Navigation :

Database

This module performs username and password lookup in the configured database.

<jarvis>
    <app>
        <login module="Jarvis::Login::Database">
            <parameter name="user_table"            value="staff"/>
            <parameter name="user_id_column"        value="id"/>
            <parameter name="user_username_column"  value="name"/>
            <parameter name="user_password_column"  value="password"/>
            <parameter name="group_table"           value="staff_group"/>
            <parameter name="group_username_column" value="name"/>
            <parameter name="group_group_column"    value="group_name"/>
        </login>
        ...

The parameters are:

Attribute	Default	Notes
`dbname`	`default`	The name of the database connection to use.
`user_table`	(none)	[Required] Name of the database table containing username and password columns.
`user_id_column`	(none)	Name of username ID column.
`user_username_column`	(none)	[Required] Name of the username column.
`user_password_column`	(none)	[Required] Name of the password column.
`group_table`	(none)	Optional group table containing username/group pairs.
`group_username_column`	(none)	Name of the username column in the group table.
`group_group_column`	(none)	Name of the group name column in the group table.
`encryption`	(none)	Specifies the encryption method for the password. This can be one of: • `none` - no encryption. • `md5` - the md5 hash algorithm is used, with optional salt. • `eksblowfish` - the Eksblowfish encryption algorithm is used. Salt is hard coded to 16. It is strongly suggested that `eksblowfish` is used, for reasons outlined here: http://paulbuchheit.blogspot.com/2007/09/quick-read-this-if-you-ever-store.html.
`salt_prefix_len`	`0`	If configured to a value > 0, then encrypted passwords are encoded with a salt prefix to hamper dictionary attacks. Currently only necessary for the `md5` encryption method. For MD5, the hex-encoded MD5 hash value is expected to be prefixed by exactly this number of ASCII salt characters. The salt characters are pre-pended to the user-supplied password before generating the MD5 hash.
`password_cost_update_statement`	(none)	SQL statement to update stored user passwords. This will be executed transparently upon login if the following conditions are met: • `eksblowfish` encryption method is used. • Stored user password hash is weaker than the current strength level. e.g. `UPDATE users SET password = ? where username = ?`

The three user parameters are mandatory. In order to perform group lookup, all three group parameters must be configured. If not, all users will be placed in a single group named default.

If the user_id_column parameter is defined, then it must specify the name of an additional database column in the user table. When configured, the value from this column matching the supplied username will be stored in a “safe” variable which can be accessed as {$__user_id} in datasets.