Using DokuWikis ACL feature with pre-authenticated apache users

JoWiSoftware.de

Thursday, June 24. 2010

Posted by Jochen Wierum in DokuWiki, English, PHP

Comments (0)
Trackbacks (0)

Using DokuWikis ACL feature with pre-authenticated apache users

DokuWiki is a very simple, PHP based wiki. It's strengh is simplicity. It uses txt files for storage and runs on nearly every Webserver which supports PHP, no database needed.

DokuWiki supports Users and ACLs, so it's possible to allow editing only to a special group of people. DokuWiki supports many authentication backends, but the default plugins all assume that the wiki has a "login" button. In my case, the users are already authenticated via htAccess. So I started to search a solution which integrates these users.

In my world, there is something like example.org/private, which contains example.org/private/wiki. The whole private space is protected via htAccess and is used by multiple users with different permissions.

My first approach was to simply disable the ACL feature. However, this solution has some drawbacks: you have no admin interface and all users have the same permissions.

This was not exactly what I want. I found a htAccessAuth Plugin which used a htUsers file as a backend. But I don't have such a file. And I don't need to create or delete users via the wiki anyway. So I simply wrote my own plugin:

  1. # inc/auth/external.class.php
  2. <?php
  3. define('DOKU_AUTH', dirname(__FILE__));
  4. require_once(DOKU_AUTH.'/basic.class.php');
  5.  
  6. class auth_external extends auth_basic {
  7.  
  8.   function auth_external() {
  9.     $this->cando['external'] = true;
  10.   }
  11.  
  12.   function trustExternal($user,$pass,$sticky=false){
  13.     global $USERINFO;
  14.  
  15.     $USERINFO['name'] = $_SERVER['PHP_AUTH_USER'];
  16.     $USERINFO['mail'] = $_SERVER['PHP_AUTH_USER'] . '@' . $_SERVER['HTTP_HOST'];
  17.     $USERINFO['grps'] = array();
  18.     $_SERVER['REMOTE_USER'] = $user;
  19.     return true;
  20.   }
  21.  
  22.   function retrieveUsers($start=0,$limit=-1,$filter=null) {
  23.     return array();
  24.   }
  25.  
  26.   function addGroup($group) {
  27.     return false;
  28.   }
  29.  
  30.   function retrieveGroups($start=0,$limit=0) {
  31.     array();
  32.   }
  33. }
  34. ?>

The class is really simple. It uses the authenticated user as the username, and generates an e-mail address from the username and the hostname. Groups are not supported.

Next, I edited conf/local.php and added these three lines:

  1. $conf['useacl'] = 1;
  2. $conf['authtype'] = 'external';
  3. $conf['superuser'] = 'jochen';

This uses the new authentication and gives me admin rights. Aside from the generic e-mail address, the solution is pretty generic. There is only one thing left: there is still a logout button, which does… well… nothing. I turned the line " <?php tpl_button('login')?>" in lib/tpl/default/main.php into a comment to remove the button.

I'm relly not sure if anyone else can make use of it. If you can, feel free to copy everything you need.


Trackbacks
Trackback specific URI for this entry

No Trackbacks

Comments
Display comments as (Linear | Threaded)

No comments

Add Comment


To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA
 
Submitted comments will be subject to moderation before being displayed.
 

Frontpage - Top level

Quicksearch

Links in diesem Artikel

Static Pages

Links