Class DigestAuthenticate

Digest Authentication adapter for AuthComponent.

Provides Digest HTTP authentication support for AuthComponent. Unlike most AuthComponent adapters, DigestAuthenticate requires a special password hash that conforms to RFC2617. You can create this password using DigestAuthenticate::password(). If you wish to use digest authentication alongside other authentication methods, its recommended that you store the digest authentication separately.

Clients using Digest Authentication must support cookies. Since AuthComponent identifies users based on Session contents, clients without support for cookies will not function properly.

Using Digest auth

In your controller's components array, add auth + the required settings.

public $components = array(
    'Auth' => array(
        'authenticate' => array('Digest')
    )
);

In your login function just call $this->Auth->login() without any checks for POST data. This will send the authentication headers, and trigger the login dialog in the browser/client.

Generating passwords compatible with Digest authentication.

Due to the Digest authentication specification, digest auth requires a special password value. You can generate this password using DigestAuthenticate::password()

$digestPass = DigestAuthenticate::password($username, env('SERVER_NAME'), $password);

Its recommended that you store this digest auth only password separate from password hashes used for other login methods. For example User.digest_pass could be used for a digest password, while User.password would store the password hash for use with other methods like Basic or Form.

BaseAuthenticate implements CakeEventListener

BasicAuthenticate

DigestAuthenticate

Package: Cake\Controller\Component\Auth
Since: 2.0
Copyright: Copyright (c) Cake Software Foundation, Inc. (https://cakefoundation.org)
License: MIT License
Location: Cake/Controller/Component/Auth/DigestAuthenticate.php

Properties summary

$settings public

array
Settings for this object.

Inherited Properties

_Collection, _passwordHasher

Method Summary

__construct() public
Constructor, completes configuration for digest authentication.
_getDigest() protected
Gets the digest headers from the request/environment.
generateResponseHash() public
Generate the response hash for a given digest array.
getUser() public
Get a user based on information in the request. Used by cookie-less auth for stateless clients.
loginHeaders() public
Generate the login headers
parseAuthData() public
Parse the digest authentication headers and split them up.
password() public static
Creates an auth digest password hash to store

Method Detail

__construct()source public

__construct( ComponentCollection $collection , array $settings )

Constructor, completes configuration for digest authentication.

Parameters

ComponentCollection $collection: The Component collection used on this request.
array $settings: An array of settings.

Overrides

BasicAuthenticate::__construct()

_getDigest()source protected

_getDigest( )

Gets the digest headers from the request/environment.

Returns

array
Array of digest information.

generateResponseHash()source public

generateResponseHash( array $digest , string $password )

Generate the response hash for a given digest array.

Parameters

array $digest: Digest information containing data from DigestAuthenticate::parseAuthData().
string $password: The digest hash password generated with DigestAuthenticate::password()

Returns

string
Response hash

getUser()source public

getUser( CakeRequest $request )

Get a user based on information in the request. Used by cookie-less auth for stateless clients.

Parameters

CakeRequest $request: Request object.

Returns

mixed
Either false or an array of user information

Overrides

BasicAuthenticate::getUser()

loginHeaders()source public

loginHeaders( )

Generate the login headers

Returns

string
Headers for logging in.

Overrides

BasicAuthenticate::loginHeaders()

parseAuthData()source public

parseAuthData( string $digest )

Parse the digest authentication headers and split them up.

Parameters

string $digest: The raw digest authentication headers.

Returns

array|null
An array of digest authentication headers

password()source public static

password( string $username , string $password , string $realm )

Creates an auth digest password hash to store

Parameters

string $username: The username to use in the digest hash.
string $password: The unhashed password to make a digest hash for.
string $realm: The realm the password is for.

Returns

string
the hashed password that can later be used with Digest authentication.

Methods inherited from BasicAuthenticate

authenticate()source public

authenticate( CakeRequest $request , CakeResponse $response )

Authenticate a user using HTTP auth. Will use the configured User model and attempt a login using HTTP auth.

Parameters

CakeRequest $request: The request to authenticate with.
CakeResponse $response: The response to add headers to.

Returns

mixed
Either false on failure, or an array of user data on success.

unauthenticated()source public

unauthenticated( CakeRequest $request , CakeResponse $response )

Handles an unauthenticated access attempt by sending appropriate login headers

Parameters

CakeRequest $request: A request object.
CakeResponse $response: A response object.

Throws

UnauthorizedException

Overrides

BaseAuthenticate::unauthenticated()

Methods inherited from BaseAuthenticate

_findUser()source protected

_findUser( string|array $username , string $password null )

Find a user record using the standard options.

The $username parameter can be a (string)username or an array containing conditions for Model::find('first'). If the $password param is not provided the password field will be present in returned array.

Input passwords will be hashed even when a user doesn't exist. This helps mitigate timing attacks that are attempting to find valid usernames.

Parameters

string|array $username: The username/identifier, or an array of find conditions.
string $password optional null: The password, only used if $username param is string.

Returns

boolean|array
Either false on failure, or an array of user data.

_password()source protected

_password( string $password )

Hash the plain text password so that it matches the hashed/encrypted password in the datasource.

Deprecated

3.0.0 Since 2.4. Use a PasswordHasher class instead.

Parameters

string $password: The plain text password.

Returns

string
The hashed form of the password.

implementedEvents()source public

implementedEvents( )

Implemented events

Returns

array
of events => callbacks.

Implementation of

CakeEventListener::implementedEvents()

logout()source public

logout( array $user )

Allows you to hook into AuthComponent::logout(), and implement specialized logout behavior.

All attached authentication objects will have this method called when a user logs out.

Parameters

array $user: The user about to be logged out.

passwordHasher()source public

passwordHasher( )

Return password hasher object

Returns

AbstractPasswordHasher
Password hasher instance

Throws

CakeException

If password hasher class not found or it does not extend AbstractPasswordHasher

Properties detail

$settingssource

public array

Settings for this object.

fields The fields to use to identify a user by.
userModel The model name of the User, defaults to User.
userFields Array of fields to retrieve from User model, null to retrieve all. Defaults to null.
scope Additional conditions to use when looking up and authenticating users, i.e. array('User.is_active' => 1).
recursive The value of the recursive key passed to find(). Defaults to 0.
contain Extra models to contain and store in session.
realm The realm authentication is for, Defaults to the servername.
nonce A nonce used for authentication. Defaults to uniqid().
qop Defaults to auth, no other values are supported at this time.
opaque A string that must be returned unchanged by clients. Defaults to md5($settings['realm'])

array(
    'fields' => array(
        'username' => 'username',
        'password' => 'password'
    ),
    'userModel' => 'User',
    'userFields' => null,
    'scope' => array(),
    'recursive' => 0,
    'contain' => null,
    'realm' => '',
    'qop' => 'auth',
    'nonce' => '',
    'opaque' => '',
    'passwordHasher' => 'Simple',
)

© 2005–2017 The Cake Software Foundation, Inc.
Licensed under the MIT License.
CakePHP is a registered trademark of Cake Software Foundation, Inc.
We are not endorsed by or affiliated with CakePHP.
https://api.cakephp.org/2.10/class-DigestAuthenticate.html