New Plugin: Provide HTTP_AUTH Authentication for Piwik - Release in Marketplace

[robocoder]

Plugin that forwards the current HTTP_AUTH’ed user to Piwik

```

• What is HttpAuthLogin plugin ?
  ```

It’s a plug-in that authentifies users based on HTTP_AUTH. HTTP_AUTH is a mechanism provided by the webserver itself (I tested this with Apache). The webserver prompts the user for a login and password, matches it to a database (or a file, you decide), and if the authentication is successful, it lets you access the current logged-in user from PHP.

```

• What use cases is HttpAuthLogin useful ?
  ```

If you have several web services running on the same machine, you can achieve Single Sign-On. For instance, if you run Piwik, a bug tracker, and a WebDAV disk space on the same web server, you could log-in once on the bug tracker, and be automagically logged-in on Piwik.

HTTP_AUTH is extremely widely supported. Even command-line tools like cURL or wget support it. If for some reason you’d like to write a script that fetches stuff out of Piwik, but you’d like it to be authentified, it’d be a lot easier to do with HttpAuthPlugIn.

Contributed by Romain Goyet.

Requires review per [wiki:CodingStandard].

Keywords: third-party-plugin

[robocoder]

New in version 0.2:

• Should conform to coding standard
• Compatible with 0.2.37
• Logout link

Extract into plugins folder and activate via Settings | Plugins menu.

[robocoder]

Note: The AuthName from your .htaccess file is not passed to PHP. If you need to change the realm name, "Piwik" is hard-coded in plugins/HttpAuthLogin/Controller.php.

[robocoder]

Note: token_auth authentication is not available with this plugin

[robocoder]

A sample .htaccess file can be found in: http://forum.piwik.org/index.php?showtopic=4431

[robocoder]

But I tested the updated plugin on the 1.0 branch, and it worked fine there.

[anonymous-matomo-user]

I've just had the time to try the HttpAuthLogin plugin with version 1.0. I logged in as administrator, enabled the plugin and when I reload the page it throws me back to the Piwik login screen. I previously authenticated with the webserver using a different username then administrator, but this username doesn't exist in Piwik. I tried clearing my HTTP auth information and then loading piwik again. I logged in to Apache again but this time Piwik falls into an infinite redirect loop.

Can you give a brief description on how exactly to use this plugin? I use LDAP for authentication in Apache and usernames are user@domain.com. I tried manually creating a user account in Piwik to match my email address, but it wouldn't allow me to use the @ character in the username. Thanks, -Tim

[robocoder]

Tim: this plugin requires that you set up an .htaccess file and password file. In your case, shouldn't you be using #734?

[anonymous-matomo-user]

Replying to vipsoft:

Tim: this plugin requires that you set up an .htaccess file and password file. In your case, shouldn't you be using #734?

For one, I'd prefer to stick with multi-layers of security: Password protect all of Piwik with Apache HTTP authentication (over SSL of course) while still having Piwik user accounts handle access control to the analytics data for each site. But I was hoping this plugin would pass along the credentials from HTTP authentication to Piwik. Isn't this what was intended?

As for using the plugin for LDAP authentication, it seemed more complicated to setup and hasn't been updated in 13 months (maybe that just means it's working as expected). Since I already had Apache HTTP authentication setup using LDAP, I thought it would be easier to use the HTTP_AUTH plugin.

-Tim

[anonymous-matomo-user]

That plugins works fairly well except one big things : the .htaccess breaks the API access with token_auth.

How could it be made so it doesn't break the token_auth ?

[anonymous-matomo-user]

mmm, it seems that, as soon as you enable this plugin (even without any .htaccess file), the token_auth access is broken. (SitesManager.getSitesWithAdminAccess always returns an empty value)

[mattab]

See #1766 for a patch to a possible bug in this plugin.

[robocoder]

Changelog:

• 0.3.2 - Piwik_HttpAuthLogin_Auth now extends Piwik_Login_Auth, and calls parent::authenticate() as a fallback for token_auth access; this is a bit cleaner than the fix in Proposed Patch: HttpAuthLogin plugin support for token_auth API #1766

[anonymous-matomo-user]

Like Tim I also had the redirect loop problem.
I looked into the sources and just added another if else block to make it work on my apache server with mod_sspi authentication.

Auth.php:
...

if(isset($_SERVER['PHP_AUTH_USER']))
{
    $httpLogin = $_SERVER['PHP_AUTH_USER'];
}
else if(isset($_SERVER['HTTP_AUTH_USER']))
{
    $httpLogin = $_SERVER['HTTP_AUTH_USER'];
}
else if(isset($_SERVER['REMOTE_USER']))
{
    $httpLogin = $_SERVER['REMOTE_USER'];
}

...

[robocoder]

Changelog:

• 0.3.3 - added domruf's patch for mod_sspi

[robocoder]

Attachment: v0.3.4
HttpAuthLogin.zip