phpBB Shibboleth modification

I have created a modification for phpBB which supports Shibboleth authentication. The source code is here: phpbb_shib_1_2.tgz.

It supports lazy sessions, so users can browse forums anonymously until they want to post a replay or start a new topic, then they must authenticate.

The personal attributes provided by Shibboleth can be stored in custom profile fields, which can be made non-editable by users, so the real identity of users can be displayed. The name and home organization of each user are also set as the default user signature.

phpBB is a popular discussion forum implementation in PHP. It supports authentication plugins, where three of them are part of the standard download - DB, LDAP and Apache. The DB is the one used by default, it stores usernames and passwords in a database. LDAP works like the DB plugin, just the usernames and passwords are looked up in a LDAP server. The Apache plugin is different, it assumes that Apache is set up so that only authenticated users can access phpBB pages, so it registers users automatically.

Shibboleth is a middleware for user authentication based on federated identity - that is, users authenticate with their home institutions, not with the websites. It is basically a plugin for Apache and an associated daemon "shibd". Shibboleth provides attributes about users, like an ID, full name, email etc.

Writing the Shibboleth authentication plugin for phpBB was not straightforward, as Shibboleth does not provide a password as the DB and LDAP plugins, and it does not authenticate always all users, like the Apache authentication plugin, because Shibboleth allows so called lazy sessions, where users get authenticated only when they need to do some operations, like to write something. So the solution was to write a plugin that provides a registration page, but that page has no form, only a link to a special URL which triggers Shibboleth authentication. That is why an authentication plugin was not enough, several other files needed to be modified as well.

The source tarball contains all the needed changes together with a README file describing what the changes do.

Martin Kuba (Makub)

Valid XHTML 1.1! Valid CSS!