Apache Authentication...

[Nubis]

Hi all,

I've been searching the web for hours without beeing able to find something really usefull.

I saw many urls linked to a few threads here so I decided to register and ask for help here.

I am running apache 1.3.27 on a Windows 2000 Advanced Server system.

MyYSQL 4.0.14 nt is installed and running as well as php 4.3.2.

I'm a bit new with user authentication and learned a lot these last weeks about it with apache.

I can now easily manage it with .htaccess and .htpsswd.

But I would like to make it a bit different now...

I'd like apache to use mod_auth_mysql for user autentication.
I've tried several modules I could get from the web, but none of them was able to work as expected.

I've read many articles too, and almost all them were saying that I need to recompile apache, or the module or both...

So, as I don't know how to do it or even where to start, it would be well appreciated if someone could help me out with this.

My second wish, is a bit complicated...

I would like apache, since user is authenticaded, to send both variables (login and password) to a specific php script, with a format like the following:

file.php?username=johndoe&password=1963

Is this possible?
and if yes, how?
I saw a system working like this used by my hosting service.

In fact, my hoster uses something like that to mysql management.
Users authenticate with login/pass with apache, and then, that same user and pass are sent to phpmyadmin, which will only show specified user's databases and rights.

I would like to do exactly the same thing on my side.

So, if someone has a tip or any other thing that migh help me out, please feel free.

Many thanks for your help.

Nubis

[tsinka]

Hi,

you can do that without using mod_auth_???? directly with php. PHP should be installed as module not as CGI.

A little example taken from the PHP manual:

<?php
  if (!isset($_SERVER['PHP_AUTH_USER'])) {
    header('WWW-Authenticate: Basic realm="My Realm"');
    header('HTTP/1.0 401 Unauthorized');
    echo 'access denied';
    exit;
  } else {
    echo "<p>Hello {$_SERVER['PHP_AUTH_USER']}.</p>";
    echo "<p>You entered {$_SERVER['PHP_AUTH_PW']} as your password.</p>";
  }
?>

In the else statement you can then use mysql_functions to authenticate the user against MySQL data.
If username and password match a record in the database you can redirect to any page you want by e.g.

header("Location: http://myserver.com/file.php?username=".$_SERVER['PHP_AUTH_USER']."&password=".$_SERVER['PHP_AUTH_PW']);

I'd suggest to use something like md5 encryption on the password since it it a security flaw to use plaintext passwords as GET parameter.

Another way could be to use sessions and to store the login data in the session.

Or you can just redirect to file.php?userid=$id and use that value on subsequent pages.

I couldn't test the above code but it should work this way. At least a starting point 🙂

Thomas

[Nubis]

Hi again,

Thanks a lot for your great help Thomas.

I've just read your post, and will test it now.

I'll let you know if it really works or not.

Yes, I use php as module.

Just another question, I won't need anymore mod_auth as well as mod_auth_mysql right? (I mean if I perform my authentications the way you said)

Thanks again

Nubis