CGI Application Authentication using multiple drivers

Question

Hi I have been trying to authenticate my CGI application through 2 drivers, one that uses username/password stored in the database and other using ldap active directory.

following is the code

$self->authen->config( 
DRIVER => [ 'DBI',
  DBH         => $self->dbh,
  TABLE       => 'user',
  CONSTRAINTS => {
    'user.username'     => '__CREDENTIAL_1__',
    'MD5:user.password' => '__CREDENTIAL_2__'
  },
],

DRIVER => [ 'Authen::Simple::LDAP',
     host   => 'ldapad.company.com',
     basedn => 'OU=XXX,OU=XX,DC=XXX,DC=XXX', 
binddn => 'CN=usename,OU=Users,OU=XXX,OU=AD,DC=XXX,DC=xxx',
bindpw => 'secret',
filter => '(cn=%s)',   
],


CREDENTIALS    => [ 'authen_username', 'authen_password' ],
STORE                => 'Session',
LOGOUT_RUNMODE       => 'logout',
LOGIN_RUNMODE        => 'login',
POST_LOGIN_RUNMODE   => 'okay',
RENDER_LOGIN         => \&my_login_form,
);

How do I make the application check the other driver is not authenticated with one. Right now, as expected, its the driver listed at the bottom that works and they both do, depending on which was assigned last.

Answer 1

I'm assuming you're using CGI::Application::Plugin::Authentication. I think there's a small problem in your code, that justifies the fact that only the last of the two works.

Your code is like:

$self->authen->config( 
  DRIVER => [ 'DBI', ... ],
  DRIVER => [ 'Authen::Simple::LDAP', ... ],
  CREDENTIALS => [ 'authen_username', 'authen_password' ],
  STORE  => 'Session',
  # ...
);

but $self->authen->config() takes a hash. For example, take a look at this example from the C::A::P::Authentication distribution.

Being a hash, that means that the last DRIVER entry will overwrite the previous ones. I believe the fix is very simple:

$self->authen->config( 
  DRIVER => [
       [ 'DBI', ... ],
       [ 'Authen::Simple::LDAP', ... ],
  ],
  CREDENTIALS => [ 'authen_username', 'authen_password' ],
  STORE  => 'Session',
  # ...
);

You can find an example of this in the module documentation:

http://search.cpan.org/~silasmonk/CGI-Application-Plugin-Authentication/lib/CGI/Application/Plugin/Authentication.pm#config

Answer 2

How do I make the application check the other driver is not authenticated with one.

It sounds to me like you want to check if more than one authentication method works, rather than the last one that works. Could you set up 3 different $self->authen->config() and try to login 3 different times? You use a hash to track the methods that work.