# Nginx\_auth\_mysql **URL:** \ **Category:** NGINX\ **Created:** [August 9, 2010, 1:22pm UTC](https://www.ruby-forum.com/t/nginx-auth-mysql/192977 "2010-08-09T13:22:02Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Adam\_Benayoun](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/3d9bf3/32.png) [@Adam\_Benayoun](https://www.ruby-forum.com/u/Adam_Benayoun)\ **Post date:** [August 9, 2010, 1:22pm UTC](https://www.ruby-forum.com/t/nginx-auth-mysql/192977/1 "2010-08-09T13:22:02Z")
Hello all, I’m new to nginx (and first post on this mailing list),I have read the wiki and scoured the web in order to find a nginx\_mysql\_auth or nginx\_ldap\_auth module for nginx. I am migrating my servers from apache to nginx + nginx-php-fpm now this is included with php-5.3.0 and in all of theses servers I am using a centralized directory to manage access to phpmyadmin, SVN repositories and much more. Now my question is this: I haven’t been able to find anything that answer my needs, I want nginx to talk directly with mysql or ldap and the only think I’ve found is this: [http://code.svn.wordpress.org/nginx\_auth\_mysql/README](http://code.svn.wordpress.org/nginx_auth_mysql/README) Apparently the folks at wordpress have developed something based on the PAM auth module by sergio Talens-Oliag but I keep hearing that this module isn’t non-blocking and therefore might ruin my nginx performance (although on my production server, I’ll need this only to limit access to phpmyadmin and this will be accesses only few times a week apparently). Does anyone know another modules? Are new modules in the work? Can someone enlighten me if using this module will indeed ruin my nginx performance? Should I hold with switching from apache to nginx? Because managing htpasswd across more than 10 servers isn’t something I’m willing to do at this stage. Thanks a lot! ---
**Author:** ![Adam\_Benayoun](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/3d9bf3/32.png) [@Adam\_Benayoun](https://www.ruby-forum.com/u/Adam_Benayoun)\ **Post date:** [August 9, 2010, 2:24pm UTC](https://www.ruby-forum.com/t/nginx-auth-mysql/192977/2 "2010-08-09T14:24:06Z")
Hello! On Mon, Aug 09, 2010 at 02:20:44PM +0300, Adam Benayoun wrote: > I’ve found is this: > [http://code.svn.wordpress.org/nginx\_auth\_mysql/README](http://code.svn.wordpress.org/nginx_auth_mysql/README) > > Apparently the folks at wordpress have developed something based on the PAM > auth module by sergio Talens-Oliag but I keep hearing that this module isn’t > non-blocking and therefore might ruin my nginx performance (although on my > production server, I’ll need this only to limit access to phpmyadmin and > this will be accesses only few times a week apparently). Yes, it’s blocking (as well as auth pam and auth ldap modules flying around). > Does anyone know another modules? Are new modules in the work? Can someone > enlighten me if using this module will indeed ruin my nginx performance? > Should I hold with switching from apache to nginx? Because managing htpasswd > across more than 10 servers isn’t something I’m willing to do at this stage. You may want to try this one: > **[ngx\_http\_auth\_request\_module: log](http://mdounin.ru/hg/ngx_http_auth_request_module/)** It’s non-blocking and you are free to code any authentication/authorization backend. Maxim D. ---
**Author:** ![Adam\_Benayoun](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/3d9bf3/32.png) [@Adam\_Benayoun](https://www.ruby-forum.com/u/Adam_Benayoun)\ **Post date:** [August 9, 2010, 5:15pm UTC](https://www.ruby-forum.com/t/nginx-auth-mysql/192977/3 "2010-08-09T17:15:41Z")
Maxim Thanks for your answer. What I am trying to do is basically this: When a user navigate to a certain domain, a http authentication box will open and he will need to enter his username and password. Then nginx will send the following information in a header to a php script: - $username entered in auth - $password entered in auth - group provided in nginx location block The php script will in turn do the authentication against ldap and will return either 201 (success!) or 401 (try again and auth will re-open). What I don’t really get yet, and pardon me but I’m still new to nginx (and i’ve tried reading the wiki and your documentation for the module) is how to make the user go through authentication box and use the information provided in it to pass it to my php script. Basically if you could point me to a wiki or a code, that would be awesome. I also think it could be nice to open a wiki page explaining how your module can be used this way since whoever who will migrate his apache+mod\_auth\_dbm or apache+mod\_auth\_ldap configuration will mostly need that information. This question is of course addressed to anyone on this mailing list, if anyone can help, I’d be grateful. Thanks a lot! * * * Adam Benayoun | CEO / [http://www.lionite.com](http://www.lionite.com) Gtalk/MSN: removed\_email\_address@domain.invalid | Skype: adam.benayoun Cell: +(972)544835975 | Twitter: @adambn ---
**Author:** ![Adam\_Benayoun](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/3d9bf3/32.png) [@Adam\_Benayoun](https://www.ruby-forum.com/u/Adam_Benayoun)\ **Post date:** [August 10, 2010, 4:58am UTC](https://www.ruby-forum.com/t/nginx-auth-mysql/192977/4 "2010-08-10T04:58:45Z")
On Mon, Aug 9, 2010 at 8:23 PM, Maxim D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > You may want to try this one: > > [ngx\_http\_auth\_request\_module: log](http://mdounin.ru/hg/ngx_http_auth_request_module/) > > It’s non-blocking and you are free to code any > authentication/authorization backend. This auth\_request module can now be combined with our ngx\_lua module and thus can be further combined with our ngx\_drizzle module to access mysql to do the actual lookup. See the TEST 4 and TEST 5 cases in the ngx\_lua module’s test suite for sample configurations to combine ngx\_http\_auth\_request with ngx\_lua: ``` http://github.com/chaoslawful/lua-nginx-module/blob/master/t/5-throw.t#L55 ``` And see the following example (TEST 14) to capture subrequests’ responses in Lua: ``` http://github.com/chaoslawful/lua-nginx-module/blob/master/t/2-content.t#L233 ``` Cheers, -agentzh ---
**Author:** ![Adam\_Benayoun](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/3d9bf3/32.png) [@Adam\_Benayoun](https://www.ruby-forum.com/u/Adam_Benayoun)\ **Post date:** [August 9, 2010, 6:18pm UTC](https://www.ruby-forum.com/t/nginx-auth-mysql/192977/5 "2010-08-09T18:18:19Z")
> The php script will in turn do the authentication against ldap and will > return either 201 (success!) or 401 (try again and auth will re-open). If you are using just php you don’t even need to change anything (at least it works with my generic setup) within nginx configuration (unless you want to protect static content which php has no control over). The examples in [PHP: HTTP authentication with PHP - Manual](http://php.net/manual/en/features.http-auth.php) work just fine. > > I’ll need this only to limit access to phpmyadmin and this will be > > accesses only few times a week apparently). phpMyAdmin provides http authentification itself ( [auth\_types · phpmyadmin/phpmyadmin Wiki · GitHub](http://wiki.phpmyadmin.net/pma/Auth_types) ): $cfg[‘Servers’][$i][‘auth\_type’] = ‘http’; (it is still good to at least restrict IP access to the path as http auth is plain text (especially if the DB server is accessible through public networks) and the phpma has experienced some nasty exploitable bugs in past) rr ---
**Author:** ![Adam\_Benayoun](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/3d9bf3/32.png) [@Adam\_Benayoun](https://www.ruby-forum.com/u/Adam_Benayoun)\ **Post date:** [August 10, 2010, 5:11am UTC](https://www.ruby-forum.com/t/nginx-auth-mysql/192977/6 "2010-08-10T05:11:38Z")
On Tue, Aug 10, 2010 at 10:58 AM, agentzh [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > This auth\_request module can now be combined with our ngx\_lua module > and thus can be further combined with our ngx\_drizzle module to access > mysql to do the actual lookup. Forgot to mention that the mysql result set returned by ngx\_drizzle can be even further cached by ngx\_srcache + ngx\_memc + memcached (cluster!) 🙂 And…ngx\_memc can also be combined with Maxim’s ngx\_http\_upstream\_keepalive to provide memcached connection pooling 😉 Everything is non-blocking here and can be at least an order of magnitude faster than traditional solutions like PHP or Python for real world settings 🙂 Cheers, -agentzh