Part of the EllisLab Network
   
1 of 2
1
RSAuth (Really Simple Authentification) Library
Posted: 28 October 2006 10:20 PM   [ Ignore ]  
Summer Student
Total Posts:  11
Joined  10-28-2006

Hi all,

  it is my first post, also is my first contribution to the codeigniter community smile . I found this fantastic framework the last thursday and after to read the documentation finally I made a very useful (for me raspberry) User Authentification library. I have used Auth PEAR Class in my projects, but now I have seen the light raspberry and I learned to use CodeIgniter. Sorry I have tested UserAuth MiniApp but I think that in some project you only need a simple authentification, and you don’t need groups. So based in Auth PEAR Class that it is very very simple to use, I have made some similar.

The Code in Here

The Sample DEMO in Here (username: admin , password: admin)

UPDATE: 11/10/2006
- Comments in all methods compatible with phpdoc
- Minor changes for CodeIgniter 1.5.0.1 with Unix systems (problems with php filenames in sensitive case)
- Password is stored in md5 in the cookie session (in login allways check with database)
- Init file deleted (in CodeIgniter 1.5.0.1 init is automatic)

UPDATE: 11/01/2006
- Rsauth is compatible with CodeIgniter 1.5.0.1 without changes.

UPDATE: revision 0.2 10/30/2006
- Fix adduser and updatepassword in model
- Add userExists in rsauth Library for checking is the user already exists (for not adduser by example).


The readme file:
=================================================
  Rsauth library tested in Codeigniter 1.4.1

  author SeViR CW · http://www.sevir.org/en/
        revision 0.1 10/29/2006
=================================================

Rsauth is a Really Simple Authentification Library. This idea
is based in Auth PEAR Class but, I change some features for
simplify more.

1. INSTALLATION
Decompress rsauth.zip in your codeigniter installation directory.

2. CONFIGURATION
In your config application directory you can find database.php file,
you need configure correctly database config.
Also you can find a rsauth.php config file. This config file only has
four params:

rsauth_table = is the name of the table to store username and password data
rsauth_adminuser = the first user is created with this username automatically
rsauth_adminpassword = the password for this first user
rsauth_dbdriver = typically is the same as database driver (mysql, posgre,...)

3. DEMO
Change your default_controller in config/routes.php for “demorsauth” and test

NOTE: The first time that you use this library, checks if rsauth table exists,
and if it doesn’t exist, it is automatically created with one user configurated
as rsauth_adminuser and rsauth_adminpassword.

4. RSAUTH LIBRARY
$this->load->library(“rsauth”);  //load the library
$loginform = $this->rsauth->login($showloginform);  //Authentification routine,
if $showloginform is TRUE then returns (views/rsauth/rsauthform.php view) if
you don’t login or the login data is incorrect.
$this->rsauth->check();  //check if the user is logged
$this->getUser();  //returns the username logged
$this->rsauth->logout();  //logout

5. RSAUTH_MNG_MODEL MODEL
Is used by RSAUTH library but also it has some useful functions:
$this->load->model(“rsauth_mng_model”);
$this->rsauth_mng_model->adduser($username,$password);  //add one user
$this->rsauth_mng_model->updatepassword($username,$password);  //update password
  for the user
$this->rsauth_mng_model->getlasterror();  //if adduser or updatepassword methods
  faults, this function shows the error

Cheers,
  SeViR CW

Profile
 
 
Posted: 28 October 2006 10:50 PM   [ Ignore ]   [ # 1 ]  
Research Assistant
Avatar
RankRankRank
Total Posts:  424
Joined  04-03-2006
SeViR CW - 28 October 2006 10:20 PM

Sorry I have tested UserAuth MiniApp but I think that in some project you only need a simple authentification, and you don’t need groups.

No need “Sorry” smile I like to quote Rick, from the very start of the authenication threads

Rick Ellis - 21 March 2006 12:47 PM

The biggest issue is that user management means different things to different people.  That said, I wouldn’t be opposed to developing a very basic user authentication/management class.

Your contribution is very welcome in the community.

George

 Signature 

George Dunlop - This-Page.com

Profile
 
 
Posted: 01 November 2006 11:33 AM   [ Ignore ]   [ # 2 ]  
Research Assistant
Avatar
RankRankRank
Total Posts:  421
Joined  05-29-2006

In the new CI 1.5 the origibal code work? Thank you

 Signature 

CI Js_calendar plugin click

WYSIWYG with CI

Profile
 
 
Posted: 01 November 2006 01:57 PM   [ Ignore ]   [ # 3 ]  
Summer Student
Total Posts:  11
Joined  10-28-2006
abmcr - 01 November 2006 11:33 AM

In the new CI 1.5 the origibal code work? Thank you

Let me see, mmm, I just download the new CI 1.5.0.1

I have only changed to FALSE the line in the config.php:
$config[‘sess_use_database’]  = TRUE;
to
$config[‘sess_use_database’]  = FALSE;

I wish some automatic session table creation in the session library init for the different DBMS, so I would have to create manually the session table in the database if $config[‘sess_use_database’] = TRUE. Maybe I will do that this weekend raspberry.

So, RSAuth is compatible with CodeIgniter 1.5.0.1 :D

Profile
 
 
Posted: 07 November 2006 07:08 AM   [ Ignore ]   [ # 4 ]  
Summer Student
Total Posts:  29
Joined  07-20-2006

Many thanks for this truly easy to use lib.

One simple question. How secure is this? Can someone hack the cookie to cheat the application?

Profile
 
 
Posted: 12 November 2006 08:20 AM   [ Ignore ]   [ # 5 ]  
Summer Student
Total Posts:  11
Joined  10-28-2006
cioannou - 07 November 2006 07:08 AM

Many thanks for this truly easy to use lib.

One simple question. How secure is this? Can someone hack the cookie to cheat the application?

Really I made this library fastly raspberry . I upload some modifications (top post for reference). Now username and the password in md5 is stored in the session cookie so the library check in login method if this userdata is set and check with the database (passwords is stored in md5 in the rsauth table so you can not recover the password). If you hack the cookie you need the correct username and password to login correctly.

I have pending add more auth methods (POP server, LDAP, RADIUS, IMAP, SMB,...). Soon I will post the changes smile

Profile
 
 
Posted: 12 November 2006 09:06 AM   [ Ignore ]   [ # 6 ]  
Summer Student
Total Posts:  29
Joined  07-20-2006

Many thanks for your reply, I will download the “latest” version.

I noticed in the cookie a variable IS_LOGGED, that’s why I asked you about security. If someone plays with it, I guess that he can cheat…. :-(

Profile
 
 
Posted: 12 November 2006 10:01 AM   [ Ignore ]   [ # 7 ]  
Summer Student
Total Posts:  11
Joined  10-28-2006
cioannou - 12 November 2006 09:06 AM

I noticed in the cookie a variable IS_LOGGED, that’s why I asked you about security. If someone plays with it, I guess that he can cheat…. :-(

Now IS_LOGGED cookie is not used in the check login routine, it is garbage of the previous versions raspberry

Profile
 
 
Posted: 12 November 2006 12:14 PM   [ Ignore ]   [ # 8 ]  
Summer Student
Total Posts:  29
Joined  07-20-2006

Since I am already using the previous version, should I be aware of any major changes that may render my app unusable?

Profile
 
 
Posted: 12 November 2006 12:51 PM   [ Ignore ]   [ # 9 ]  
Summer Student
Total Posts:  29
Joined  07-20-2006
SeViR CW - 12 November 2006 10:01 AM
cioannou - 12 November 2006 09:06 AM

I noticed in the cookie a variable IS_LOGGED, that’s why I asked you about security. If someone plays with it, I guess that he can cheat…. :-(

Now IS_LOGGED cookie is not used in the check login routine, it is garbage of the previous versions raspberry

Sorry but according to the instructions above:

$this->rsauth->check(); //check if the user is logged

and also according to the controller example:

if ($this->rsauth->check()){
            $loginform
= "Hello ".$this->session->userdata('username');
            
$logoutbt = form_open('demorsauth/logout',array('name'=>'rsauthform','id'=>'rsauthform')).
                        
form_submit('logout','Logout').
                        
"</form>";
        
}


Code from the new library you posted:

/**
         * Checks if user is loginIn
         * @return boolean true or false
         */
        
function check(){
            
return $this->app->session->userdata('islogged');
        
}

Now if I understand this correctly, all a “bad guy” has to do is just hack the ISLOGGED part of the cookie, right?

What I did was to change the check() function to :

$loginform = $this->rsauth->login(TRUE);
        
$logoutbt = "";
        
[b]if ($loginform==''){[/b]
                                         $loginform
= "Hello ".$this->session->userdata('username');
                 
$logoutbt = form_open('demorsauth/logout',array('name'=>'rsauthform','id'=>'rsauthform')).
                        
form_submit('logout','Logout').
                        
"</form>";
        
}

And it seems to work

Thank you for your effort and time

Profile
 
 
Posted: 28 November 2006 07:01 AM   [ Ignore ]   [ # 10 ]  
Research Assistant
RankRankRank
Total Posts:  426
Joined  10-02-2006

Something happened with the 1.5.1 update:

DEBUG - 2006-11-28 12:50:54—> Encrypt Class Initialized

It gets to RSAuth and loads this and then nothing.

 Signature 

CI version?
From SVN.

Profile
 
 
Posted: 29 November 2006 07:48 AM   [ Ignore ]   [ # 11 ]  
Summer Student
Total Posts:  29
Joined  07-20-2006

What do you mean, it works for me in 1.5.1

Profile
 
 
Posted: 29 November 2006 10:48 AM   [ Ignore ]   [ # 12 ]  
Research Assistant
RankRankRank
Total Posts:  426
Joined  10-02-2006

I mean exactly what I say. I reverted back to 1.5.0.1 so I could move forward with the coding, but if it loads OK for others then I’ll try again.

 Signature 

CI version?
From SVN.

Profile
 
 
Posted: 01 December 2006 03:57 AM   [ Ignore ]   [ # 13 ]  
Summer Student
Total Posts:  29
Joined  07-20-2006

Sorry, by 1.5.1 I thought you meant 1.5.0.1, haven’t tried 1.5.1 yet. My mistake.

Profile
 
 
Posted: 06 December 2006 06:48 AM   [ Ignore ]   [ # 14 ]  
Summer Student
Total Posts:  2
Joined  11-28-2006

I’ve just downloaded this class, and it seems really simple to use, and thus a great contribution to CI in my opinion.
However I’ve found something that is worth to mention.

In both Libraries/Rsauth.php on line: 22 AND in Controller/demorsauth.php on line: 9 you’re loading the session class but this could give some difficulties (at least for me).  CI will produce a error message saying that it cannot redeclare the ci_session class System/Libraries/session.php

So it would be a best practice if you just autoload the session class, or just load the class in the controller only.

But again great job done…

Greetsz,

- Jermaine

Profile
 
 
Posted: 07 January 2007 05:53 PM   [ Ignore ]   [ # 15 ]  
Summer Student
Avatar
Total Posts:  27
Joined  11-16-2006

I’m getting the following error after installing. I checked /system/libraries/ and Session.php is there. Any ideas?

An Error Was Encountered

Unable to load the requested class: session

 Signature 

Xuru Internet Marketing

Profile
 
 
   
1 of 2
1
 
Post Marker Legend
New Topic New posts Hot Topic Hot Topic with new posts New Poll New Poll Moved Topic Moved Topic Sticky Topic Sticky topic
Old Topic No new posts Hot Old Topic Hot Topic with no new posts Old Poll Old Poll Closed Topic Closed Topic Announcement Announcements
Theme
Change Theme
Visitor Statistics
The most visitors ever was 819, on March 11, 2010 11:15 AM
Total Registered Members: 120616 Total Logged-in Users: 59
Total Topics: 126649 Total Anonymous Users: 2
Total Replies: 665785 Total Guests: 540
Total Posts: 792434    
Members ( View Memberlist )