Class DigestAuthenticate
Digest Authentication adapter for AuthComponent.
Provides Digest HTTP authentication support for AuthComponent. Unlike most AuthComponent adapters,
DigestAuthenticate requires a special password hash that conforms to RFC2617. You can create this
password using DigestAuthenticate::password(). If you wish to use digest authentication alongside other
authentication methods, its recommended that you store the digest authentication separately.
Clients using Digest Authentication must support cookies. Since AuthComponent identifies users based on Session contents, clients without support for cookies will not function properly.
Using Digest auth
In your controller's components array, add auth + the required settings. {{{ public $components = array( 'Auth' => array( 'authenticate' => array('Digest') ) ); }}}
In your login function just call $this->Auth->login() without any checks for POST data. This
will send the authentication headers, and trigger the login dialog in the browser/client.
Generating passwords compatible with Digest authentication.
Due to the Digest authentication specification, digest auth requires a special password value. You
can generate this password using DigestAuthenticate::password()
$digestPass = DigestAuthenticate::password($username, env('SERVER_NAME'), $password);
Its recommended that you store this digest auth only password separate from password hashes used for other
login methods. For example User.digest_pass could be used for a digest password, while User.password would
store the password hash for use with other methods like Basic or Form.
- BaseAuthenticate
-
BasicAuthenticate
-
DigestAuthenticate
Since: 2.0
Copyright: Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
License: MIT License
Location: Cake/Controller/Component/Auth/DigestAuthenticate.php
Properties summary
-
$settingspublicarraySettings for this object.
Inherited Properties
Method Summary
-
__construct() public
Constructor, completes configuration for digest authentication. -
_getDigest() protected
Gets the digest headers from the request/environment. -
generateResponseHash() public
Generate the response hash for a given digest array. -
getUser() public
Get a user based on information in the request. Used by cookie-less auth for stateless clients. -
loginHeaders() public
Generate the login headers -
parseAuthData() public
Parse the digest authentication headers and split them up. -
password() public static
Creates an auth digest password hash to store
Method Detail
__construct() public ¶
__construct( ComponentCollection $collection , array $settings )
Constructor, completes configuration for digest authentication.
Parameters
-
ComponentCollection$collection - The Component collection used on this request.
- array $settings
- An array of settings.
Overrides
_getDigest() protected ¶
_getDigest( )
Gets the digest headers from the request/environment.
Returns
Array of digest information.
generateResponseHash() public ¶
generateResponseHash( array $digest , string $password )
Generate the response hash for a given digest array.
Parameters
- array $digest
- Digest information containing data from DigestAuthenticate::parseAuthData().
- string $password
- The digest hash password generated with DigestAuthenticate::password()
Returns
Response hash
getUser() public ¶
getUser( CakeRequest $request )
Get a user based on information in the request. Used by cookie-less auth for stateless clients.
Parameters
-
CakeRequest$request - Request object.
Returns
Either false or an array of user information
Overrides
loginHeaders() public ¶
loginHeaders( )
Generate the login headers
Returns
Headers for logging in.
Overrides
parseAuthData() public ¶
parseAuthData( string $digest )
Parse the digest authentication headers and split them up.
Parameters
- string $digest
- The raw digest authentication headers.
Returns
An array of digest authentication headers
password() public static ¶
password( string $username , string $password , string $realm )
Creates an auth digest password hash to store
Parameters
- string $username
- The username to use in the digest hash.
- string $password
- The unhashed password to make a digest hash for.
- string $realm
- The realm the password is for.
Returns
the hashed password that can later be used with Digest authentication.
Methods inherited from BasicAuthenticate
authenticate() public ¶
authenticate( CakeRequest $request , CakeResponse $response )
Authenticate a user using HTTP auth. Will use the configured User model and attempt a login using HTTP auth.
Parameters
-
CakeRequest$request - The request to authenticate with.
-
CakeResponse$response - The response to add headers to.
Returns
Either false on failure, or an array of user data on success.
unauthenticated() public ¶
unauthenticated( CakeRequest $request , CakeResponse $response )
Handles an unauthenticated access attempt by sending appropriate login headers
Parameters
-
CakeRequest$request - A request object.
-
CakeResponse$response - A response object.
Throws
Overrides
Methods inherited from BaseAuthenticate
_findUser() protected ¶
_findUser( string|array $username , string $password = null )
Find a user record using the standard options.
The $username parameter can be a (string)username or an array containing conditions for Model::find('first'). If the $password param is not provided the password field will be present in returned array.
Input passwords will be hashed even when a user doesn't exist. This helps mitigate timing attacks that are attempting to find valid usernames.
Parameters
- string|array $username
- The username/identifier, or an array of find conditions.
- string $password optional null
- The password, only used if $username param is string.
Returns
Either false on failure, or an array of user data.
_password() protected deprecated ¶
_password( string $password )
Hash the plain text password so that it matches the hashed/encrypted password in the datasource.
Deprecated
Parameters
- string $password
- The plain text password.
Returns
The hashed form of the password.
logout() public ¶
logout( array $user )
Allows you to hook into AuthComponent::logout(), and implement specialized logout behavior.
All attached authentication objects will have this method called when a user logs out.
Parameters
- array $user
- The user about to be logged out.
Properties detail
$settings ¶
Settings for this object.
fieldsThe fields to use to identify a user by.userModelThe model name of the User, defaults to User.scopeAdditional conditions to use when looking up and authenticating users, i.e.array('User.is_active' => 1).recursiveThe value of the recursive key passed to find(). Defaults to 0.containExtra models to contain and store in session.realmThe realm authentication is for, Defaults to the servername.nonceA nonce used for authentication. Defaults touniqid().qopDefaults to auth, no other values are supported at this time.opaqueA string that must be returned unchanged by clients. Defaults tomd5($settings['realm'])
array( 'fields' => array( 'username' => 'username', 'password' => 'password' ), 'userModel' => 'User', 'scope' => array(), 'recursive' => 0, 'contain' => null, 'realm' => '', 'qop' => 'auth', 'nonce' => '', 'opaque' => '', 'passwordHasher' => 'Simple', )