SID-01983: IIS TWIKI Template Login

Status:	Answered	TWiki version:	6.0.1	Perl version:	5.16.3
Category:	CategoryAuthentication	Server OS:	WIndows 7 x64	Last update:	11 years ago

Hello,

I have Twiki setup and running from the same source on both IIS 7.5 and Apache. However, the TWIKI Template Login in IIS is not functioning inline with its Apache counterpart. When attempting to login to TWIKI via the path, http://localhost:8080/twiki/tbin/login.pl/Main/WebHome (IIS) with proper credentials of a registered user, it runs through authentication successfully but does not show any user as logged in. The same login to the apache site works correctly and shows the user as logged in. I have been monitoring the two login requests via ProcMon and Fiddler but there are no differences between the two requests' HTTP request or stack. I have seen no errors exposed either.

Any ideas on how to further debug this issue? It certainly seems like an issue with establishing a session within IIS though turning the setting off does not affect the case.

Additional information

• User registration functions correctly on both sites

Related LocalSite.cfg entries:

• $TWiki::cfg{UseClientSessions} = 1;
• $TWiki::cfg{Sessions}{ExpireAfter} = 21600;
• $TWiki::cfg{Sessions}{ExpireCookiesAfter} = 0;
• $TWiki::cfg{Sessions}{IDsInURLs} = 0;
• TWiki::cfg{Sessions}{UseIPMatching} = 1;
• $TWiki::cfg{Sessions}{MapIP2SID} = 0;
• $TWiki::cfg{LoginManager} = 'TWiki::LoginManager::TemplateLogin';
• $TWiki::cfg{TemplateLogin}{PreventBrowserRememberingPassword} = 0;

-- Nolan Sedley - 2014-10-21

Discussion and Answer

I am not familiar with IIS, so I can't give you direct advise.

I recommend to add some debug statements in twiki/lib/TWiki/LoginManager/TemplateLogin.pm and twiki/lib/TWiki/LoginManager.pm. For TWiki debugging see TWikiDebugging.

-- Peter Thoeny - 2014-10-21

@PeterThoeny,

I did some debugging and came up with the following statement causing the issue : LoginManager.pm ~350

    if((! defined($authUser) ) || ($sessionUser && $sessionUser eq $TWiki::cfg{AdminUserLogin} ) ) {
        $authUser = $sessionUser;
    }

This condition is never satisfied in IIS due to the "defined()" comparison.

Assumptions : Variable $authUser is blank

APACHE

1. defined($authUser) returns "1"
2. !defined($authUser) returns "1" -- This seems wrong, shouldn't inversing the result equal 0?

IIS 7.5:

1. (defined($authUser)) returns "1"
2. !defined($authUser) returns "" -- Empty! This empty does not satisfy the condition to set the authuser

The problem here doesn't seem to be so much with the defined function as with the inverse, '!', operand. (Note I have also tried the "not" operator with the same results).

This seems most odd. Easy fix would just to say if((defined($authUser))==1) but it is worrisome that this inverse operand wasn't working as expected. Or should we move away from using "defined" for this case? From docs http://perldoc.perl.org/functions/defined.html

Many folks tend to overuse defined and are then surprised to discover that the number 0 and "" (the zero-length string) are, in fact, defined values.

Any ideas?

-- Nolan Sedley - 2014-10-27

Thanks for debugging. It is not possible to have a login name 0, so it is safe to omit the defined. Please try (! $authUser ) instead of (! defined($authUser) ).

If this works, please create a bug report at TWikibug:WebHome so that we can fix that.

-- Peter Thoeny - 2014-10-27

Thank you Nolan, this is now tracked in TWikibug:Item7584.

-- Peter Thoeny - 2014-11-14

      Change status to: Asked question Answered question Closed unanswered