prodrivers / simplesamlphp-module-sqlauthphppassword

An authentication module for SimpleSAMLphp that assumes password hashes are stored cryptographically secure. Archived as no longer actively used or developed.

sqlauthPHPPassword:SQL

This is an authentication module for SimpleSAMLphp to authenticate a user against a SQL database table.

It uses PHP's built-in password_verify functions to securelly store password.

The implementation is based heavily on SimpleSAMLphp modules sqlauth:SQL and sqlauthBcrypt:SQL.

Options

dsn : The DSN which should be used to connect to the database server. Check the various database drivers in the PHP documentation for a description of the various DSN formats.

username : The username which should be used when connecting to the database server.

password : The password which should be used when connecting to the database server. If you are running this locally for development and you are using an empty password, set this to the empty string ('').

query : The SQL query which should be used to retrieve the user. The parameters :username and :password are available. If the username/password is incorrect, the query should return no rows. The name of the columns in resultset will be used as attribute names. If the query returns multiple rows, they will be merged into the attributes. Duplicate values and NULL values will be removed.

pepper : The pepper string appended to passwords before generating the hash. If you are not using a pepper, set this to the empty string ('').

hash_column : The column storing password hashes.

Examples

Example - MySQL server:

'phppassword-example' => array(
  'sqlauthphppassword:SQL',
  'dsn' => 'mysql:host=<hostname>;dbname=<database name>',
  'username' => '<database user>',
  'password' => '<database user password>',
  'hash_column' => 'password_hash',
  'query' => 'SELECT username AS uid, name AS cn, email AS mail, password_hash FROM users WHERE username = :username',
  'pepper' => '<random string>',
),