Tengo mi DokuWiki en un dominio protegido por el servidor, para entrar los usuarios tienen que autenticarse mediante HTTP digest. He escrito esta extensión al módulo de autenticación htaccess para soportar este tipo de autenticación. Debes tener instalado el módulo de autenticación htaccess, y modificar algunos archivos para que funcione.

1. Sigue las instrucciónes de instalación de la clase htaccess.
2. Instala htdigest.class.php
3. Aplica el parche htdigest.patch
4. htusers.auth.php y acl.auth.php funcionan igual que en htaccess

Crea el archivo htdigest.class.php en el directorio inc/auth/ con este contenido:

<?php
/**
 * htdigest authentication backend
 * @license    GPL 2 (http://www.gnu.org/licenses/gpl.html)
 * @author     Jesús A. Álvarez <zydeco@namedfork.net>
 * Version: 1.0
 * last modified: 2008-04-18 09:22
 *
 * Work based on the htaccess authentication backend:
 * @author     Samuele Tognini <samuele@cli.di.unipi.it>
 *
 * Work based on the plaintext authentication backend:
 * @author     Andreas Gohr <andi@splitbrain.org>
 * @author     Chris Smith <chris@jalakai.co.uk>
 * 
 * and on the .htaccess authentication backed:
 * @author     Marcel Meulemans <marcel_AT_meulemans_DOT_org>
 * Additions:  Sebastian S <Seb.S@web.expr42.net>
 *
 */
 
define('DOKU_AUTH', dirname(__FILE__));
require_once(DOKU_AUTH.'/htaccess.class.php');
 
define('AUTH_USERFILE',DOKU_CONF.'htusers.auth.php');
 
if(isset($_REQUEST['u']))
     $_REQUEST['u'] = cleanID($_REQUEST['u']);
     if(isset($_REQUEST['acl_user']))
     $_REQUEST['acl_user'] = cleanID($_REQUEST['acl_user']);
 
     class auth_htdigest extends auth_htaccess {
 
       var $users = null;
       var $_pattern = array();
 
       /**
	* Constructor
	* 
	* Calls the parent class' constructor, but we can't logoff using digest
	*
	* @author Jesús A. Álvarez <zydeco@namedfork.net>
	*/
       function auth_htdigest() {
	 $this->auth_htaccess();
	 $this->cando['logoff'] = false;
	 $this->cando['userLogout'] = false; // see template.php modification, will hide login/logout button
       }
 
 
       /**
	* Check user+password [required auth function]
	*
	* Checks if the given user exists
	*
	* @author  Jesús A. Álvarez <zydeco@namedfork.net>
	* @return  bool
	*/
       function checkPass($user='',$pass=''){
	 global $conf;
	 if (isset($_SERVER['PHP_AUTH_DIGEST'])) {
	   preg_match('/username="(?P<username>.*)"/U', $_SERVER['PHP_AUTH_DIGEST'], $digest);
	   $userinfo = $this->getUserData($digest['username']);
	   if ($userinfo === false) return false;
	   return true;
	 }else{
	   return false;
	 }
	 return false;
       }
      }
?>

Estas modificaciones permitirán detectar a los usuarios que se han autenticado por http digest, y ocultar el botón login/logout, ya que no he encontrado ninguna manera fiable de hacer logout con http digest.

diff -aur inc.orig/auth.php inc/auth.php
--- inc.orig/auth.php	2008-04-18 09:16:46.000000000 +0000
+++ inc/auth.php	2008-04-17 22:37:01.000000000 +0000
@@ -60,9 +60,18 @@
       if (!isset($_REQUEST['r'])) $_REQUEST['r'] = '';
 
       // if no credentials were given try to use HTTP auth (for SSO)
-      if(empty($_REQUEST['u']) && empty($_COOKIE[DOKU_COOKIE]) && !empty($_SERVER['PHP_AUTH_USER'])){
-        $_REQUEST['u'] = $_SERVER['PHP_AUTH_USER'];
-        $_REQUEST['p'] = $_SERVER['PHP_AUTH_PW'];
+      if(empty($_REQUEST['u']) && empty($_COOKIE[DOKU_COOKIE])){
+        if (!empty($_SERVER['PHP_AUTH_USER']))
+        {
+          $_REQUEST['u'] = $_SERVER['PHP_AUTH_USER'];
+          $_REQUEST['p'] = $_SERVER['PHP_AUTH_PW'];
+        }
+        elseif (!empty($_SERVER['PHP_AUTH_DIGEST']))
+        {
+          preg_match('/username="(?P<username>.*)"/U', $_SERVER['PHP_AUTH_DIGEST'], $digest);
+          $_REQUEST['u'] = $digest['username'];
+          $_REQUEST['p'] = md5($digest['username']); // FIXME why do we need this?
+        }
       }
 
       // external trust mechanism in place?
diff -aur inc.orig/template.php inc/template.php
--- inc.orig/template.php	2008-04-18 09:16:46.000000000 +0000
+++ inc/template.php	2008-04-18 09:08:36.000000000 +0000
@@ -495,7 +495,7 @@
       print html_topbtn();
       return true;
     case 'login':
-      if($conf['useacl'] && $auth){
+      if($conf['useacl'] && $auth && $auth->cando['userLogout'] !== false){
         if($_SERVER['REMOTE_USER']){
           print html_btn('logout',$ID,'',array('do' => 'logout', 'sectok' => getSecurityToken()));
         }else{

Debes añadir esto a tu archivo conf/local.php:

$conf['authtype']       = 'htdigest';
 
if (!isset($_SESSION[$conf['title']]['auth']['info']) && (isset($_SERVER["PHP_AUTH_DIGEST"])))
{   // analyze the PHP_AUTH_DIGEST variable
    preg_match('/username="(?P<username>.*)"/U', $_SERVER['PHP_AUTH_DIGEST'], $digest);
    $_REQUEST['u'] = $digest['username'];
    $_REQUEST['p'] = md5($digest['username']); // FIXME why do we need this?
}

Los mismos que htaccess, excepto htaccess_realm, htaccess_logout y htaccess_unauthurl.

• No hay forma de cerrar la sesión