Comments on: MediaWiki: HttpAuth Plugin

By: Rainer Seifert

Rainer Seifert — Wed, 18 Jun 2008 22:38:08 +0000

Hi oremj,

your HTTPAuth PLugin looks similar to an extention I’m desparetly looking for.

What I want is:
Poeple log onto our password protected customer site. From there, there is a link to mediawiki. I would like, that those people get auto logined to the wiki site with the same username. No need to press the login button and type in username and password. They have already done it. Actually they didn’t, they got autologined via our desktop software into our customer web site.

Is that possible? And can your code be adjusted to that?

To be honest. I am familiar with PHP. But to adjust your mediawiki extention for my purpose is far too challenging for me. Additionally, I’m willing to pay for your help and support in this subject. Please contact me. You should have my email address.

Thanks a lot in advance.
Greetings
Rainer

By: oremj

oremj — Thu, 29 May 2008 19:08:51 +0000

Thanks for the heads up. You should be able to download it now.

By: Michael

Michael — Thu, 29 May 2008 18:57:49 +0000

Hi Jeremiah,
Looks like PHP functionality was added to http://people.mozilla.com.
HttpAuthPlugin.php no longer can be downloaded, returned page is blank.
Could you rename plugin extension to ‘txt’ or ‘phps’. That should make your script available again.
Looking forward to using it.
Thanks

By: Rod

Rod — Tue, 12 Feb 2008 07:08:54 +0000

What Michael said above I added “return true;” as the last line of authAuthenticate. It looks like, if it falls through that far, it means we have authentication.

By: Michael Blodgett

Michael Blodgett — Mon, 10 Sep 2007 15:23:18 +0000

Hello Jeremiah,
I’m using MediaWiki 1.11.0rc1 on Centos5.0, I had to add a ‘return 0′ at the end of the autoAuthenticate function in your module. I’m using xradius to do the http auth, everything seem to function correctly.

By: anon

anon — Mon, 10 Sep 2007 05:09:37 +0000

Hi,

This plugin will be more flexible, if it also check for REMOTE_USER variable (when PHP_AUTH_USER doesn’t exist), so that it will also work when running php as cgi.

Just a wishlist to improve the plugin capability

By: amg1127

amg1127 — Fri, 10 Aug 2007 18:28:15 +0000

There is a security hole in the extension.

Function autoAuthenticate() should ensure the username loaded from session matches the username that was used for HTTP authentication.

If it doesn’t, a user can get an account that would belong to an other previously authenticated user, because some browsers can clear HTTP authentication data without clearing the cookies.

By: Korbinian Pauli

Korbinian Pauli — Sun, 08 Apr 2007 15:28:30 +0000

Hi Ben,

I had troubles with the plugin in 1.9.3, too. Htaccess logged in fine, but in mediawiki I was not logged in. So I replaced all PHP_AUTH_USER with REMOTE_USER in HttpAuthPlugin.php and LocalSettings.php. Now everthing works fine.

Best regards,
Korbinian

By: Ben Herrick

Ben Herrick — Wed, 28 Feb 2007 08:54:03 +0000

Hi Jeremiah,

I’m having some trouble using your HttpAuthPlugin on the latest version of MediaWiki. I get logged in with no issue, but when I try to edit a page it fails silently on submit.

I’m using MediaWiki 1.9.3. No error messages are logged anywhere that I can find, the page that I’m editing simply doesn’t change.

Any idea what this might be?

Thanks!

-Ben