note 38517 deleted from features.http-auth by cmb
| From: | cmb@php.net | Date: | Sun, 06 Oct 2019 08:34:08 +0000 |
| Subject: | note 38517 deleted from features.http-auth by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-212537@lists.php.net to get a copy of this message | ||
Note Submitter: ken_php_net at wolfpackinteractive dot com
----
Say you have password and groups files in standard Apache format (htpasswd etc.), but you want to
apply authorization based on something other than filename, ie something you can't catch in
.htaccess. You want to emulate the server behavior in PHP -- the equivalent of:
AuthType Basic
AuthName "Members"
AuthUserFile /path/to/.htpasswd
AuthGroupFile /path/to/.groups
require group Members
Here's what I came up with:
<?PHP
$AuthUserFile = file("/path/to/.htpasswd");
$AuthGroupFile = file("/path/to/.groups");
$group = "Members";
$realm = "Members";
function authenticate(){
header("WWW-Authenticate: Basic realm=\"$realm\"");
header('HTTP/1.0 401 Unauthorized');
echo "You must enter a valid user name and password to access the requested resource.";
exit;
}
for(; 1; authenticate()){
if (!isset($HTTP_SERVER_VARS['PHP_AUTH_USER']))
continue;
$user = $HTTP_SERVER_VARS['PHP_AUTH_USER'];
if(!preg_grep("/$group: $user$/", $AuthGroupFile)) # (format assumptions)
continue;
if(!($authUserLine = array_shift(preg_grep("/$user:.*$/", $AuthUserFile))))
continue;
preg_match("/$user:((..).*)$/", $authUserLine, $matches);
$authPW = $matches[1];
$salt = $matches[2];
$submittedPW = crypt($HTTP_SERVER_VARS['PHP_AUTH_PW'], $salt);
if($submittedPW != $authPW)
continue;
break;
}
echo "You got in!"
?>