4 * HTTP Digest Authentication handler
6 * Use this class for easy http digest authentication.
10 * 2. Call the setRealm() method with the realm you plan to use
11 * 3. Call the init method function.
12 * 4. Call the getUserName() function. This function may return false if no
13 * authentication information was supplied. Based on the username you
14 * should check your internal database for either the associated password,
15 * or the so-called A1 hash of the digest.
16 * 5. Call either validatePassword() or validateA1(). This will return true
18 * 6. To make sure an authentication prompt is displayed, call the
19 * requireLogin() method.
24 * @copyright Copyright (C) 2007-2012 Rooftop Solutions. All rights reserved.
25 * @author Evert Pot (http://www.rooftopsolutions.nl/)
26 * @license http://code.google.com/p/sabredav/wiki/License Modified BSD License
28 class Sabre_HTTP_DigestAuth extends Sabre_HTTP_AbstractAuth {
31 * These constants are used in setQOP();
34 const QOP_AUTHINT = 2;
38 protected $digestParts;
40 protected $qop = self::QOP_AUTH;
43 * Initializes the object
45 public function __construct() {
47 $this->nonce = uniqid();
48 $this->opaque = md5($this->realm);
49 parent::__construct();
54 * Gathers all information from the headers
56 * This method needs to be called prior to anything else.
60 public function init() {
62 $digest = $this->getDigest();
63 $this->digestParts = $this->parseDigest($digest);
68 * Sets the quality of protection value.
70 * Possible values are:
71 * Sabre_HTTP_DigestAuth::QOP_AUTH
72 * Sabre_HTTP_DigestAuth::QOP_AUTHINT
74 * Multiple values can be specified using logical OR.
76 * QOP_AUTHINT ensures integrity of the request body, but this is not
77 * supported by most HTTP clients. QOP_AUTHINT also requires the entire
78 * request body to be md5'ed, which can put strains on CPU and memory.
83 public function setQOP($qop) {
92 * The A1 parameter should be md5($username . ':' . $realm . ':' . $password);
97 public function validateA1($A1) {
100 return $this->validate();
105 * Validates authentication through a password. The actual password must be provided here.
106 * It is strongly recommended not store the password in plain-text and use validateA1 instead.
108 * @param string $password
111 public function validatePassword($password) {
113 $this->A1 = md5($this->digestParts['username'] . ':' . $this->realm . ':' . $password);
114 return $this->validate();
119 * Returns the username for the request
123 public function getUsername() {
125 return $this->digestParts['username'];
130 * Validates the digest challenge
134 protected function validate() {
136 $A2 = $this->httpRequest->getMethod() . ':' . $this->digestParts['uri'];
138 if ($this->digestParts['qop']=='auth-int') {
139 // Making sure we support this qop value
140 if (!($this->qop & self::QOP_AUTHINT)) return false;
141 // We need to add an md5 of the entire request body to the A2 part of the hash
142 $body = $this->httpRequest->getBody(true);
143 $this->httpRequest->setBody($body,true);
144 $A2 .= ':' . md5($body);
147 // We need to make sure we support this qop value
148 if (!($this->qop & self::QOP_AUTH)) return false;
153 $validResponse = md5("{$this->A1}:{$this->digestParts['nonce']}:{$this->digestParts['nc']}:{$this->digestParts['cnonce']}:{$this->digestParts['qop']}:{$A2}");
155 return $this->digestParts['response']==$validResponse;
161 * Returns an HTTP 401 header, forcing login
163 * This should be called when username and password are incorrect, or not supplied at all
167 public function requireLogin() {
171 case self::QOP_AUTH : $qop = 'auth'; break;
172 case self::QOP_AUTHINT : $qop = 'auth-int'; break;
173 case self::QOP_AUTH | self::QOP_AUTHINT : $qop = 'auth,auth-int'; break;
176 $this->httpResponse->setHeader('WWW-Authenticate','Digest realm="' . $this->realm . '",qop="'.$qop.'",nonce="' . $this->nonce . '",opaque="' . $this->opaque . '"');
177 $this->httpResponse->sendStatus(401);
183 * This method returns the full digest string.
185 * It should be compatibile with mod_php format and other webservers.
187 * If the header could not be found, null will be returned
191 public function getDigest() {
194 $digest = $this->httpRequest->getRawServerValue('PHP_AUTH_DIGEST');
195 if ($digest) return $digest;
197 // most other servers
198 $digest = $this->httpRequest->getHeader('Authorization');
200 // Apache could prefix environment variables with REDIRECT_ when urls
201 // are passed through mod_rewrite
203 $digest = $this->httpRequest->getRawServerValue('REDIRECT_HTTP_AUTHORIZATION');
206 if ($digest && strpos(strtolower($digest),'digest')===0) {
207 return substr($digest,7);
216 * Parses the different pieces of the digest string into an array.
218 * This method returns false if an incomplete digest was supplied
220 * @param string $digest
223 protected function parseDigest($digest) {
225 // protect against missing data
226 $needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1, 'uri'=>1, 'response'=>1);
229 preg_match_all('@(\w+)=(?:(?:")([^"]+)"|([^\s,$]+))@', $digest, $matches, PREG_SET_ORDER);
231 foreach ($matches as $m) {
232 $data[$m[1]] = $m[2] ? $m[2] : $m[3];
233 unset($needed_parts[$m[1]]);
236 return $needed_parts ? false : $data;