Kitto.Auth.TextFile

Defines the file-based authenticator and related classes and services.

This authenticator uses an external file containing user names and password hashes to authenticate users.

TKTextFileAuthenticator class

The TextFile authenticator uses an external text file to authenticate users. The file should have a line for each user, in the format:

<user name>=<password hash>

By convention, a # character at the beginning of a line disables a user. All lines beginning with # are ignored by the authenticator.

The authenticator needs the same auth items as its ancestor TKClassicAuthenticator.

In order for this authenticator to work, it is required that the following file exists:

%HOME_PATH%FileAuthenticator.txt

You can override the file name by means of the FileName parameter (may contain macros).

When Authenticate is called, the authenticator fetches the file data (which is not cached, meaning it is read anew at every authentication request) and check the supplied credentials against the user name and relevant password MD5 hash.

Parameters:

• IsClearPassword Set this item to true to signify that the password is stored in clear, and not hashed, in the external file. Default False.
• FileName Overrides the predefined user list file name. May contain macros.

function SupportsPasswordChange: Boolean;

The user list is a read-only text file of name=hash pairs: there is no write path, so a password cannot be changed or reset from here. The three members below are implemented rather than left abstract because abstract members of a factory-created class do not fail at build time: they raise "Abstract Error" the first time a user reaches the feature.

procedure ResetPassword(const AParams: TEFNode);

Raises: the user list file is edited by hand, not rewritten by the application, so there is nowhere to store a new password.

procedure QRGenerate(const AParams: TEFNode);

Raises: the file format carries no per-user TOTP secret.

function IsPasswordMatching(const ASuppliedPasswordHash: string;

Always False, and never reached: InternalAuthenticate compares against the user list inline, and the password-change flow is refused by SupportsPasswordChange before it gets here.