diff --git a/docs/simplesamlphp-idp.txt b/docs/simplesamlphp-idp.txt index 76d9ca37b65d8056d0b188347ce1de9411482ffd..eedc96578834fa46a3567d7a2f1f59778216bf1c 100644 --- a/docs/simplesamlphp-idp.txt +++ b/docs/simplesamlphp-idp.txt @@ -40,8 +40,8 @@ The next step is to configure the way users authenticate on your IdP. Various mo [`ldap:LDAPMulti`](./ldap:ldap) : Authenticates an user to one of several LDAP server. The user can choose the LDAP server from a dropdown list. - -`sqlauth:SQL` + +[`sqlauth:SQL`](./sqlauth:sql) : Authenticate an user against a database. [`radius:Radius`](./radius:radius) diff --git a/modules/sqlauth/docs/sql.txt b/modules/sqlauth/docs/sql.txt new file mode 100644 index 0000000000000000000000000000000000000000..14f00f60b0341b933b334ecc29c05a8db67a3473 --- /dev/null +++ b/modules/sqlauth/docs/sql.txt @@ -0,0 +1,77 @@ +`sqlauth:SQL` +============= + +This is a authentication module for authenticating an user against a SQL database. + + +Options +------- + +`dsn` +: The DSN which should be used to connect to the database server. + Check the various database drivers in the [PHP documentation](http://php.net/manual/en/pdo.drivers.php) for a description of the various DSN formats. + +`username` +: The username which should be used when connecting to the database server. + + +`password` +: The password which should be used when connecting to the database server. + +`query` +: The SQL query which should be used to retrieve the user. + The parameters :username and :password are available. + If the username/password is incorrect, the query should return no rows. + The name of the columns in resultset will be used as attribute names. + If the query returns multiple rows, they will be merged into the attributes. + Duplicate values and NULL values will be removed. + + +Examples +-------- + +Database layout used in examples: + + CREATE TABLE users ( + username VARCHAR(30) NOT NULL PRIMARY KEY, + password TEXT NOT NULL, + name TEXT NOT NULL, + email TEXT NOT NULL + ); + CREATE TABLE usergroups ( + username TEXT REFERENCES users (username) ON DELETE CASCADE ON UPDATE CASCADE, + groupname TEXT, + UNIQUE(username, groupname) + ); + +Example - simple setup, PostgreSQL server: + + 'sql-exampleorg' => array( + 'sqlauth:SQL', + 'dsn' => 'pgsql:host=sql.example.org;port=5432;dbname=simplesaml', + 'username' => 'userdb', + 'password' => 'secretpassword', + 'query' => 'SELECT username, name, email FROM users WHERE username = :username AND password = :password', + ), + +Example - multiple groups, MySQL server: + + 'sql-exampleorg-groups' => array( + 'sqlauth:SQL', + 'dsn' => 'mysql:host=sql.example.org;dbname=simplesaml', + 'username' => 'userdb', + 'password' => 'secretpassword', + 'query' => 'SELECT users.username, name, email, groupname AS groups FROM users LEFT JOIN usergroups ON users.username=usergroups.username WHERE users.username = :username AND password = :password', + ), + +Example query - MD5 of salt + password, stored as salt + md5(salt + password) in password-field, MySQL server: + + SELECT username, name, email + FROM users + WHERE username = :username AND SUBSTRING(password, -32) = MD5(CONCAT(SUBSTRING(password, 1, LENGTH(password) - 32), :password)) + +Example query - MD5 of salt + password, stored as salt + md5(salt + password) in password-field, PostgreSQL server: + + SELECT username, name, email + FROM users + WHERE username = :username AND SUBSTRING(password FROM LENGTH(password) - 31) = MD5(SUBSTRING(password FROM 1 FOR LENGTH(password) - 32) || :password) diff --git a/modules/sqlauth/lib/Auth/Source/SQL.php b/modules/sqlauth/lib/Auth/Source/SQL.php index a60087ae5d3b40269a75ad66037f240b290fb836..4385daf18dd2c747f0ce6a77f8c8e71748724fb1 100644 --- a/modules/sqlauth/lib/Auth/Source/SQL.php +++ b/modules/sqlauth/lib/Auth/Source/SQL.php @@ -6,60 +6,6 @@ * This class is an example authentication source which authenticates an user * against a SQL database. * - * The following options are required: - * It has the following options: - * - dsn: The DSN which should be used to connect to the database server. Check the various - * database drivers in http://php.net/manual/en/pdo.drivers.php for a description of - * the various DSN formats. - * - username: The username which should be used when connecting to the database server. - * - password: The password which should be used when connecting to the database server. - * - query: The SQL query which should be used to retrieve the user. The parameters :username - * and :password are available. If the username/password is incorrect, the query should - * return no rows. The name of the columns in resultset will be used as attribute names. - * If the query returns multiple rows, they will be merged into the attributes. Duplicate - * values and NULL values will be removed. - * - * Database layout used in examples: - * CREATE TABLE users ( - * username VARCHAR(30) NOT NULL PRIMARY KEY, - * password TEXT NOT NULL, - * name TEXT NOT NULL, - * email TEXT NOT NULL - * ); - * CREATE TABLE usergroups ( - * username TEXT REFERENCES users (username) ON DELETE CASCADE ON UPDATE CASCADE, - * groupname TEXT, - * UNIQUE(username, groupname) - * ); - * - * Example - simple setup, PostgreSQL server: - * 'sql-exampleorg' => array( - * 'sqlauth:SQL', - * 'dsn' => 'pgsql:host=sql.example.org;port=5432;dbname=simplesaml', - * 'username' => 'userdb', - * 'password' => 'secretpassword', - * 'query' => 'SELECT username, name, email FROM users WHERE username = :username AND password = :password', - * ), - * - * Example - multiple groups, MySQL server: - * 'sql-exampleorg-groups' => array( - * 'sqlauth:SQL', - * 'dsn' => 'mysql:host=sql.example.org;dbname=simplesaml', - * 'username' => 'userdb', - * 'password' => 'secretpassword', - * 'query' => 'SELECT users.username, name, email, groupname AS groups FROM users LEFT JOIN usergroups ON users.username=usergroups.username WHERE users.username = :username AND password = :password', - * ), - * - * Example query - MD5 of salt + password, stored as salt + md5(salt + password) in password-field, MySQL server: - * SELECT username, name, email - * FROM users - * WHERE username = :username AND SUBSTRING(password, -32) = MD5(CONCAT(SUBSTRING(password, 1, LENGTH(password) - 32), :password)) - * - * Example query - MD5 of salt + password, stored as salt + md5(salt + password) in password-field, PostgreSQL server: - * SELECT username, name, email - * FROM users - * WHERE username = :username AND SUBSTRING(password FROM LENGTH(password) - 31) = MD5(SUBSTRING(password FROM 1 FOR LENGTH(password) - 32) || :password) - * * @package simpleSAMLphp * @version $Id$ */