Users cannot change their passwords when using HTTP authentication

AndreCharbonneau 2010-10-29 17:42:39 UTC #1

Greetings,
We’ve been running eGroupware 1.8 for a while now and it’s been working great.
However, we had to enable the user authentication at the apache level, so I’ve switched the authentication scheme in my eGroupware 1.8 installation today to the following:

Select which type of authentication you are using: HTTP
SQL encryption type for passwords (default - md5): CRYPT

The users are able to login but when they try to change their passwords they get the following error message:

Error: Failed to change password. Please contact your administrator.

Unfortunately, I could not find any error messages in the logs.

Did anyone else experience this problem?

(I’m running egroupware 1.8.001.20100929-3.1 on openSUSE 11.3 (x86_64))

Thanks a lot,
Andre

Ralf_Becker_Stylite 2010-10-29 18:53:59 UTC #2

Hi Andre,

Greetings,
We’ve been running eGroupware 1.8 for a while now and it’s been working
great.
However, we had to enable the user authentication at the apache level, so
I’ve switched the authentication scheme in my eGroupware 1.8 installation
today to the following:

Select which type of authentication you are using: HTTP
SQL encryption type for passwords (default - md5): CRYPT

The users are able to login but when they try to change their passwords they
get the following error message:

Error: Failed to change password. Please contact your administrator.

HTTP Auth means Apache checks the password and authenticates users.

No way to change the password in EGroupware, it has to be changed
whereever Apache gets it from (eg. htpasswd file).

Unfortunately, I could not find any error messages in the logs.

Did anyone else experience this problem?

(I’m running egroupware 1.8.001.20100929-3.1 on openSUSE 11.3 (x86_64))

There are bugfixes available in updated 1.8.001.20101026 packages.

Thanks a lot,
Andre

–
Ralf Becker
Director Software Development

Stylite GmbH
[open style of IT]

Morschheimer Strasse 15
67292 Kirchheimbolanden

fon +49 (0) 6352 70629-0
fax +49 (0) 6352 70629-30
mailto: rb@stylite.de

www.stylite.de
www.egroupware.org

Geschäftsführer Andre Keller,
Gudrun Müller, Ralf Becker
Registergericht Kaiserslautern HRB 30575
Umsatzsteuer-Id / VAT-Id: DE214280951

Nokia and AT&T present the 2010 Calling All Innovators-North America contest
Create new apps & games for the Nokia N8 for consumers in U.S. and Canada
$10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store
http://p.sf.net/sfu/nokia-dev2dev

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

AndreCharbonneau 2010-11-17 15:33:27 UTC #3

Thanks for the reply.
The passwords are still stored in the egroupware database. (i.e., in the SQL table and I configured Apache to read the passwords from that location.) For example, my Apache configuration looks something like:

<Directory /usr/share/egroupware/>
  AuthType Basic
  AuthName "eGroupWare"
  AuthBasicProvider dbd
  Require valid-user
  AuthDBDUserPWQuery \
    "SELECT account_pwd FROM egw_accounts WHERE account_lid = %s"
</Directory>

I think it should not be too difficult to add the feature in egroupware to be able to change the user passwords in the database in the case the HTTP authentication is done. If someone can point me to the location of the code that does the password changing, maybe I can try to implement this and submit a patch?

Thanks,
Andre

Ralf_Becker_Stylite 2010-11-17 15:59:18 UTC #4

Thanks for the reply.
The passwords are still stored in the egroupware database. (i.e., in the
SQL table and I configured Apache to read the passwords from that location.)
For example, my Apache configuration looks something like:

<Directory /usr/share/egroupware/>
AuthType Basic
AuthName "eGroupWare"
AuthBasicProvider dbd
Require valid-user
AuthDBDUserPWQuery
“SELECT account_pwd FROM egw_accounts WHERE account_lid = %s”

I think it should not be too difficult to add the feature in egroupware to
be able to change the user passwords in the database in the case the HTTP
authentication is done. If someone can point me to the location of the code
that does the password changing, maybe I can try to implement this and
submit a patch?

Patch makes no sense, as http auth is usually not used against
EGroupware’s own account-table, but an external source.

You can of cause hack that into your own installation, by copying the
password change code from auth_sql to auth_http.

Ralf

Ralf Becker
Director Software Development