Thanks for publishing the update! Any insight as to compatibility with WordPress 3.2.x?

Also, you may want to update the WordPress repository listing, so that it has a link to this blog, as well as the entry from March 10, 2005, as that’s the first result that shows up in a Google search.

Thanks for this! I was having an issue where the first time I authenticated, Shibboleth was sending me back to the page I was on without apparently logging me in. But if I clicked on the login link again, I was immediately logged in without having to re-enter my credentials. I figured out that if the Login URI were set to urlencode(wp_login_url($redirect_to)) instead of urlencode($redirect_to), the problem went away, so I wrote a patch which adds this behavior as an option: http://www.elsewhere.org/tmp/http-auth-shib.patch

I have no idea if anyone else is running into this, but if so, that worked for me.

Thanks again!

Hi Daniel.

I’m interest to use this plugin. Just i didn’t find the tutorial to use this plugin. Where i can found it? Thank’s

Hi, is it possible to implement facebook connect and twittewr oauth with this? If so, how exactly?

I managed to get plugin working with Kerberous. If domain users are used, then REMOTE_USER will include DOMAIN\username and username will be broken (in DB will be DOMAINusername, but auth is tried with DOMAIN\username)

Fix:


function check_remote_user() {
$username = '';

foreach (array('REMOTE_USER', 'REDIRECT_REMOTE_USER') as $key) {
if (isset($_SERVER[$key])) {
$username = $_SERVER[$key];
}
if (preg_match('/\\\\([\w]+)/', $username, $matches)) $username = $matches[1];
}


Hi Daniel,

I’m trying to set your awesome plugin up on my site (running on localhost, on snowleopard). I have 3.3.1 of WP and 4.4 of your plugin, but can’t seem to get it to work.

I have a test php page with the same .htaccess settings (even running inside the wordpress directory) and it is working, but when I hit the wp-login.php it just gives me “ERROR: No REMOTE_USER or REDIRECT_REMOTE_USER found” and never pops up the authentication box.

my .htaccess file in the root of my wp install is:

AuthName “WordPress”
AuthType Basic
AuthUserFile /etc/apache2/passwd/passwords
Require user siteadmin

I have a user in wordpress with a nickname ‘siteadmin’ and using that username works fine for with my test (non wp) page.

I have tried Authentication label set as WordPress and as the default HTTP authentication.

I have also tried echoing “apache_getenv(‘REMOTE_USER’)” in the if ! $username and it is coming back blank, but I don’t understand how to set it.

What I am hoping to achieve is login on a seperate php page in another app, but have that user authenticated to wp so that they don’t have to login again – will I be able to do that with this plugin?

Cheers,
Brendan

Hey, thanks for this plugin! I hope to use it to simplify wordpress login through shibboleth. I do, however, have a few questions about it.
I am using a multisite install of wordpress with domain (not path) setup, and each network site has the ‘HTTP Authentication’ page in the settings admin dashboard. Setting authenticator options globally would be preferred (Is this possible?), as I have (hopefully logically) decided to direct users log in to edit their sites using the root multisite url (ex/ example1.com/wp-login.php) rather than logging in at their individual sites (ex/ example2.com/wp-login.php, example3.com/wp-login.php, etc.). I did this to reduce the need to provide login links in site themes or design with the admin-bar at the top of site pages. Because of this, the authenticator settings are the same across all network sites. Problems arise when I set the authenticator options at the root level, create a new network site, then change authenticator options at the root level; the changes are not applied to previously created network sites. While this is definitely preferred in other wordpress setups, for me it means I would have to update all previously created sites if ever I need to change the authenticator plugin options. Individual site admins also have access to these authenticator options for their site in the ‘settings’ menu, and they could really mess things up.
As a self reality check, because way I have decided to do logins and since I have shibboleth-protected (via .htaccess) the “wp-login.php” file and “wp-admin” directory, shouldn’t the HTTP Authenticator login uri option just point to the root wordpress login URI (example1.com/wp-login.php)? Essentially the stock wordpress login should trigger a redirect through our shibboleth authenticator by default, right?

Just making sure my assumptions about and implementation of this plugin are correct :). Sorry if things come off a bit rambling.

Thanks!
-Billy

I’m getting the following error on PHP 5.4.3:

PHP Fatal error: Call-time pass-by-reference has been removed in /usr/local/www/wordpress/wp-content/plugins/http-authentication/http-authentication.php on line 22

If you would like to enable call-time pass-by-reference, you can set allow_call_time_pass_reference to true in your INI file. However, future versions may not support this any longer.

Many thanks for this plugin.
I stand to be corrected, however, whilst the documentation says to set up WordPress users with the Nickname the same as the external username, I found that I could only get the plugin to work if the Nickname and the WordPress Username were the same.
Also, whilst getting to the root of this issue, I noticed that the 4.4 version of the plugin uses a deprecated function: get_userdatabylogin at line 187 of http-authentication.php, which you might wish to correct when you next update the plugin. I haven’t checked for any other deprecated functions.

Very well done plugin, thanks!

One thingy for future: you no more need to include registration.php since it’s deprecated.

Thanks so much for writing this plugin. It’s so easy to use and integrate with my Shibboleth set up.

I did modify the authenticate function so that it would auto-update the wordpress user information with attributes from Shibboleth. I hope it’s useful to someone.


function authenticate($user, $username, $password) {
$user = $this->check_remote_user();

return $user;


I think this is broken as of WordPress 3.5.x Adding a user no longer works; it complains that no password was given.

Great plugin! I have overwritten one pluggable WordPress function to make WP detect the user if he did not visit the login page. Here is my code. It is meant to be public domain. I would love to see you include it (right at the end of http-authentication.php):

if ( !function_exists('wp_get_current_user') ) :
function wp_get_current_user() {
global $current_user;
global $http_authentication_plugin;

return $current_user;
}
endif;

Hello there,

Our Web Authentication System: WAA->WLS communication protocol makes use of a string variable which identifies the RSA key which is used to form a signature supplied with the response.

Recently, the code was rewritten centrally such that this variable restricts the variable to to be 1-8 digits, not beginning with a 0.

Unfortunately by implementing this, when authenticating via the plugin, a “host not available” error is returned after authentication is made. Any pointer?