Question

I want to do what is described here, but with Drupal 7.

Before version 7, passwords were saved in database as a md5 hash, so you could use Auth_MySQL.

In this example, I’m trying to allow access on gitweb only to valid drupal users:

File: /etc/apache2/sites-enabled/default-ssl

    <Directory /usr/share/gitweb>
            AuthName "site name"
            AuthType Basic

            Auth_MySQL On
            Auth_MySQL_Authoritative on

            Auth_MySQL_Host localhost
            Auth_MySQL_Username drupal_user
            Auth_MySQL_Password drupal_password
            Auth_MySQL_DB drupal_database
            Auth_MySQL_Password_Table users
            Auth_MySQL_Username_Field name
            Auth_MySQL_Password_Field pass
            Auth_MySQL_Encryption_Types PHP_MD5
            Auth_MySQL_Password_Clause " AND status=1"
            Auth_MySQL_Empty_Passwords Off

            AuthBasicAuthoritative Off
            AuthUserFile /dev/null

            require valid-user
    </Directory>

Looking into database, with select name,pass from users;, passwords hashes are like this: $S$DSmryVGZQg2AsLOFBT68xoQaEqPA1TWe4gi2gezh93tAjrbskFUi because they are “salted”, not classic md5 hash like in older drupal version?

I know that is possible to check if a password matches the hashed password with the function user_check_password($password, $account) =>api.

How to let Apache using Drupal 7 users/password as authentication system?

Answer 1

Finally, I’ve found the solution: mod-auth-external.

Install the module, if it’s not yet installed

sudo apt-get install libapache2-mod-authnz-external
sudo a2enmod authnz_external

Add this to http.conf

DefineExternalAuth drupal environment /var/www/drupal-authentication.php

Add this to .htaccess in protected directory:

AuthType basic
AuthName "GitWeb"
AuthBasicProvider external
AuthExternal drupal
Require valid-user

Edit /var/www/drupal-authentication.php (or where your drupal installation is)

#!/usr/bin/php5
<?php

empty($_SERVER['SHELL']) && die('shells only please');

define('DRUPAL_ROOT', '/var/www');
require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);

$username = getenv('USER');
$password = getenv('PASS');

$auth = user_authenticate($username, $password);

if (!$auth) {
  exit(1);
}

exit(0);

This example is working: when accessing /gitweb directory or any file inside it, browser asks for username and password. The login is successfull only if username and password match drupal’s one.

Security

I’m not sure how much safe this is. It needs testing.

Performance

drupal-authentication.php is called for each http request, so performance are low. You can improve efficience with mod_authz_socache as described here