HTTP Basic Authentication against vB-Accounts

Seeing all those "user integration" requests over and over again I made a small "hack" (not really as no tables, templates or files are modified ) that might be useful if you want to give access to non-forum content based on forum accounts:

HTTP Basic Authentication against vB user table
------------------------------------------------

This "hack" allows you to use HTTP Basic authentication
(password protected directories) based upon vB accounts.

Update Version 0.2
------------------
I've added a configuration option to the .htaccess so
you can specify which usergroup (only one for the moment)
you want to grant access.
If you don't need this feature just leave the line commented out.

Requirements
------------
- vBulletin 3 (at least the user table)
- Apache/mod_perl compiled with support for PerlAuthenHandler
- Basic Authentication feature enabled to be used in .htaccess

Installation
------------
1) Edit vBAuth.pm, fill in the configuration settings (database, etc.)
2) Put vBAuth.pm in your Perl Apache-Moduls directoy
3) (Optional) Edit .htaccess to meet your requirements
4) Put .htaccess in the directory you want to protect

[Andreas]

No. This hack will only work with Apache (who uses IIS anyway ^.^).

For IIS and ISAPI Authentication Filter would be required.
I am not all familiar with IIS (haven't used it yet) but i'll try to write one, although this might take some days.

[Chrissicom]

would be great to have this working with IIS

[Rampag33]

Great mod. Will have to wait to see if the admin has the mod_perl compiled.

[Yoshy]

Bug:
1st line of vBAuth.pm is package Apache::vBAuth2;
In the .htaccess it's PerlAuthenHandler Apache::vBAuth

You might want to put PerlAuthenHandler Apache::vBAuth2 in the htaccess


Also on my server I had to remove PerlOptions +GlobalRequest to make it work.

This is perfect for my test forum ! Thanks
[high] * Yoshy installs ![/high]

[Rampag33]

don't have that module install or I would install it. Damn and I was so close.

[my username]

So much for all the work the vb team has spent on making the application as secure as possible (application-level security).

HTTP basic auth. (http://www.ietf.org/rfc/rfc2617.txt) sends the password in clear text for every HTTP-request made to the server (when using cookies you're at least able transfer a hashed version of the password for each request)...this is why the W3C tell you NOT to use HTTP basic auth.

Why not just include/require global.php in the scripts that are "off-forum"?

http://www.w3.org/Security/Faq/wwwsf2.html
http://www.xiven.com/sourcecode/digestauthentication

[JohnBee]

Any chance this mod will get out of beta?
I want to install it on my server but the admins will not add beta material
on serverside.

[AN-net]

wow great hack!!! wish i had root access

[HiDeo]

Nice jobs, thanks

[JohnBee]

My hosting company will not add any Beta files to there serverside
modules, can you tell me if you have any plans of moving this to
full release anytime soon?