Class DigestAuthenticate
Digest Authentication adapter for AuthComponent.
Provides Digest HTTP authentication support for AuthComponent.
Using Digest auth
In your controller's components array, add auth + the required config
public $components = [
'Auth' => [
'authenticate' => ['Digest']
]
];You should also set AuthComponent::$sessionKey = false; in your AppController's
beforeFilter() to prevent CakePHP from sending a session cookie to the client.
Since HTTP Digest Authentication is stateless you don't need a login() action in your controller. The user credentials will be checked on each request. If valid credentials are not provided, required authentication headers will be sent by this authentication provider which triggers the login dialog in the browser/client.
You may also want to use $this->Auth->unauthorizedRedirect = false;.
This causes AuthComponent to throw a ForbiddenException exception instead of
redirecting to another page.
Generating passwords compatible with Digest authentication.
DigestAuthenticate requires a special password hash that conforms to RFC2617.
You can generate this password using DigestAuthenticate::password()
$digestPass = DigestAuthenticate::password($username, $password, env('SERVER_NAME'));If you wish to use digest authentication alongside other authentication methods,
it's recommended that you store the digest authentication separately. For
example User.digest_pass could be used for a digest password, while
User.password would store the password hash for use with other methods like
Basic or Form.
Property Summary
-
$_config protected
arrayRuntime config
-
$_configInitialized protected
boolWhether the config property has already been configured with defaults
-
$_defaultConfig protected
arrayDefault config for this object.
-
$_needsPasswordRehash protected
boolWhether or not the user authenticated by this class requires their password to be rehashed with another algorithm.
-
$_passwordHasher protected
AbstractPasswordHasherPassword hasher instance.
-
$_registry protected
ComponentRegistryA Component registry, used to get more components.
Method Summary
-
__construct() public
Constructor
-
_configDelete() protected
Delete a single config key
-
_configRead() protected
Read a config variable
-
_configWrite() protected
Write a config variable
-
_findUser() protected
Find a user record using the username and password provided.
-
_getDigest() protected
Gets the digest headers from the request/environment.
-
_query() protected
Get query object for fetching user from database.
-
authenticate() public
Authenticate a user using HTTP auth. Will use the configured User model and attempt a login using HTTP auth.
-
config() public
Usage
-
configShallow() public
Merge provided config with existing config. Unlike
config()which does a recursive merge for nested keys, this method does a simple merge. -
generateResponseHash() public
Generate the response hash for a given digest array.
-
getUser() public
Get a user based on information in the request. Used by cookie-less auth for stateless clients.
-
implementedEvents() public
Returns a list of all events that this authenticate class will listen to.
-
loginHeaders() public
Generate the login headers
-
needsPasswordRehash() public
Returns whether or not the password stored in the repository for the logged in user requires to be rehashed with another algorithm
-
parseAuthData() public
Parse the digest authentication headers and split them up.
-
password() public static
Creates an auth digest password hash to store
-
passwordHasher() public
Return password hasher object
-
unauthenticated() public
Handles an unauthenticated access attempt by sending appropriate login headers
Method Detail
__construct() ¶ public
__construct(Cake\Controller\ComponentRegistry $registry, array $config = [])Constructor
Besides the keys specified in BaseAuthenticate::$_defaultConfig, DigestAuthenticate uses the following extra keys:
realmThe realm authentication is for, Defaults to the servername.nonceA nonce used for authentication. Defaults touniqid().qopDefaults to 'auth', no other values are supported at this time.opaqueA string that must be returned unchanged by clients. Defaults tomd5($config['realm'])
Parameters
-
Cake\Controller\ComponentRegistry$registry The Component registry used on this request.
-
array$config optional Array of config to use.
_configDelete() ¶ protected
_configDelete(string $key): voidDelete a single config key
Parameters
-
string$key Key to delete.
Returns
voidThrows
Cake\Core\Exception\Exceptionif attempting to clobber existing config
_configRead() ¶ protected
_configRead(string|null $key): mixedRead a config variable
Parameters
-
string|null$key Key to read.
Returns
mixed_configWrite() ¶ protected
_configWrite(string|array $key, mixed $value, bool|string $merge = false): voidWrite a config variable
Parameters
-
string|array$key Key to write to.
-
mixed$value Value to write.
-
bool|string$merge optional True to merge recursively, 'shallow' for simple merge, false to overwrite, defaults to false.
Returns
voidThrows
Cake\Core\Exception\Exceptionif attempting to clobber existing config
_findUser() ¶ protected
_findUser(string $username, string|null $password = null): bool|arrayFind a user record using the username and password provided.
Input passwords will be hashed even when a user doesn't exist. This helps mitigate timing attacks that are attempting to find valid usernames.
Parameters
-
string$username The username/identifier.
-
string|null$password optional The password, if not provided password checking is skipped and result of find is returned.
Returns
bool|array_getDigest() ¶ protected
_getDigest(Cake\Network\Request $request): arrayGets the digest headers from the request/environment.
Parameters
-
Cake\Network\Request$request Request object.
Returns
array_query() ¶ protected
_query(string $username): Cake\ORM\QueryGet query object for fetching user from database.
Parameters
-
string$username The username/identifier.
Returns
Cake\ORM\Queryauthenticate() ¶ public
authenticate(Cake\Network\Request $request, Cake\Network\Response $response): mixedAuthenticate a user using HTTP auth. Will use the configured User model and attempt a login using HTTP auth.
Parameters
-
Cake\Network\Request$request The request to authenticate with.
-
Cake\Network\Response$response The response to add headers to.
Returns
mixedconfig() ¶ public
config(string|array|null $key = null, mixed|null $value = null, bool $merge = true): mixedUsage
Reading the whole config:
$this->config();Reading a specific value:
$this->config('key');Reading a nested value:
$this->config('some.nested.key');Setting a specific value:
$this->config('key', $value);Setting a nested value:
$this->config('some.nested.key', $value);Updating multiple config settings at the same time:
$this->config(['one' => 'value', 'another' => 'value']);Parameters
-
string|array|null$key optional The key to get/set, or a complete array of configs.
-
mixed|null$value optional The value to set.
-
bool$merge optional Whether to recursively merge or overwrite existing config, defaults to true.
Returns
mixedThrows
Cake\Core\Exception\ExceptionWhen trying to set a key that is invalid.
configShallow() ¶ public
configShallow(string|array $key, mixed|null $value = null): $thisMerge provided config with existing config. Unlike config() which does
a recursive merge for nested keys, this method does a simple merge.
Setting a specific value:
$this->config('key', $value);Setting a nested value:
$this->config('some.nested.key', $value);Updating multiple config settings at the same time:
$this->config(['one' => 'value', 'another' => 'value']);Parameters
-
string|array$key The key to set, or a complete array of configs.
-
mixed|null$value optional The value to set.
Returns
$thisgenerateResponseHash() ¶ public
generateResponseHash(array $digest, string $password, string $method): stringGenerate the response hash for a given digest array.
Parameters
-
array$digest Digest information containing data from DigestAuthenticate::parseAuthData().
-
string$password The digest hash password generated with DigestAuthenticate::password()
-
string$method Request method
Returns
stringgetUser() ¶ public
getUser(Cake\Network\Request $request): mixedGet a user based on information in the request. Used by cookie-less auth for stateless clients.
Parameters
-
Cake\Network\Request$request Request object.
Returns
mixedimplementedEvents() ¶ public
implementedEvents(): arrayReturns a list of all events that this authenticate class will listen to.
An authenticate class can listen to following events fired by AuthComponent:
-
Auth.afterIdentify- Fired after a user has been identified using one of configured authenticate class. The callback function should have signature likeafterIdentify(Event $event, array $user)when$useris the identified user record. -
Auth.logout- Fired when AuthComponent::logout() is called. The callback function should have signature likelogout(Event $event, array $user)where$useris the user about to be logged out.
Returns
arrayloginHeaders() ¶ public
loginHeaders(Cake\Network\Request $request): stringGenerate the login headers
Parameters
-
Cake\Network\Request$request Request object.
Returns
stringneedsPasswordRehash() ¶ public
needsPasswordRehash(): boolReturns whether or not the password stored in the repository for the logged in user requires to be rehashed with another algorithm
Returns
boolparseAuthData() ¶ public
parseAuthData(string $digest): array|nullParse the digest authentication headers and split them up.
Parameters
-
string$digest The raw digest authentication headers.
Returns
array|nullpassword() ¶ public static
password(string $username, string $password, string $realm): stringCreates an auth digest password hash to store
Parameters
-
string$username The username to use in the digest hash.
-
string$password The unhashed password to make a digest hash for.
-
string$realm The realm the password is for.
Returns
stringpasswordHasher() ¶ public
passwordHasher(): AbstractPasswordHasherReturn password hasher object
Returns
AbstractPasswordHasherThrows
RuntimeExceptionIf password hasher class not found or it does not extend AbstractPasswordHasher
unauthenticated() ¶ public
unauthenticated(Cake\Network\Request $request, Cake\Network\Response $response): voidHandles an unauthenticated access attempt by sending appropriate login headers
- Null - No action taken, AuthComponent should return appropriate response.
- Cake\Network\Response - A response object, which will cause AuthComponent to simply return that response.
Parameters
-
Cake\Network\Request$request A request object.
-
Cake\Network\Response$response A response object.
Returns
voidThrows
Cake\Network\Exception\UnauthorizedExceptionProperty Detail
$_configInitialized ¶ protected
Whether the config property has already been configured with defaults
Type
bool$_defaultConfig ¶ protected
Default config for this object.
fieldsThe fields to use to identify a user by.userModelThe alias for users table, defaults to Users.scopeAdditional conditions to use when looking up and authenticating users, i.e.['Users.is_active' => 1].containExtra models to contain and store in session.passwordHasherPassword hasher class. Can be a string specifying class name or an array containingclassNamekey, any other keys will be passed as config to the class. Defaults to 'Default'.
Type
array$_needsPasswordRehash ¶ protected
Whether or not the user authenticated by this class requires their password to be rehashed with another algorithm.
Type
bool