1

I've recently set up a password protected area on a client's website, but there's an issue where several of the members of the organisation concerned have identical usernames, although, obviously, different passwords.

For example, if there are two people with the username of John Smith, only the first John Smith listed in the .htpasswd file can gain access. However, if I change their order in that file, then only the other John Smith can gain access.

It seems that once having found what it thinks is an incorrect username/password combination, .htaccess doesn't look any further to see if there are any other people named John Smith and if their passwords are correct.

Is there an easy solution to this problem?

The obvious one is to ensure that usernames are unique, however in this situation I'm constrained to using the members' real names as contained in an existing membership database, as their username.

4
  • 2
    User names have to be unique. Can you use their email address to log them in instead if their full name isn't unique? Commented Nov 29, 2021 at 9:31
  • Alternatively, use another method than http auth. If you had a login page you might have a dropdown with a distinguishing feature e.g. department.
    – Steve
    Commented Nov 29, 2021 at 21:05
  • @StephenOstermiller Unfortunately, the structure of the existing membership list prohibits that. It's the method I would prefer, although that does bring its own issues where two members, husband and wife, share the same email address but have different passwords. Name, email, and password would solve the problem, but the site owners want to keep it nice and simple...
    – Ian
    Commented Nov 29, 2021 at 23:08
  • @Steve A possibility. I'll need to speak to the site owners to see whether there is any such categorisation that can be used.
    – Ian
    Commented Nov 29, 2021 at 23:09

1 Answer 1

1

I might tackle this problem by not using .htaccess and instead replace it with php code (looks better, allows more granular control and tracking of the different users. Authentication could be done using a select on both username and hashed password, although the same username weakens the hashing a bit for those users.

If you do need to use webserver based authentication, backend it with an authentication mechanism you can control. I didnt find a MySQL one that would work (although I did not look that hard) but http://mod-auth-pq-sql.sourceforge.net is a postgres module which allows you to craft an sql statement that you could code to your requirement.

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.