We found shield 7.x-1.2 and 7.x-1.3 failing on a number of servers and decided to investigate.

We noticed that the REDIRECT_HTTP_AUTHORIZATION (which could be HTTP_AUTHORIZATION on other servers) was being set and the current CGI checks were failing as the REMOTE_USER value was never set.

Requires Drupal 7.23+ or a small modification to the .htaccess REWRITE rules for older versions.

This appears to be the normal practice for other modules that use HTTP authentication on FastCGI.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Alan D. created an issue. See original summary.

Alan D.’s picture

Alan D.’s picture

Or to enable by default without needing any config

Alan D.’s picture

Note, this is what Drupal 8 does too, so not applicable to forward port :)

Symfony\Component\HttpFoundation\ServerBag

        if (isset($this->parameters['PHP_AUTH_USER'])) {
            $headers['PHP_AUTH_USER'] = $this->parameters['PHP_AUTH_USER'];
            $headers['PHP_AUTH_PW'] = isset($this->parameters['PHP_AUTH_PW']) ? $this->parameters['PHP_AUTH_PW'] : '';
        } else {
            /*
             * php-cgi under Apache does not pass HTTP Basic user/pass to PHP by default
             * For this workaround to work, add these lines to your .htaccess file:
             * RewriteCond %{HTTP:Authorization} ^(.+)$
             * RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
             *
             * A sample .htaccess file:
             * RewriteEngine On
             * RewriteCond %{HTTP:Authorization} ^(.+)$
             * RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
             * RewriteCond %{REQUEST_FILENAME} !-f
             * RewriteRule ^(.*)$ app.php [QSA,L]
             */

            $authorizationHeader = null;
            if (isset($this->parameters['HTTP_AUTHORIZATION'])) {
                $authorizationHeader = $this->parameters['HTTP_AUTHORIZATION'];
            } elseif (isset($this->parameters['REDIRECT_HTTP_AUTHORIZATION'])) {
                $authorizationHeader = $this->parameters['REDIRECT_HTTP_AUTHORIZATION'];
            }
Alan D.’s picture

Wow, we the only ones that run FastCGI? Figured this would generate some interest...

New server build on AWS; a standard cPanel build on top of Centos with FastCGI enabled and this was required to get the module working...

sjerdo’s picture

FileSize
1.15 KB
1.29 KB

We have experienced the same bug for several of our clients.
I have updated the patch to make it more readable by removing the nested ternary operators.

barthje’s picture

Status: Needs review » Reviewed & tested by the community

Tested this and works like a charm! Thanks Sjerdo.