Table of Contents
AuthRemoteUser Plugin
Compatible with DokuWiki
- 2024-02-06 "Kaos" unknown
- 2023-04-04 "Jack Jackrum" unknown
- 2022-07-31 "Igor" unknown
- 2020-07-29 "Hogfather" yes
Provides single sign-on authentication via an environment variable which is set through authentication systems like HTTP-Auth, LDAP, CAS, Cosign, NTLM, PAM, WebAuth, SSPI, and so on
Similar to authclientcert
Description
This plugin allows integration with the web server's built-in authentication system via an environment variable which is set through
- HTTP-Auth,
- LDAP,
- CAS,
- Cosign,
- NTLM,
- PAM,
- WebAuth,
- SSPI,
- and so on.
Default variable name is REMOTE_USER
.
It uses the default plain text file conf/users.auth.php
to store user information.
Installation
- Enable an authentication system which sets (domain and) username in an environment variable on your webserver (
_SERVER[…]
) (and disable anonymous authentication) on your web server. - Search and install the plugin using the Extension Manager. Refer to Plugin Installation Instructions on how to install plugins manually.
Usage
- Determine the variable name your authentication system uses:
- Default is
REMOTE_USER
. - If your authentication system uses another variable name notice this name.
- Determine your username:
- Open
phpinfo.php
in your web browser and search for the value in_SERVER[…]
whereby…
is the variable name of your authentication system. - Add this value as new user ID to your user list if it is missing and add them groups
admin
anduser
1) - Remove file
phpinfo.php
.
- In your DokuWiki login as superuser, click Admin, choose Configuration Settings, and configure these settings:
- Disable action
profile
. - If enabled, disable option
subscribers
temporarily. - Enable
authtype
AuthRemoteUser. - Disable
rememberme
. - If your authentication system doesn't use variable name
REMOTE_USER
set the name (see also topic 1.2) inserver_var_name_of_auth_system
. - Save this configuration.
- Remove DokuWiki cookie from your browser or close and restart your browser.
- Reload your DokuWiki installation. Your login should be automatically detected.
- Now, you can re-enable option
subscribers
again (see above).
Copy the configuration settings to the conf/local.protected.php
file to protect the settings against changes via Config Manager.
Administration of users and its groups is done in the User Manager which is fully supported by this plugin.
Storage
AuthRemoteUser uses the same storage backend like authplain that is conf/users.auth.php
. Users which are added after switching to AuthRemoteUser, won't contain an encrypted password.
That is: You can switch back to authplain (and enable profile
setting) whenever you want, and all your users which were already added before are still able to login using their (hopefully yet known) password. All other users can use the forget my password link.
File Format
Empty lines, and everything after a #
character are ignored. Each line contains a colon separated array of five fields:
loginname:password:Real Name:email:group
password
:
Encrypted password if user id was added using authplain, otherwise empty.Real Name
:
Real name of the user.email
:
Email address of user.groups
:
Comma separated list of groups a user is member of. The group names must follow the rules of valid pagenames.
Editing
Since conf/users.auth.php
is a plain text file, it can be edited with any text editor.