Restler 3.0基本身份驗證

我正在嘗試Restler爲我的新項目構建web api。
其中一個要求是簡單認證。
我找到很好的例子對SO https://stackoverflow.com/a/7969250/965722但它是Restler 2. 使用手動我設法這個類轉換爲Restler 3.0Restler 3.0基本身份驗證

<?php 
class BasicAuthentication implements iAuthenticate 
{ 
    const REALM = 'Restricted API'; 
    public static $currentUser; 
    public static $requires = 'user'; 
    public static $role = 'user'; 

    public function __isAllowed() 
    { 
     if (isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW'])) 
     { 
      $user = $_SERVER['PHP_AUTH_USER']; 
      $pass = $_SERVER['PHP_AUTH_PW']; 
      $user = mysql_real_escape_string($user); 
      $pass = mysql_real_escape_string($pass); 

      $roles = array('12345' => 'user', '67890' => 'admin'); 

      if (!isset($pass) || !array_key_exists($pass, $roles)) 
      { 
       return false; 
      } 

      static ::$role = $roles[$pass]; 
      Resources::$accessControlFunction = 'AccessControl::verifyAccess'; 
      return static ::$requires == static ::$role || static ::$role == 'admin'; 
     } 
     header('WWW-Authenticate: Basic realm="' . self::REALM . '"'); 
     throw new RestException(401, 'Basic Authentication Required'); 
    } 

    /** 
    * @access private 
    */ 
    public static function verifyAccess(array $m) 
    { 
     $requires = isset($m['class']['AccessControl']['properties']['requires']) ? $m['class']['AccessControl']['properties']['requires'] : false; 
     return $requires ? static ::$role == 'admin' || static ::$role == $requires : true; 
    } 
} 
?>

我的示例API類看起來像這樣：

<?php 
class Api 
{ 
    /** 
    * @url GET 
    * @url GET hello 
    * @url GET hello/{to} 
    */ 
    function hello($to = 'world') 
    { 
     return "Hello $to!"; 
    } 
    /** 
    * @access protected 
    * @class AccessControl {@requires user} 
    */ 
    public function user() 
    { 
     return "protected api, only user and admin can access"; 
    } 
    /** 
    * @access protected 
    * @class AccessControl {@requires admin} 
    */ 
    public function admin() 
    { 
     return "protected api, only admin can access"; 
    } 
}

任何我的index.php

<?php 
require_once 'vendor/restler.php'; 
use Luracast\Restler\Restler; 

$r = new Restler(); 
$r->addAPIClass('Api', ''); 
$r->addAuthenticationClass('BasicAuthentication'); 
$r->handle(); 
?>

當我導航到我的網頁標準登錄和密碼錶單顯示，但即使我把正確的用戶名和密碼都沒有發生 - 登錄窗口重新打開。

我可能犯了一些愚蠢的錯誤，但我找不到它。這是我第一次嘗試基本認證，所以請親切。

我需要在服務器上進行一些特殊配置嗎？

編輯：
它看起來像我需要一些特殊的配置，因爲我的服務器運行的CGI/FastCGI的。
我試過從此評論添加代碼：http://php.net/manual/en/features.http-auth.php#106285 但我無法正確配置.htaccess。
這是默認Restler htaccess文件：

Options -MultiViews 
DirectoryIndex index.php 
<IfModule mod_rewrite.c> 
    RewriteEngine On 
    RewriteRule ^$ index.php [QSA,L] 
    RewriteCond %{REQUEST_FILENAME} !-f 
    RewriteCond %{REQUEST_FILENAME} !-d 
    RewriteRule ^(.*)$ index.php [QSA,L] 
</IfModule> 
<IfModule mod_php5.c> 
    php_flag display_errors Off 
</IfModule>

這些線由解決方法需要從以前的鏈接工作：

RewriteEngine on 
RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization},last]

如何既結合？

來源

2013-09-26 Misiu

我不知道爲什麼，但我必須在我的BasicAuthentication類中實現iUseAuthentication。（關於它的文檔沒有任何內容，可能是因爲這是RC版本，文檔和樣本被修改）。
這樣一切都開始工作。
另外我修改htaccess的像這樣：

Options -MultiViews 
DirectoryIndex index.php 
<IfModule mod_rewrite.c> 
    RewriteEngine On 
    RewriteRule ^$ index.php [QSA,L] 
    RewriteCond %{REQUEST_FILENAME} !-f 
    RewriteCond %{REQUEST_FILENAME} !-d 
    RewriteRule ^(.*)$ index.php [QSA,L] 
    RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization},last] 
</IfModule> 
<IfModule mod_php5.c> 
    php_flag display_errors Off 
</IfModule>

希望這可以幫助別人:)

編輯：
我發現我的代碼，我在這裏張貼，也許有人會覺得它有用。

<?php 
use \Luracast\Restler\iAuthenticate; 
use \Luracast\Restler\Resources; 
class BasicAuthentication implements iAuthenticate 
{ 
    const REALM = 'Restricted API'; 
    public static $requires = 'user'; 
    public static $role = 'user'; 

    public function __isAllowed() 
    { 
     //set http auth headers for apache+php-cgi work around 
     if (isset($_SERVER['HTTP_AUTHORIZATION']) && preg_match('/Basic\s+(.*)$/i', $_SERVER['HTTP_AUTHORIZATION'], $matches)) 
     { 
      list($name, $password) = explode(':', base64_decode($matches[1])); 
      $_SERVER['PHP_AUTH_USER'] = strip_tags($name); 
      $_SERVER['PHP_AUTH_PW'] = strip_tags($password); 
     } 

     //set http auth headers for apache+php-cgi work around if variable gets renamed by apache 
     if (isset($_SERVER['REDIRECT_HTTP_AUTHORIZATION']) && preg_match('/Basic\s+(.*)$/i', $_SERVER['REDIRECT_HTTP_AUTHORIZATION'], $matches)) 
     { 
      list($name, $password) = explode(':', base64_decode($matches[1])); 
      $_SERVER['PHP_AUTH_USER'] = strip_tags($name); 
      $_SERVER['PHP_AUTH_PW'] = strip_tags($password); 
     } 
     if (isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW'])) 
     { 
      $user = $_SERVER['PHP_AUTH_USER']; 
      $pass = $_SERVER['PHP_AUTH_PW']; 

      $roles = array('12345' => 'user', '67890' => 'admin'); 

      if (!isset($pass) || !array_key_exists($pass, $roles)) 
      { 
       return false; 
      } 

      static ::$role = $roles[$pass]; 
      Resources::$accessControlFunction = 'BasicAuthentication::verifyAccess'; 
      $x = static ::$requires == static ::$role || static ::$role == 'admin'; 

         $file = 'a.txt'; 
      $current = file_get_contents($file); 
      $current .= static ::$requires." ".static::$role . "\n"; 
      file_put_contents($file, $current); 

      return $x; 
     } 
     header('WWW-Authenticate: Basic realm="' . self::REALM . '"'); 
     throw new RestException(401, 'Basic Authentication Required'); 
    } 

    /** 
    * @access private 
    */ 
    public static function verifyAccess(array $m) 
    { 
     $requires = isset($m['class']['BasicAuthentication']['properties']['requires']) ? $m['class']['BasicAuthentication']['properties']['requires'] : false; 

           $file = 'a.txt'; 
      $current = file_get_contents($file); 
      $current .= $requires." - ".static::$role . "\n"; 
      file_put_contents($file, $current); 
     return $requires ? static ::$role == 'admin' || static ::$role == $requires : true; 
    } 
} 
?>

和我的樣本API類：

<?php 
class Api implements iUseAuthentication 
{ 
    private $_authenticated = false; 
    /** 
    * This method will be called first for filter classes and api classes so 
    * that they can respond accordingly for filer method call and api method 
    * calls 
    * 
    * 
    * @param bool $isAuthenticated passes true when the authentication is 
    *        done, false otherwise 
    * 
    * @return mixed 
    */ 
    public function __setAuthenticationStatus($isAuthenticated = false) 
    { 
     $this->_authenticated = $isAuthenticated; 
    } 

    /** 
    * @access protected 
    * @class BasicAuthentication {@requires user} 
    */ 
    public function user() 
    { 
     return "protected api, only user and admin can access"; 
    } 
    /** 
    * @access protected 
    * @class BasicAuthentication {@requires admin} 
    */ 
    public function admin() 
    { 
     return "protected api, only admin can access"; 
    } 
} 
?>

來源

2013-09-27 06:06:30 Misiu

@Misiiu你在這一行的意思是：類BasicAuthentication實現IAuthenticate進行的，而不是IAuthenticate進行你不得不使用iUseAuthentication –

@ZeeshanJan我已經編輯我的答案。我已經發布了我的BasicAuthentication類和實現'iUseAuthentication'的示例API類。所有你必須做的是當你創建Restler實例時你必須添加'$ r-> addAuthenticationClass（'BasicAuthentication'）;'。希望這可以幫助！ :) – Misiu

Restler 3.0基本身份驗證

回答

相關問題