diff --git a/ChangeLog b/ChangeLog index 60f241471..115d930b7 100755 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,12 @@ phpMyAdmin - ChangeLog $Id$ $Source$ +2006-08-24 Michal Čihař + * Documentation.html, libraries/config.default.php, + libraries/auth/signon.auth.lib.php, scripts/signon.php, + scripts/setup.php: Add single signon authentication method (patch + #1545366, patch #1541379, patch #1531302 and RFE #1031391). + 2006-08-22 Marc Delisle * scripts/setup.php: bug #1536112, better fix (in case of register_globals enabled), thanks to Michal diff --git a/Documentation.html b/Documentation.html index 393322f9a..d46c8a2ad 100755 --- a/Documentation.html +++ b/Documentation.html @@ -667,6 +667,16 @@ GRANT ALL PRIVILEGES ON user_base.* TO 'real_user'@localhost IDENTIFIED BY 'real
  • 'HTTP' authentication (was called 'advanced' in older versions) ($auth_type = 'HTTP') as introduced in 1.3.0 allows you to log in as any valid MySQL user via HTTP-Auth.
    • +
  • 'signon' authentication mode + ($auth_type = 'signon') + as introduced in 2.10.0 allows you to login from prepared PHP + session data. This is useful for implementing single signon + from another application. Sample way how to seed session is in + signon example: scripts/signon.php. You need to + configure session name and signon + URL to use this authentication method. Please see the install section on "Using authentication modes" @@ -1010,6 +1020,15 @@ ALTER TABLE `pma_column_comments` xxx.xxx.xxx.xx[yyy-zzz] (partial IP address range) +
    $cfg['Servers'][$i]['SignonSession'] string
    +
    Name of session which will be used for signon authentication method. +
    +
    $cfg['Servers'][$i]['SignonURL'] string
    +
    URL where user will be redirected for login for signon authentication method. Should be absolute including protocol. +
    +
    $cfg['Servers'][$i]['LogoutURL'] string
    +
    URL where user will be redirected after logout (doesn't affect config authentication method). Should be absolute including protocol. +
    $cfg['ServerDefault'] integer
    If you have more than one server configured, you can set diff --git a/libraries/auth/signon.auth.lib.php b/libraries/auth/signon.auth.lib.php new file mode 100644 index 000000000..b896a84d0 --- /dev/null +++ b/libraries/auth/signon.auth.lib.php @@ -0,0 +1,166 @@ + authentication failed + * + * @return boolean always true (no return indeed) + * + * @access public + */ +function PMA_auth_fails() +{ + $error = PMA_DBI_getError(); + if ($error && $GLOBALS['errno'] != 1045) { + PMA_sendHeaderLocation('error.php?error=' . urlencode($error)); + exit; + } else { + PMA_auth(); + return true; + } + +} // end of the 'PMA_auth_fails()' function + +?> diff --git a/libraries/config.default.php b/libraries/config.default.php index be9cb6ff6..3afba1f1e 100644 --- a/libraries/config.default.php +++ b/libraries/config.default.php @@ -68,10 +68,13 @@ $cfg['Servers'][$i]['controlpass'] = ''; // access to the "mysql/user // The controluser is also // used for all relational // features (pmadb) -$cfg['Servers'][$i]['auth_type'] = 'config'; // Authentication method (config, http or cookie based)? +$cfg['Servers'][$i]['auth_type'] = 'config'; // Authentication method (config, http, signon or cookie based)? $cfg['Servers'][$i]['user'] = 'root'; // MySQL user $cfg['Servers'][$i]['password'] = ''; // MySQL password (only needed // with 'config' auth_type) +$cfg['Servers'][$i]['SignonSession'] = ''; // Session to use for 'signon' auth method +$cfg['Servers'][$i]['SignonURL'] = ''; // URL where to redirect user to login for 'signon' auth method +$cfg['Servers'][$i]['LogoutURL'] = ''; // URL where to redirect user after logout $cfg['Servers'][$i]['nopassword'] = FALSE; // Whether to try to connect without password $cfg['Servers'][$i]['only_db'] = ''; // If set to a db-name, only // this db is displayed in left frame diff --git a/scripts/setup.php b/scripts/setup.php index c5f724e8a..bb07d2e16 100644 --- a/scripts/setup.php +++ b/scripts/setup.php @@ -938,7 +938,7 @@ function show_server_form($defaults = array(), $number = FALSE) { array('Connection type', 'connect_type', 'How to connect to server, keep tcp if unsure', array('tcp', 'socket')), array('PHP extension to use', 'extension', 'What PHP extension to use, use mysqli if supported', array('mysql', 'mysqli')), array('Compress connection', 'compress', 'Whether to compress connection to MySQL server', FALSE), - array('Authentication type', 'auth_type', 'Authentication method to use', array('cookie', 'http', 'config')), + array('Authentication type', 'auth_type', 'Authentication method to use', array('cookie', 'http', 'config', 'signon')), array('User for config auth', 'user', 'Leave empty if not using config auth'), array('Password for config auth', 'password', 'Leave empty if not using config auth', 'password'), array('Only database to show', 'only_db', 'Limit listing of databases in left frame to this one'), @@ -946,6 +946,9 @@ function show_server_form($defaults = array(), $number = FALSE) { array('phpMyAdmin control user', 'controluser', 'User which phpMyAdmin can use for various actions'), array('phpMyAdmin control user password', 'controlpass', 'Password for user which phpMyAdmin can use for various actions', 'password'), array('phpMyAdmin database for advanced features', 'pmadb', 'phpMyAdmin will allow much more when you enable this. Table names are filled in automatically.'), + array('Session name for signon auth', 'SignonSession', 'Leave empty if not using signon auth'), + array('Login URL for signon auth', 'SignonURL', 'Leave empty if not using signon auth'), + array('Logout URL', 'LogoutURL', 'Where to redirect user after logout'), ), 'Configure server', ($number === FALSE) ? 'Enter new server connection parameters.' : 'Editing server ' . get_server_name($defaults, $number), @@ -1276,7 +1279,7 @@ switch ($action) { case 'addserver_real': if (isset($_POST['submit_save'])) { - $new_server = grab_values('host;extension;port;socket;connect_type;compress:bool;controluser;controlpass;auth_type;user;password;only_db;verbose;pmadb;bookmarktable:serialized;relation:serialized;table_info:serialized;table_coords:serialized;pdf_pages:serialized;column_info:serialized;history:serialized;AllowDeny:serialized'); + $new_server = grab_values('host;extension;port;socket;connect_type;compress:bool;controluser;controlpass;auth_type;user;password;only_db;verbose;pmadb;bookmarktable:serialized;relation:serialized;table_info:serialized;table_coords:serialized;pdf_pages:serialized;column_info:serialized;history:serialized;AllowDeny:serialized;SignonSession;SignonURL;LogoutURL'); $err = FALSE; if (empty($new_server['host'])) { message('error', 'Empty hostname!'); @@ -1286,6 +1289,14 @@ switch ($action) { message('error', 'Empty username while using config authentication method!'); $err = TRUE; } + if ($new_server['auth_type'] == 'signon' && empty($new_server['SignonSession'])) { + message('error', 'Empty signon session name while using signon authentication method!'); + $err = TRUE; + } + if ($new_server['auth_type'] == 'signon' && empty($new_server['SignonURL'])) { + message('error', 'Empty signon URL while using signon authentication method!'); + $err = TRUE; + } if ( isset($new_server['pmadb']) && strlen($new_server['pmadb'])) { // Just use defaults, should be okay for most users $pmadb = array(); diff --git a/scripts/signon.php b/scripts/signon.php new file mode 100644 index 000000000..a8cae890c --- /dev/null +++ b/scripts/signon.php @@ -0,0 +1,50 @@ +' . "\n"; +?> + + + + + + phpMyAdmin signle signon example + + +
    +Username:
    +Password:
    + +
    + + +