diff --git a/inc/HTTPAuthSession.php b/inc/HTTPAuthSession.php index c9c66b22..93ce1191 100644 --- a/inc/HTTPAuthSession.php +++ b/inc/HTTPAuthSession.php @@ -95,6 +95,26 @@ class HTTPAuthSession { $_SERVER['PHP_AUTH_PW'] = $pass; } } + else if ( isset($c->authenticate_hook['server_auth_type']) && $c->authenticate_hook['server_auth_type'] == $_SERVER['AUTH_TYPE'] + && isset($_SERVER["REMOTE_USER"]) && !empty($_SERVER["REMOTE_USER"])) { + /** + * The authentication has happened in the server, and we should accept it. + * Perhaps this 'split' is not a good idea though. People may want to use the + * full ID as the username. A further option may be desirable. + * + */ + $_SERVER['PHP_AUTH_USER'] = $_SERVER['REMOTE_USER']; + $_SERVER['PHP_AUTH_PW'] = 'Externally Authenticated'; + if ( ! isset($c->authenticate_hook['call']) ) { + /** + * Since we still need to get the user's details from somewhere. We change the default + * authentication hook to auth_external which simply retrieves a user row from the DB + * and does no password checking. + */ + $c->authenticate_hook['call'] = 'auth_external'; + } + } + /** * Fall through to the normal PHP authentication variables.