Thanks for the reply, William. Here's the code: I copied it nearly verbatim from a link in one of the how-tos.
An interesting part is the line
logger.info(request.env.inspect)
at the beginning of authenticate which gives me all the HTTP headers - none of the Authenticate variations are present in the hash, so there's getting stripped somewhere. I know my browser is setting them since I get them on my dev machine being driven with the same browser.
def authorize(realm='Web Password', errormessage="Could't authenticate you")
logger.info(request.env.inspect)
username, passwd = get_auth_data
# check if authorized
# try to get user
if user = User.authenticate(username, passwd)
# user exists and password is correct ... horray!
if user.methods.include? 'lastlogin'
# note last login
session['lastlogin'] = user.lastlogin
user.last.login = Time.now
user.save()
end
session["User.id"] = user.email
else
# the user does not exist or the password was wrong
response.headers["Status"] = "Unauthorized"
response.headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\""
render :text => errormessage, :status => 401 and return
end
end
private
def get_auth_data
user, pass = '', ''
# extract authorisation credentials
if request.env.has_key? 'X-HTTP_AUTHORIZATION'
# try to get it where mod_rewrite might have put it
authdata = request.env['X-HTTP_AUTHORIZATION'].to_s.split
elsif request.env.has_key? 'Authorization'
# for Apace/mod_fastcgi with -pass-header Authorization
authdata = request.env['Authorization'].to_s.split
elsif request.env.has_key? 'HTTP_AUTHORIZATION'
# this is the regular location
authdata = request.env['HTTP_AUTHORIZATION'].to_s.split
elsif request.env.has_key? 'Authorization'
# this is the regular location, for Apache 2
authdata = @request.env['Authorization'].to_s.split
else user, pass = params[:userid], params[:pw]
end
# at the moment we only support basic authentication
if authdata and authdata[0] == 'Basic'
user, pass = Base64.decode64(authdata[1]).split(':')[0..1]
end
return [user, pass]
end
2007-03-25 10:50 AM
