documentation for external authentication
git-svn-id: https://semanticscuttle.svn.sourceforge.net/svnroot/semanticscuttle/trunk@634 b3834d28-1941-0410-a4f8-b48e95affb8f
This commit is contained in:
cweiske
parent
7f4d678b9b
commit
928ab39333
1 changed files with 175 additions and 0 deletions
175
doc/authentication.txt
Normal file
175
doc/authentication.txt
Normal file
|
|
@ -0,0 +1,175 @@
|
||||||
|
External authentication with SemanticScuttle
|
||||||
|
============================================
|
||||||
|
|
||||||
|
Most times, one piece of software is only a part in the big puzzle
|
||||||
|
that makes the software landscape of a company or organization.
|
||||||
|
SemanticScuttle is not different and should integrate as nicely as
|
||||||
|
possible with all other systems.
|
||||||
|
|
||||||
|
One of the basic tasks of integration is user authentication against
|
||||||
|
a central database - be it a central user database, an LDAP or a
|
||||||
|
active directory server.
|
||||||
|
|
||||||
|
Since version 0.96, SemanticScuttle supports user authentication against
|
||||||
|
external systems. To provide a wide range of supported systems, we chose
|
||||||
|
to utilize PEAR's Authentication package [1].
|
||||||
|
It does this by providing different "authentication containers" [2],
|
||||||
|
for example Database, IMAP, LDAP, POP3, RADIUS, SAP and SOAP.
|
||||||
|
|
||||||
|
Please be aware of the fact that, after successful authentication, the user
|
||||||
|
and his scrambled password are stored in the SemanticScuttle database.
|
||||||
|
This is required for proper functioning of the software. It does not mean
|
||||||
|
that you will be able to login if your external authentication provider
|
||||||
|
is offline - you won't, execpt you switch it off in the SemanticScuttle
|
||||||
|
configuration.
|
||||||
|
|
||||||
|
|
||||||
|
[1] http://pear.php.net/package/Auth
|
||||||
|
[2] http://pear.php.net/manual/en/package.authentication.auth.intro-storage.php
|
||||||
|
|
||||||
|
|
||||||
|
Basic configuration
|
||||||
|
===================
|
||||||
|
The default configuration file data/config.default.php has an own section
|
||||||
|
on auth options and an explanation of the single entries.
|
||||||
|
|
||||||
|
To utilize the external authentication, you need to install the
|
||||||
|
PEAR Auth package:
|
||||||
|
$ pear install auth
|
||||||
|
If you do not have a PEAR installation available, you can try to manually
|
||||||
|
install the files in the src/ directory. If you choose to do that, the
|
||||||
|
src/ directory should look similar to that:
|
||||||
|
|
||||||
|
src/
|
||||||
|
Auth.php
|
||||||
|
Auth/
|
||||||
|
Anonymous.php
|
||||||
|
Container.php
|
||||||
|
Container/
|
||||||
|
..
|
||||||
|
SemanticScuttle/
|
||||||
|
header.php
|
||||||
|
..
|
||||||
|
|
||||||
|
After that, modify your data/config.php file. The most important change
|
||||||
|
is to use
|
||||||
|
$serviceoverrides['User'] = 'SemanticScuttle_Service_AuthUser';
|
||||||
|
which tells SemanticScuttle to switch to the special authentication service.
|
||||||
|
|
||||||
|
Now that's done, you can configure the single auth options:
|
||||||
|
$authType = 'MDB2';
|
||||||
|
selects the authentication container.
|
||||||
|
|
||||||
|
$authOptions
|
||||||
|
is an array of options specific to the authentication container. Please
|
||||||
|
consult the PEAR Auth documentation for more information.
|
||||||
|
|
||||||
|
$authDebug = true;
|
||||||
|
should be used when setup fails, since it may give important hints
|
||||||
|
where it fails. Please note that login will seem to fail with
|
||||||
|
debugging activated. Going back to the main page after that will
|
||||||
|
show that you are logged in.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Authentication examples
|
||||||
|
=======================
|
||||||
|
|
||||||
|
General database authentification
|
||||||
|
---------------------------------
|
||||||
|
Here you also need the PEAR MDB2 package.
|
||||||
|
The "new_link" option is important!
|
||||||
|
|
||||||
|
config.php settings:
|
||||||
|
-8<------------------
|
||||||
|
$serviceoverrides['User'] = 'SemanticScuttle_Service_AuthUser';
|
||||||
|
$authType = 'MDB2';
|
||||||
|
$authOptions = array(
|
||||||
|
'dsn' => array(
|
||||||
|
'phptype' => 'mysql',
|
||||||
|
'hostspec' => 'FIXME',
|
||||||
|
'username' => 'FIXME',
|
||||||
|
'password' => 'FIXME',
|
||||||
|
'database' => 'FIXME',
|
||||||
|
'new_link' => true,
|
||||||
|
),
|
||||||
|
'table' => 'usersFIXME',
|
||||||
|
'usernamecol' => 'usernameFIXME',
|
||||||
|
'passwordcol' => 'passwordFIXME',
|
||||||
|
'cryptType' => 'md5',
|
||||||
|
);
|
||||||
|
-8<------------------
|
||||||
|
|
||||||
|
|
||||||
|
Mantis Bugtracker
|
||||||
|
-----------------
|
||||||
|
Here you also need the PEAR MDB2 package.
|
||||||
|
|
||||||
|
config.php settings:
|
||||||
|
-8<------------------
|
||||||
|
$serviceoverrides['User'] = 'SemanticScuttle_Service_AuthUser';
|
||||||
|
$authType = 'MDB2';
|
||||||
|
$authOptions = array(
|
||||||
|
'dsn' => array(
|
||||||
|
'phptype' => 'mysql',
|
||||||
|
'hostspec' => 'FIXME',
|
||||||
|
'username' => 'FIXME',
|
||||||
|
'password' => 'FIXME',
|
||||||
|
'database' => 'FIXME',
|
||||||
|
'new_link' => true,
|
||||||
|
),
|
||||||
|
'table' => 'mantis_user_table',
|
||||||
|
'usernamecol' => 'username',
|
||||||
|
'passwordcol' => 'password',
|
||||||
|
'cryptType' => 'md5',
|
||||||
|
);
|
||||||
|
-8<------------------
|
||||||
|
|
||||||
|
|
||||||
|
MediaWiki
|
||||||
|
---------
|
||||||
|
Unfortunately, the password column does not contain a simple hashed
|
||||||
|
password - for good reasons as described on
|
||||||
|
http://www.mediawiki.org/wiki/Manual_talk:User_table#user_password_column
|
||||||
|
|
||||||
|
If you configure your mediawiki to use passwords without salt, you
|
||||||
|
can make it work nevertheless:
|
||||||
|
|
||||||
|
MediaWiki LocalSettings.php:
|
||||||
|
$wgPasswordSalt = false;
|
||||||
|
- after that, users need to change/update their passwords to get them
|
||||||
|
unsalted in the database. You can verify if the passwords are unhashed
|
||||||
|
if you do
|
||||||
|
SELECT CAST( user_password AS CHAR ) FROM user
|
||||||
|
on your MediaWiki database. Passwords prefixed with ":A:" can be used.
|
||||||
|
|
||||||
|
Another problem is that mediawiki user names begin with an uppercase letter.
|
||||||
|
You need to modify www/login.php and remove the "utf8_strtolower" function
|
||||||
|
call:
|
||||||
|
$posteduser = trim(utf8_strtolower(POST_USERNAME));
|
||||||
|
becomes
|
||||||
|
$posteduser = trim(POST_USERNAME);
|
||||||
|
|
||||||
|
|
||||||
|
config.php settings:
|
||||||
|
-8<------------------
|
||||||
|
$serviceoverrides['User'] = 'SemanticScuttle_Service_AuthUser';
|
||||||
|
$authType = 'MDB2';
|
||||||
|
$authOptions = array(
|
||||||
|
'dsn' => array(
|
||||||
|
'phptype' => 'mysql',
|
||||||
|
'hostspec' => 'FIXME',
|
||||||
|
'username' => 'FIXME',
|
||||||
|
'password' => 'FIXME',
|
||||||
|
'database' => 'FIXME',
|
||||||
|
'new_link' => true,
|
||||||
|
),
|
||||||
|
'table' => 'user',
|
||||||
|
'usernamecol' => 'user_name',
|
||||||
|
'passwordcol' => 'user_password',
|
||||||
|
'cryptType' => 'md5_mediawiki',
|
||||||
|
);
|
||||||
|
function md5_mediawiki($password) {
|
||||||
|
return ':A:' . md5($password);
|
||||||
|
}
|
||||||
|
-8<------------------
|
||||||
Loading…
Reference in a new issue