NAME

SYNOPSIS

 use base qw(CGI::Application);
 use CGI::Application::Plugin::Authentication;

 __PACKAGE__->authen->config(
     DRIVER => [ 'DBI',
         DBH         => $self->dbh,
         TABLE       => 'user',
         CONSTRAINTS => {
             'user.name'         => '__CREDENTIAL_1__',
             'MD5:user.password' => '__CREDENTIAL_2__'
         },
     ],
 );

DESCRIPTION

When describing the database structure, you need to specify some or all of the following parameters: TABLE(S), JOIN_ON, COLUMNS, CONSTRAINTS, ORDER_BY and LIMIT.

     TABLE => 'users',

 - or -

     TABLES => ['users U', 'domains D'],

     JOIN_ON => 'user.domainid = domain.id',

 - or -

     JOIN_ON => 'U.domainid = D.id',

     COLUMNS => { 'crypt:password' => '__CREDENTIAL_2__' },

     CONSTRAINTS => {
         'users.email'          => '__CREDENTIAL_1__',
         'MD5:users.passphrase' => '__CREDENTIAL_2__',
         'users.active'         => 1,
     }

     ORDER_BY => 'created DESC'

     LIMIT => 1

ENCODED PASSWORDS

    CONSTRAINTS => {
        username       => '__CREDENTIAL_1__',
        'MD5:password' => '__CREDENTIAL_2__',
    }

Here the password field is expected to be stored in the database in MD5 format. In order for the MD5 check to work for all databases, the password will be encoded using perl, and then checked against the value in the database. So in effect, the following will be done:

    $username = 'test';
    $password = '123';
    $encoded_password = 'ICy5YqxZB1uWSwcVLSNLcA';
    $sth = $dbh->prepare('SELECT count(*) FROM users WHERE username = ? AND password = ?';
    $sth->execute($username, $encoded_password);
    # I we found a row, then the user credentials are valid and the user is logged in

This is all automatically performed behind the scenes when you specify that a certain field in the database is encoded.

We have to handle this slightly different when working with Unix crypt. In order to crypt a password, you need to provide the crypt function with a 2 character salt value. These are usually just generated randomly, and when the value is crypted, the first two characters of the resulting string will be the 2 salt characters. The problem comes into play when you want to check a password against a crypted password. You need to know the salt in order to properly test the password. But in our case, the crypted password is in the DB. This means we can not generate the crypted test password before we run the query against the database.

So instead we pull the value of the crypted password out of the database, and then perform the tests after the query, instead of before. Here is an example:

    CONSTRAINTS => { 'username'       => '__CREDENTIAL_1__' },
    COLUMNS     => { 'crypt:password' => '__CREDENTIAL_2__' },

And here is what will happen behind the scenes:

    $username = 'test';
    $password = '123';
    $sth = $dbh->prepare('SELECT password FROM users WHERE username = ?';
    $sth->execute($username);
    ($encoded_password) = $sth->fetchrow_array;
    if ($encoded_password eq crypt($password, $encoded_password)) {
        # The credentials are valid and the user is logged in
    }

Again, this is all done automatically behind the scenes, but I've included it here to illustrate how the queries are performed, and how the comparisons are handled. For more information see the section labelled ENCODED PASSWORDS in the CGI::Application::Plugin::Authentication::Driver docs.

EXAMPLE

 # using multiple tables
 #  Here we check three credentials (user, password and domain) across
 #  two separate tables.
 __PACKAGE__->authen->config(
     DRIVER => [ 'DBI',
         # the handle comes from $self->dbh, via the "DBH" plugin. 
         TABLES      => ['user', 'domain'],
         JOIN_ON     => 'user.domainid = domain.id',
         CONSTRAINTS => {
             'user.name'     => '__CREDENTIAL_1__',
             'user.password' => '__CREDENTIAL_2__',
             'domain.name'   => '__CREDENTIAL_3__'
         }
     ],
 );

  - or -

 # using filtered fields
 #  Here the password column contains values that are encoded using unix crypt
 #  and since we need to know the salt in order to encrypt the password
 #  properly, we need to pull out the password, and check it locally
 __PACKAGE__->authen->config(
     DRIVER => [ 'DBI',
         DBH         => $dbh,   # provide your own DBI handle
         TABLE       => 'user',
         CONSTRAINTS => { 'user.name'      => '__CREDENTIAL_1__' }
         COLUMNS     => { 'crypt:password' => '__CREDENTIAL_2__' },
     ],
 );

 - or -

 # extra constraints
 #  Here we only check users where the 'active' column is true
 __PACKAGE__->authen->config(
     DRIVER => [ 'DBI',
         TABLE       => 'user',
         CONSTRAINTS => {
             'user.name'     => '__CREDENTIAL_1__',
             'user.password' => '__CREDENTIAL_2__',
             'user.active'   => 't'
         },
     ],
 );

 - or -

 # all of them combined
 #  Here the user is required to enter a username and password (which is
 #  crypted), and a daily code that changes every day (which is encoded using
 #  an MD5 hash hex format and stored in upper case).
 __PACKAGE__->authen->config(
     DRIVER => [ 'DBI',
         TABLES      => ['user U', 'dailycode D'],
         JOIN_ON     => 'U.userid = D.userid',
         CONSTRAINTS => {
             'U.name'            => '__CREDENTIAL_1__',
             'uc:md5_hex:D.code' => '__CREDENTIAL_3__',
             'D.date'            => 'now'
         },
         COLUMNS     => {
             'crypt:U.password' => '__CREDENTIAL_2__'
         },
     ],
 );

METHODS

SEE ALSO

LICENCE AND COPYRIGHT

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

DISCLAIMER OF WARRANTY

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.