• From: Saskatoon
  • Registered: 2005-05-25
  • Posts: 5

Topic: Apache Authentication

Does anyone know how to authenticate punBB via basic http apache authentication? We have apache user realms that are tied to our LDAP server and it would be very handy to pass the username and password from the server to the punBB users table.

Both Geeklog and phpBB have mods/hacks that allow either Apache, LDAP or Active Directory authentication. These features are very attractive to larger institutions that have existing user database.  As impressive as punBB is as a forum solution, having a separate user/password database is not an option.

  • From: 127.0.0.1
  • Registered: 2001-11-02
  • Posts: 9,167

Re: Apache Authentication

The problem is that you still need to fill the database with users. If you know a little programming yourself, it shouldn't be too difficult to hack check_cookie() in include/functions.php. There you can check if the user is HTTP authenticated and if the user does not exist in the database, create it.

"Programming is like sex: one mistake and you have to support it for the rest of your life."

Rickard's Website

  • From: Saskatoon
  • Registered: 2005-05-25
  • Posts: 5

Re: Apache Authentication

Hey!  Thank you for the suggestion. It proved quite helpful.  I'm not too sure how secure this solution is but it seems to work. Also as you mentioned, users currently have to exist in the punBB database with at least the same username.

Basically after a successful http authentication, the username provided by the server is used to find the user id and password on the punBB database. The ID and password are then used to set the cookie. The interesting thing is that the password stored in the punBB is not used in the authentication process to access the website and can be set to anything.

Inside "include/functions.php"
Just below:

function check_cookie(&$pun_user)
{
    global $db, $pun_config, $cookie_name, $cookie_seed;

    $now = time();
    $expire = $now + 31536000;    // The cookie expires after a year

The following code was added:

//If Apache Authentication is successful then SET cookie
    $username = $_SERVER["REMOTE_USER"];
    $result = $db->query('SELECT username, password, id FROM '.$db->prefix.'users WHERE username=\''.$username.'\'') or error('Goodbye', __FILE__, __LINE__, $db->error());
    $pun_user = $db->fetch_assoc($result);
   
    pun_setcookie($pun_user[id], $pun_user[password], $expire);
    //End Apache Authentication Check