Digest Authentication adapter for AuthComponent.
Provides Digest HTTP authentication support for AuthComponent. Unlike most AuthComponent adapters, DigestAuthenticate requires a special password hash that conforms to RFC2617. You can create this password using DigestAuthenticate::password()
. If you wish to use digest authentication alongside other authentication methods, its recommended that you store the digest authentication separately.
Clients using Digest Authentication must support cookies. Since AuthComponent identifies users based on Session contents, clients without support for cookies will not function properly.
In your controller's components array, add auth + the required settings.
public $components = array( 'Auth' => array( 'authenticate' => array('Digest') ) );
In your login function just call $this->Auth->login()
without any checks for POST data. This will send the authentication headers, and trigger the login dialog in the browser/client.
Due to the Digest authentication specification, digest auth requires a special password value. You can generate this password using DigestAuthenticate::password()
$digestPass = DigestAuthenticate::password($username, env('SERVER_NAME'), $password);
Its recommended that you store this digest auth only password separate from password hashes used for other login methods. For example User.digest_pass
could be used for a digest password, while User.password
would store the password hash for use with other methods like Basic or Form.
$settings
public array
__construct( ComponentCollection $collection , array $settings )
Constructor, completes configuration for digest authentication.
ComponentCollection
$collection
$settings
BasicAuthenticate::__construct()
_getDigest( )
Gets the digest headers from the request/environment.
generateResponseHash( array $digest , string $password )
Generate the response hash for a given digest array.
$digest
$password
getUser( CakeRequest $request )
Get a user based on information in the request. Used by cookie-less auth for stateless clients.
CakeRequest
$request
BasicAuthenticate::getUser()
loginHeaders( )
Generate the login headers
BasicAuthenticate::loginHeaders()
parseAuthData( string $digest )
Parse the digest authentication headers and split them up.
$digest
password( string $username , string $password , string $realm )
Creates an auth digest password hash to store
$username
$password
$realm
authenticate( CakeRequest $request , CakeResponse $response )
Authenticate a user using HTTP auth. Will use the configured User model and attempt a login using HTTP auth.
CakeRequest
$request
CakeResponse
$response
unauthenticated( CakeRequest $request , CakeResponse $response )
Handles an unauthenticated access attempt by sending appropriate login headers
CakeRequest
$request
CakeResponse
$response
UnauthorizedException
BaseAuthenticate::unauthenticated()
_findUser( string|array $username , string $password null )
Find a user record using the standard options.
The $username parameter can be a (string)username or an array containing conditions for Model::find('first'). If the $password param is not provided the password field will be present in returned array.
Input passwords will be hashed even when a user doesn't exist. This helps mitigate timing attacks that are attempting to find valid usernames.
$username
$password
optional null _password( string $password )
Hash the plain text password so that it matches the hashed/encrypted password in the datasource.
$password
implementedEvents( )
Implemented events
CakeEventListener::implementedEvents()
logout( array $user )
Allows you to hook into AuthComponent::logout(), and implement specialized logout behavior.
All attached authentication objects will have this method called when a user logs out.
$user
passwordHasher( )
Return password hasher object
AbstractPasswordHasher
CakeException
If password hasher class not found or it does not extend AbstractPasswordHasher
public array
Settings for this object.
fields
The fields to use to identify a user by.userModel
The model name of the User, defaults to User.userFields
Array of fields to retrieve from User model, null to retrieve all. Defaults to null.scope
Additional conditions to use when looking up and authenticating users, i.e. array('User.is_active' => 1).
recursive
The value of the recursive key passed to find(). Defaults to 0.contain
Extra models to contain and store in session.realm
The realm authentication is for, Defaults to the servername.nonce
A nonce used for authentication. Defaults to uniqid()
.qop
Defaults to auth, no other values are supported at this time.opaque
A string that must be returned unchanged by clients. Defaults to md5($settings['realm'])
array( 'fields' => array( 'username' => 'username', 'password' => 'password' ), 'userModel' => 'User', 'userFields' => null, 'scope' => array(), 'recursive' => 0, 'contain' => null, 'realm' => '', 'qop' => 'auth', 'nonce' => '', 'opaque' => '', 'passwordHasher' => 'Simple', )
© 2005–2016 The Cake Software Foundation, Inc.
Licensed under the MIT License.
CakePHP is a registered trademark of Cake Software Foundation, Inc.
We are not endorsed by or affiliated with CakePHP.
http://api.cakephp.org/2.8/class-DigestAuthenticate.html