PHP IDE :: NuSphere Forums :: View topic - Digest Authentication

Posted: Wed Nov 18, 2009 5:25 pm

... I have been searching through the forum for some info regarding digest authentication (server side).

is there any function to have the nusoap server require a digest authentication or I have to managed that with pure php?

I mean, do I need to do something like that?

Code:

$realm = 'Restricted area';
$users = array('*****' => '***', 'guest' => 'guest');

if (empty($_SERVER['PHP_AUTH_DIGEST'])) {
header('HTTP/1.1 401 Unauthorized');
header('WWW-Authenticate: Digest realm="'.$realm.
'",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');

die('Text to send if user hits Cancel button');
}

// analyze the PHP_AUTH_DIGEST variable
if (!($data = http_digest_parse($_SERVER['PHP_AUTH_DIGEST'])) ||
!isset($users[$data['username']]))
die('Wrong Credentials!');

// generate the valid response
$A1 = md5($data['username'] . ':' . $realm . ':' . $users[$data['username']]);
$A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']);
$valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2);

if ($data['response'] != $valid_response)
die('Wrong Credentials!');

or could this thing be managed directly with nusoap_server class?

I tried to use setCredentials but php said me that this method is not part of nusoap_server class.

Is there anywhere a complete client/server examples using digest authentication ??

TIA

Posted: Tue Nov 24, 2009 2:11 pm

You can leave your server side script intact. Just configure your web server to protect the URL or URLs with this authentication. If your server is Apache, try this:
http://httpd.apache.org/docs/2.2/mod/mod_auth_digest.html

Alternatively, yes, you can handle authentication in php, but I see no reason why you'd need this.

Please note that IE and Firefox (IIS and Apache) have some differences in digest authentication. IE will work fine with IIS and Firefox will work fine with Apache, other combinations may fail to work with URLs supplying parameters.