How Authentication works with MoinMoin

MoinMoin supports configurable, modular authenticators to support all sorts of builtin and 3rd party authentication methods.

You use the auth configuration value to set up a list of authenticators that are processed in exactly that order.

When an external user database is used, you do not want to recreate all users in moin manually. For this case the authenticator objects which support user profile creation/updating have a parameter autocreate. If you set it to True a new user profile will be created/updated automatically when a (new) user has passed authentication.

Presently the following authenticators are supported:

Other pseudo-authenticators - These are not strictly authenticators, as they don't authenticate users, but use auth information for other purposes:

• MoinMoin.auth.log.AuthLog	will just log login/logout/request, nothing else
  MoinMoin.auth.smb_mount.SMBMount	mount some smb share using user/password from login, umount on logout

Shipped plugins

MoinAuth (default)

This is the default auth list moin uses (so if you just want that, you don't need to configure it).

   1     from MoinMoin.auth import MoinAuth
   2     auth = [MoinAuth()]

Given authentication

given by REMOTE_USER environment variable

Webservers (like e.g. Apache) often support all sorts of authentication plugins (e.g. HTTP basic auth). If the webserver is configured for authentication, it handles authentication before moin gets called. When visiting a resource requiring authentication, you get queried for username/password by a dialog box of your browser. When you submit, 2 things can happen:

• username/password is incorrect, usually it will just ask again (if you cancel, it will deny access with a 401 not authorized error)

• username/password is correct, the webserver passes the authorized username to Moin (via REMOTE_USER).

Moin's GivenAuth authenticator will, by default, just try to log in the user with the username it recieved from REMOTE_USER.

To activate usage of REMOTE_USER for authentication you have to add following lines to wikiconfig.py:

   1     from MoinMoin.auth import GivenAuth
   2     auth = [GivenAuth(autocreate=True)]

given by other environment variable

Instead of reading the username from REMOTE_USER, moin can also read it from some other environment variable:

   1     from MoinMoin.auth import GivenAuth
   2     auth = [GivenAuth(env_var='WHATEVER', autocreate=True)]

decoding of the user name

REMOTE_USER (or whatever you specify as env_var) is a encoded string and needs to be decoded to unicode. If you don't specify the coding, moin will try 'utf-8' and 'latin-1' (in that order). For non-ASCII characters, this might lead to incorrect results if another coding was used by the web server.

If it fails, you can specify the coding manually:

   1     auth = [GivenAuth(env_var='WHATEVER', autocreate=True, coding='cp850')]

transformation of the user name

Sometimes the user name we receive in REMOTE_USER needs some transformation, so it can sanely be used in the wiki.

GivenAuth has some flags to support some standard transformations, enable whatever you like (give True - the default is all False, meaning disabled transformation):

The transformations (if enabled) will happen in the order shown.

For example, for some windows domain environments, this might make sense:

   1     auth = [GivenAuth(autocreate=True, strip_windomain=True, titlecase=True, remove_blanks=True)]

fixed user given by configuration

You can also hardcode a username into your configuration:

   1     from MoinMoin.auth import GivenAuth
   2     auth = [GivenAuth(user_name=u'Joe Doe', autocreate=True)]

Everyone and everything accessing the wiki will now be logged in as user Joe Doe automatically.

SSL client certification authentication

To activate authentication via SSL client certificates you have to add following lines to wikiconfig.py:

   1     from MoinMoin.auth.sslclientcert import SSLClientCertAuth
   2     auth = [SSLClientCertAuth()]

SSL client certification authentication must be used with a web server like Apache that handles the SSL bits and just presents a few environment variables to Moin.

The SSLClientCertAuth authenticator has a few parameters that you pass to the constructor (example below):

For example, to accept only certificates that Apache has verified and that are signed by a certain authority, use:

   1     from MoinMoin.auth.sslclientcert import SSLClientCertAuth
   2     auth = [SSLClientCertAuth(authorities=['my.authority.tld'])]

or similar.

PHP session

To activate Single-Sign-On integration with PHP applications, use this module. It reads PHP session files and therefore directly integrates with existing PHP authentication systems.

To use this module, use the following lines of code in your configuration:

   1     from MoinMoin.auth.php_session import PHPSessionAuth
   2     auth = [PHPSessionAuth()]

PHPSessionAuth has the following parameters:

   1     PHPSessionAuth(apps=['egw'], s_path="/tmp", s_prefix="sess_")

• apps is a list of enabled applications

• s_path is the path of the PHP session files

• s_prefix is the prefix of the PHP session files

The only supported PHP application is eGroupware 1.2 currently. But it should be fairly easy to add a few lines of code that extract the necessary information from the PHP session, if you do that, please open a feature request with a patch.

OpenID (with BotBouncer)

The OpenID authentication plugin allows users to sign in using their OpenID and connect that OpenID to a new or existing Moin account. To allow users to sign in with OpenID, add the plugin to the auth list, or to require OpenID with http://botbouncer.com/ verification use:

   1     from MoinMoin.auth.openidrp import OpenIDAuth