i just remembered i meant to test this by calling dbman from an shtml page. i'll try this and post a reply later.
ok i don't really know how to try this other than a link to the db.cgi from the shtml page. but what do i put for username or userid? when i enable debugging, it doesn't show remote_user. i guess that's because my db.cgi is in cgi-bin directory instead of the protected www/database directory.
maybe it will be easier to ask how to do what i'm trying to do:
i want one login for my site. once user logs in, i want dbman to know who they are and look up permissions in the pass file -- i don't mind maintaining htpasswd list with same usernames as dbman password file. i will have regular web pages as well as database info. i don't want anyone to see these pages unless they are logged in via htaccess. once they've logged in, dbman should not display the login screen but should show their permissions properly. is this possible?