client, the server has to map that into a resource name recognizable by the operating system; determine whether there are any access restrictions on that resource; and, if the access is restricted to particular users, authenticate the requester as one of the users. Resource mapping, access control, and authentication are closely enough intertwined that they should be discussed together.

On the inside, there's presentation, so I'll start by discussing how you map URLs to particular resources along with some related path- or URL-oriented commands. File protection and access control are right in the middle and require some understanding of both sides, so I'll discuss that last.