Automated login fix/improvements

[adrianbj]

Not sure if anyone has come across this old thread: https://sourceforge.net/p/adminer/discussion/960418/thread/0ebcd89548/

It used to be so simple to automatically login with credentials() but around v4.7.2 it stopped working and so I implemented an ugly hack (https://github.com/adrianbj/TracyDebugger/blob/cf2092dd81b87e0dff63b704a52d99614f70a5db/panels/Adminer/plugins/AdminerProcessWireLogin.php#L51-L90) with:

    function loginForm() {
        ?>
        <input type="hidden" name="auth[permanent]" value="1" checked />
        <script nonce="<?=get_nonce()?>">
            addEventListener('DOMContentLoaded', function () {
                document.getElementsByTagName('body')[0].style.display = "none";
                document.forms[0].submit();
            });
        </script>
        <?php
    }

I'd love to see this work like it used to, or has anyone else actually found a proper solution that works currently?

[peterpp]

There is a plugin for 3rd party login: https://github.com/Roy-Orbison/adminer-login-external which can be used also for autologin.
It has been merged into EdminerEvo with some useful examples: adminerevo/adminerevo#43

It is in my TODO list, I want to review it and maybe provide its functionality directly. We'll see.

[adrianbj]

Thanks for pointing out that plugin - I hadn't seen that. Honestly though it seems to be a bit hacky with some similar approaches to what I've done, eg populating and hiding the form fields, and using JS to autosubmit the form. Granted it has some additional protection with $this->externals but I'd still love to see a return to a situation where we can just provide the credentials via credentials(). Is there a security issue with this approach that I am not thinking of?

[peterpp]

I don't know without deeper analysis. But I believe it could be simplified without lowering the security level of the core functionality.

[adrianbj]

Just thought I'd post an update on my approach in case you have any feedback or if others might find it useful.

I removed all login(), credentials(), loginForm(), loginFormFields() that were populating and submitting the login form and trying to authorize and replaced with just this:

        if(!$_GET['username']) {
            $_POST['auth'] = [
                'driver' => 'mysql',
                'server' => 'my-server-name',
                'db' => 'my-database,
                'username' => 'me',
                'password' => 'abc123'
            ];
        }

and it seems very reliable.

The only issue (which I also had with the other approaches I have tried), is that I still sometimes get this "Events" alert:

But it is providing access just fine, so not sure why the alert is being thrown.

BTW - I did go through the process of using the new getCredentials() and authenticate() functions but still couldn't get a login to actually happen that way and in fact in a recent version of the new-default-theme branch I actually starting having a situation where the JS to submit the form was getting called in an infinite loop, which is what prompted me to find this new way.

[adrianbj]

Just wanted to post an update here. I have refined my approach a bit and it's been reliable for a few weeks now.

if(!$_GET['username'] || !isset($_COOKIE['neo_permanent']) || $_COOKIE['neo_permanent'] == '') {
            $_POST['auth'] = [
                'driver' => 'mysql',
                'server' => 'my-server-name',
                'db' => 'my-database,
                'username' => 'me',
                'password' => 'abc123'
            ];
}

function getCredentials() {
   return array(wire('config')->dbHost . (wire('config')->dbPort ? ':' . wire('config')->dbPort : ''), wire('config')->dbUser, wire('config')->dbPass);
}

function authenticate() {
    return true;
}

Note the change to the new neo_permanent cookie.

One caveat is that I still do get that Access denied for user 'me'@'localhost' to database 'my-database' but doesn't impact anything. It is only shown when viewing the main DB view - not when viewing specific tables, or any other view.

[peterpp]

Autologin implementation by checking username and permanent cookie has limitations. If the session cookie expires or gets lost, you will end up on a page with login form, probably also with an error message.

I implemented new ExternalLoginPlugin in the external-login branch. Could you check it? You can use it as is, or you can adopt the key part to your code.

How it works:

• Autologin is handled in the new init() customizable function. It cannot be done in constructor because I need Admin context to read from configuration.
• It uses the database connections defined in the servers config option. It is now possible to define user credentials for each server connection.
• If user is authenticated by external service and there is only one server connection, user is automatically logged in.
• Stored password is used to verify the validity of the current session.
• If the session is not valid, it is restarted and the correct credentials are saved. This is the same process as used to keep the permanent login.

Other details:

• Login form is used when multiple server connections are defined.
• Username and password fields are hidden in login form.
• Logout button is hidden when autologin is used.

[peterpp]

This configurations seems to be valid. So I have two questions:

• Do you modify login form in ProcessWirePlugin? Because ExternalLoginPlugin hides Username and Password fields.
• Did you update also adminneo.php itself? Because autologin is implemented in the new init() method.

[adrianbj]

I don't modify the form in ProcessWirePlugin, but just in case I removed that plugin while testing to make sure there wasn't something impacting things. I also cleared all cookies to make sure nothing from my $_POST['auth'] approach was sticking around.

Yes, I updated with a newly compiled adminneo.php - it contains: function init():void{}public abstract

[peterpp]

I found a problem with global $drivers variable. It should be fixed now in external-login branch.

[adrianbj]

Works great now!

[peterpp]

Nice! Merged to the main branch.