fatfree user auth global variable - php

Question

Iam auth my user with the build in function. But is fatfree not setting the username global? Cant find it
$angemeldet = new \DB\SQL\Mapper($this->db, 'users');
$auth = new \Auth($angemeldet, array('id'=>'name', 'pw'=>'email'));
$auth->basic(); // a network login prompt will display to authenticate the user
This is working.
http://www.willis-owen.co.uk/2013/02/blog-tutorial-with-fat-free-framework-v3/
Here i found that he is setting it in the SESSION. But if i try to access it, its completly empty. Where can i find the username?
And how can i manipulate the password? So i can compare a hash?

Answer 1

The F3 Auth will not set the user to the SESSION by default, you would have to do that yourself. You can't store PDO objects in the SESSION because they can't be serialized. The username will be stored in the SERVER.PHP_AUTH_USER, so you can use that to fetch the $user.
To hash the password, you pass a function to the $auth->basic( function( $password ){} ); and return the hashed password. Using SHA256 with a salt will be much more secure than MD5.
This is the code I am using to do BASIC auth.
// I call this from the constructor of the handler of secure pages.
public static function authenticate(){
// map to the users db table
$user = new \DB\SQL\Mapper( F3::get( 'db' ), 'users' );
// tell F3 to use the columns username and password
$auth = new \Auth( $user, array( 'id'=>'username', 'pw'=>'password' ) );
// check to see if they are authed, use a function to create hashed password
$authenticated = $auth->basic( function ( $password ){
$salt = 'Some secure salt string...';
return hash( 'sha256', $password . $salt );
} );
// if we are logged in and the user isn't set....
if ( $authenticated && !F3::exists( 'user' ) ){
// use SERVER.PHP_AUTH_USER to load user by username
$user->load( array( 'username=?', F3::get( 'SERVER.PHP_AUTH_USER' ) ) );
// set user to variable if it could be loaded
if ( !$user->dry() ){
F3::set( 'user', $user );
}
}
}

Answer 2

Look at the code below:
public function verify($f3, $params) {
$username = $f3->get('POST.email');
$password = $f3->get('POST.password');
$hashedPassword = md5($password);
$submit = $f3->get('POST.submit');
if (isset($submit)) {
global $db;
$user = new DB\SQL\Mapper($db, 'users');
// username is email, password is password in our case
$auth = new \Auth($user, array('id' => 'email', 'pw' => 'password'));
$loginResult = $auth->login($username, $hashedPassword); // Cross-check with users with hashedPassword
// Authenticated the user successfully
if ($loginResult == true) {
$f3->set('message', 'Logged in successfully.');
$f3->reroute('/login');
}
} else {
$f3->set('message', 'Please enter valid username/password');
}
$f3->reroute('/login');
}
In the above code you can see that I have used md5 hash in the password. This might give you idea on what you are trying to achieve.

Answer 3

check the API docs for the basic auth method: http://fatfreeframework.com/auth#basic
i think it should be something like
$auth->basic(function($input){
return md5($input);
});
unfortunately this method does not return any user data on a valid login. but since objects are passed by reference in php, you could try to have a look at the mapper after the auth process, if some data was populated. var_dump($angemeldet->cast());

Answer 4

This is the easiest way to do basic (browser popup) auth, from my experience:
function renderAdmin() {
$user=new DB\SQL\Mapper($this->db,'users');
$auth== null;
$auth = new \Auth($user, array('id'=>'username', 'pw'=>'password'));
$login_result = $auth->basic();
if ($login_result) $f3->set('SESSION.username','SERVER.PHP_AUTH_USER');
if (!$f3->get('SESSION.username')) $f3->error(401);
else {
// all your code for the admin section
echo \Template::instance()->render('admin.html');
}
}