Early in TWiki::new, the login manager is created. The creation of the login manager does two things:

1. If sessions are in use, it loads CGI::Session but doesn't initialise the session yet.
2. Creates the login manager object

1. Calls loginManager->getUser to get the username before the session is created
   • TWiki::Client::ApacheLogin looks at REMOTE_USER
   • TWiki::Client::TemplateLogin just returns undef
2. reads the TWIKISID cookie to get the SID (or the TWIKISID parameters in the CGI query if cookies aren't available, or IP2SID? mapping if that's enabled).
3. Creates the CGI::Session object, and the session is thereby read.
4. If the username still isn't known, reads it from the cookie. Thus TWiki::Client::ApacheLogin overrides the cookie using REMOTE_USER, and TWiki::Client::TemplateLogin always uses the session.

Later again in TWiki::new, plugins are given a chance to override the username found from the loginManager.

The last step in TWiki::new is to find the user, using whatever user mapping manager is in place.

StaticMethod makeLoginManager ($twiki) -> $TWiki::Client

ObjectMethod loadSession ($defaultUser) -> $login

ObjectMethod clearSessionValue ($name) -> $boolean

ObjectData? twiki

Package TWiki::Client

The package is also a Factory for login managers and also the base class for all login managers.

On it's own, an object of this class is used when you specify 'none' in the security setup section of configure. When it is used, logins are not supported. If you want to authenticate users then you should consider TemplateLogin? or ApacheLogin? , which are subclasses of this class.

If you are building a new login manager, then you should write a new subclass of this class, implementing the methods marked as VIRTUAL. There are already examples in the lib/TWiki/Client directory.

StaticMethod makeClient ($twiki) -> $TWiki::Client

ObjectMethod loadSession ()

Get the client session data, using the cookie and/or the request URL. Set up appropriate session variables in the twiki object and return the login name.

ObjectMethod checkAccess ()

ObjectMethod finish

StaticMethod expireDeadSessions ()

This is a static method, but requires TWiki::cfg. It is designed to be run from a session or from a cron job.

ObjectMethod userLoggedIn ($login,$wikiname)

Called when the user logs in. It's invoked from TWiki::UI::Register::finish for instance, when the user follows the link in their verification email message.

• $login - string login name
• $wikiname - string wikiname

ObjectMethod endRenderingHandler ()

DEPRECATED Use postRenderingHandler instead.

ObjectMethod addCookie ($c)

Add a cookie to the list of cookies for this session.

• $c - a CGI::Cookie

ObjectMethod modifyHeader (\%header)

• \%header - header entries

ObjectMethod redirectCgiQuery ($url)

• $url - target of the redirection.

ObjectMethod getSessionValues () -> \%values

ObjectMethod getSessionValue ($name) -> $value

ObjectMethod setSessionValue ($name,$value)

ObjectMethod clearSessionValue ($name)

ObjectMethod forceAuthentication () -> boolean

VIRTUAL METHOD implemented by subclasses

Triggered by an access control violation, this method tests to see if the current session is authenticated or not. If not, it does whatever is needed so that the user can log in, and returns 1.

If the user has an existing authenticated session, the function simply drops though and returns 0.

ObjectMethod loginUrl (...) -> $url

VIRTUAL METHOD implemented by subclasses

Return a full URL suitable for logging in.

• ... - url parameters to be added to the URL, in the format required by TWiki::getScriptUrl()

ObjectMethod getUser ()

VIRTUAL METHOD implemented by subclasses

If there is some other means of getting a username - for example, Apache has remote_user() - then return it. Otherwise, return undef and the username stored in the session will be used.