I've run into a problem using the Shield module in certain hosting environments (namely Webfaction) because their setup doesn't pass on environment variables in the HTTP header. The result is that Shield keeps the webserver stuck in an endless loop asking for login credentials because it never gets values of username and password.
Here's the explanation taken from their forum:
The common workarounds for that problem involve setting a HTTP_AUTHENTICATION environment variable via mod_rewrite, but that doesn't work on our servers because our php-cgi environment runs on Apache with suExec, which does not pass environment variables to CGI scripts.
So, the solution is the pass the HTTP:Authentication header to your PHP script via some other means.
They suggest using mod_rewrite to pass the username and password variables as URL parameters. I don't know if this issue is really a bug per se but I thought I'd document my experience; maybe there's room for changes in Shield to work across more hosting configurations.
Thoughts?
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | authentication-vars-as-url-parameters-2078697-2.patch | 659 bytes | cossovich |
Comments
Comment #1
cossovich commentedI've lodged a companion issue against Drupal core here: #2078699: htaccess rewrite rules for HTTP authentication are not compatible with certain hosting environments
To implement the solution suggested by Webfaction the htaccess file in the Drupal root would need to be modified.
Comment #2
cossovich commentedHere's my patch to implement the workaround outlined in the Webfaction docs.
Comment #3
geek-merlinSounds reasonable.
This would need a link to above issue in the readme and/or project page too.
Comment #5
geek-merlin