MySQL Auth

Article Topics: Setup

Very Important: As of Apache 2.4 mod_auth_mysql is discontinued and no longer supported

Very Important: Usernames MUST be unique across all sites if using this method to authenticate members. Check the Surfer section of your Configuration Admin to ensure the 'UNIQUE_MEMBER_NAMES' setting is set to 'For all sites.'

Read through our mod_authn_dbd article for an alternative authentication method

MySQL Auth is a feature supported by NATS that allows you to authenticate members against an external MySQL database. This is useful for clients who use an external member database to store information.

Setting up MySQL Auth

This article applies to mod_auth_mysql 3.0

Biller Member Management

In order to use the MySQL Auth feature, you must first tell the biller to turn off user management on their end.

.htaccess

For NATS password management, you will have to use a MySQL auth method, such as Apache's mod_auth_mysql. The following code consists of specific configuration settings for mod_auth_mysql:

AuthMYSQLEnable on
AuthName "Members Only"
AuthType Basic
AuthGroupFile /dev/null
AuthMySQLHost localhost
AuthMySQLDB <name of the nats datatbase>
AuthMySQLUser <user for the nats database>
AuthMySQLPassword <password for the user for the nats database>
AuthMySQLUserTable member_auth
AuthMySQLNameField username
AuthMySQLPasswordField password
AuthMySQLPwEncryption none
AuthMySQLUserCondition "siteid=X AND username != '' AND password != ''"
require valid-user

Replace X in "siteid=X" with the ID number of the site you would like to affect. If you would like to use a single member's area for all of your sites, simply remove "AND siteid=X" from the line. For more options and information, please see our Multisite Access article. The NOT condition will prevent anyone from logging in without a username or password.

Note: For additional security, we suggest creating a separate db user with only the SELECT privilege to the member_auth table.

If you would like to use your old password files in combination with the mod_auth_mysql feature, simply add the following line to your configuration file on top of the auth mod_auth_mysql lines:

AuthMySQLAuthoritative Off

Notes

If other sites on the server use htaccess for authentication, but aren't using mod_auth_mysql, add the following options to the top of their htaccess files:

AuthMySQLEnable Off
AuthMySQLAuthoritative Off

If you use member encryption change the password field to cryptpass and change AuthMySQLPwEncryption to crypt

Alternate Server Member Management

If your NATS database is on a different server from your site member's area, use the following instructions to use MySQL Auth:

Use the GRANT command to give appropriate permissions to the NATS database username at the IP address of each member's area server. When this is done, change the value of the AuthMySQLHost directive to the IP address of the NATS server.

If you do not know how to do this, please request that your Host or Server admin allows the NATS database user to access the database from your member's area servers.

Please Note: For additional security GRANT only the SELECT privilege to the member_auth table for this db user.

Alternative MySQL member_auth view

As an alternative to using the NATS member_auth table, you or your host can create a Mysql View of the member table so the active members are directly based upon the membership table rather than stored in a separate table. For details in regards to setting up a Mysql view visit create member auth view.

Additional Resources

• mod_auth_mysql's homepage