Provided by: libcgi-application-plugin-authentication-perl_0.21-2_all bug

NAME

       CGI::Application::Plugin::Authentication - Authentication framework for CGI::Application

SYNOPSIS

        package MyCGIApp;

        use base qw(CGI::Application); # make sure this occurs before you load the plugin

        use CGI::Application::Plugin::Authentication;

        MyCGIApp->authen->config(
              DRIVER => [ 'Generic', { user1 => '123' } ],
        );
        MyCGIApp->authen->protected_runmodes('myrunmode');

        sub myrunmode {
           my $self = shift;

           # The user should be logged in if we got here
           my $username = $self->authen->username;

        }

DESCRIPTION

       CGI::Application::Plugin::Authentication adds the ability to authenticate users in your
       CGI::Application modules.  It imports one method called 'authen' into your
       CGI::Application module.  Through the authen method you can call all the methods of the
       CGI::Application::Plugin::Authentication plugin.

       There are two main decisions that you need to make when using this module.  How will the
       usernames and password be verified (i.e. from a database, LDAP, etc...), and how can we
       keep the knowledge that a user has already logged in persistent, so that they will not
       have to enter their credentials again on the next request (i.e. how do we 'Store' the
       authentication information across requests).

   Choosing a Driver
       There are three drivers that are included with the distribution.  Also, there is built in
       support for all of the Authen::Simple modules (search CPAN for Authen::Simple for more
       information).  This should be enough to cover everyone's needs.

       If you need to authenticate against a source that is not provided, you can use the Generic
       driver which will accept either a hash of username/password pairs, or an array of arrays
       of credentials, or a subroutine reference that can verify the credentials.  So through the
       Generic driver you should be able to write your own verification system.  There is also a
       Dummy driver, which blindly accepts any credentials (useful for testing).  See the
       CGI::Application::Plugin::Authentication::Driver::Generic,
       CGI::Application::Plugin::Authentication::Driver::DBI and,
       CGI::Application::Plugin::Authentication::Driver::Dummy docs for more information on how
       to use these drivers.  And see the Authen::Simple suite of modules for information on
       those drivers.

   Choosing a Store
       The Store modules keep information about the authentication status of the user persistent
       across multiple requests.  The information that is stored in the store include the
       username, and the expiry time of the login.  There are two Store modules included with
       this distribution.  A Session based store, and a Cookie based store.  If your application
       is already using Sessions (through the CGI::Application::Plugin::Session module), then I
       would recommend that you use the Session store for authentication.  If you are not using
       the Session plugin, then you can use the Cookie store.  The Cookie store keeps all the
       authentication in a cookie, which contains a checksum to ensure that users can not change
       the information.

       If you do not specify which Store module you wish to use, the plugin will try to determine
       the best one for you.

   Login page
       The Authentication plugin comes with a default login page that can be used if you do not
       want to create a custom login page.  This login form will automatically be used if you do
       not provide either a LOGIN_URL or LOGIN_RUNMODE parameter in the configuration.  If you
       plan to create your own login page, I would recommend that you start with the HTML code
       for the default login page, so that your login page will contain the correct form fields
       and hidden fields.

   Ticket based authentication
       This Authentication plugin can handle ticket based authentication systems as well.  All
       that is required of you is to write a Store module that can understand the contents of the
       ticket.  The Authentication plugin will require at least the 'username' to be retrieved
       from the ticket.  A Ticket based authentication scheme will not need a Driver module at
       all, since the actual verification of credentials is done by an external authentication
       system, possibly even on a different host.  You will need to specify the location of the
       login page using the LOGIN_URL configuration variable, and unauthenticated users will
       automatically be redirected to your ticket authentication login page.

EXPORTED METHODS

   authen
       This is the only method exported from this module.  Everything is controlled through this
       method call, which will return a CGI::Application::Plugin::Authentication object, or just
       the class name if called as a class method.  When using the plugin, you will always first
       call $self->authen or __PACKAGE__->authen and then the method you wish to invoke.  For
       example:

         __PACKAGE__->authen->config(
               LOGIN_RUNMODE => 'login',
         );

       - or -

         $self->authen->protected_runmodes(qw(one two));

METHODS

   config
       This method is used to configure the CGI::Application::Plugin::Authentication module.  It
       can be called as an object method, or as a class method. Calling this function, will not
       itself generate cookies or session ids.

       The following parameters are accepted:

       DRIVER
           Here you can choose which authentication module(s) you want to use to perform the
           authentication.  For simplicity, you can leave off the
           CGI::Application::Plugin::Authentication::Driver:: part when specifying the DRIVER
           name  If this module requires extra parameters, you can pass an array reference that
           contains as the first parameter the name of the module, and the rest of the values in
           the array will be considered options for the driver.  You can provide multiple drivers
           which will be used, in order, to check the credentials until a valid response is
           received.

                DRIVER => 'Dummy' # let anyone in regardless of the password

             - or -

                DRIVER => [ 'DBI',
                    DBH         => $self->dbh,
                    TABLE       => 'user',
                    CONSTRAINTS => {
                        'user.name'         => '__CREDENTIAL_1__',
                        'MD5:user.password' => '__CREDENTIAL_2__'
                    },
                ],

             - or -

                DRIVER => [
                    [ 'Generic', { user1 => '123' } ],
                    [ 'Generic', sub { my ($u, $p) = @_; is_prime($p) ? 1 : 0 } ]
                ],

             - or -

                DRIVER => [ 'Authen::Simple::LDAP',
                    host   => 'ldap.company.com',
                    basedn => 'ou=People,dc=company,dc=net'
                ],

       STORE
           Here you can choose how we store the authenticated information after a user has
           successfully logged in.  We need to store the username so that on the next request we
           can tell the user has already logged in, and we do not have to present them with
           another login form.  If you do not provide the STORE option, then the plugin will look
           to see if you are using the CGI::Application::Plugin::Session module and based on that
           info use either the Session module, or fall back on the Cookie module.  If the module
           requires extra parameters, you can pass an array reference that contains as the first
           parameter the name of the module, and the rest of the array should contain key value
           pairs of options for this module.  These storage modules generally live under the
           CGI::Application::Plugin::Authentication::Store:: name-space, and this part of the
           package name can be left off when specifying the STORE parameter.

               STORE => 'Session'

             - or -

               STORE => ['Cookie',
                   NAME   => 'MYAuthCookie',
                   SECRET => 'FortyTwo',
                   EXPIRY => '1d',
               ]

       POST_LOGIN_RUNMODE
           Here you can specify a runmode that the user will be redirected to if they
           successfully login.

             POST_LOGIN_RUNMODE => 'welcome'

       POST_LOGIN_URL
           Here you can specify a URL that the user will be redirected to if they successfully
           login.  If both POST_LOGIN_URL and POST_LOGIN_RUNMODE are specified, then the latter
           will take precedence.

             POST_LOGIN_URL => 'http://example.com/start.cgi'

       POST_LOGIN_CALLBACK
           A code reference that is executed after login processing but before POST_LOGIN_RUNMODE
           or redirecting to POST_LOGIN_URL. This is normally a method in your CGI::Application
           application and as such the CGI::Application object is passed as a parameter.

             POST_LOGIN_CALLBACK => \&update_login_date

           and later in your code:

             sub update_login_date {
               my $self = shift;

               return unless($self->authen->is_authenticated);

               ...
             }

       LOGIN_RUNMODE
           Here you can specify a runmode that the user will be redirected to if they need to
           login.

             LOGIN_RUNMODE => 'login'

       LOGIN_URL
           If your login page is external to this module, then you can use this option to specify
           a URL that the user will be redirected to when they need to login. If both LOGIN_URL
           and LOGIN_RUNMODE are specified, then the latter will take precedence.

             LOGIN_URL => 'http://example.com/login.cgi'

       LOGOUT_RUNMODE
           Here you can specify a runmode that the user will be redirected to if they ask to
           logout.

             LOGOUT_RUNMODE => 'logout'

       LOGOUT_URL
           If your logout page is external to this module, then you can use this option to
           specify a URL that the user will be redirected to when they ask to logout.  If both
           LOGOUT_URL and LOGOUT_RUNMODE are specified, then the latter will take precedence.

             LOGIN_URL => 'http://example.com/logout.html'

       DETAINT_URL_REGEXP
           This is a regular expression used to detaint URLs used in the login form. By default
           it will be set to

             ^([\w\_\%\?\&\;\-\/\@\.\+\$\=\#\:\!\*\"\'\(\)\,]+)$

           This regular expression is based upon the document
           http://www.w3.org/Addressing/URL/url-spec.txt. You could set it to a more specific
           regular expression to limit the domains to which users could be directed.

       DETAINT_USERNAME_REGEXP
           This is a regular expression used to detaint the username parameter used in the login
           form. By default it will be set to

             ^([\w\_]+)$

       CREDENTIALS
           Set this to the list of form fields where the user will type in their username and
           password.  By default this is set to ['authen_username', 'authen_password'].  The form
           field names should be set to a value that you are not likely to use in any other
           forms.  This is important because this plugin will automatically look for query
           parameters that match these values on every request to see if a user is trying to log
           in.  So if you use the same parameter names on a user management page, you may
           inadvertently perform a login when that was not intended.  Most of the Driver modules
           will return the first CREDENTIAL as the username, so make sure that you list the
           username field first.  This option can be ignored if you use the built in login box

             CREDENTIALS => 'authen_password'

             - or -

             CREDENTIALS => [ 'authen_username', 'authen_domain', 'authen_password' ]

       LOGIN_SESSION_TIMEOUT
           This option can be used to tell the system when to force the user to re-authenticate.
           There are a few different possibilities that can all be used concurrently:

           IDLE_FOR
               If this value is set, a re-authentication will be forced if the user was idle for
               more then x amount of time.

           EVERY
               If this value is set, a re-authentication will be forced every x amount of time.

           CUSTOM
               This value can be set to a subroutine reference that returns true if the session
               should be timed out, and false if it is still active.  This can allow you to be
               very selective about how the timeout system works.  The authen object will be
               passed in as the only parameter.

           Time values are specified in seconds. You can also specify the time by using a number
           with the following suffixes (m h d w), which represent minutes, hours, days and weeks.
           The default is 0 which means the login will never timeout.

           Note that the login is also dependent on the type of STORE that is used.  If the
           Session store is used, and the session expires, then the login will also automatically
           expire.  The same goes for the Cookie store.

           For backwards compatibility, if you set LOGIN_SESSION_TIMEOUT to a time value instead
           of a hashref, it will be treated as an IDLE_FOR time out.

             # force re-authentication if idle for more than 15 minutes
             LOGIN_SESSION_TIMEOUT => '15m'

             # Everyone must re-authentication if idle for more than 30 minutes
             # also, everyone must re-authentication at least once a day
             # and root must re-authentication if idle for more than 5 minutes
             LOGIN_SESSION_TIMEOUT => {
                   IDLE_FOR => '30m',
                   EVERY    => '1d',
                   CUSTOM   => sub {
                     my $authen = shift;
                     return ($authen->username eq 'root' && (time() - $authen->last_access) > 300) ? 1 : 0;
                   }
             }

       RENDER_LOGIN
           This value can be set to a subroutine reference that returns the HTML of a login form.
           The subroutine reference overrides the default call to login_box.  The subroutine is
           normally a method in your CGI::Application application and as such the
           CGI::Application object is passed as the first parameter.

             RENDER_LOGIN => \&login_form

           and later in your code:

             sub login_form {
               my $self = shift;

               ...
               return $html
             }

       LOGIN_FORM
           You can set this option to customize the login form that is created when a user needs
           to be authenticated.  If you wish to replace the entire login form with a completely
           custom version, then just set LOGIN_RUNMODE to point to your custom runmode.

           All of the parameters listed below are optional, and a reasonable default will be used
           if left blank:

           DISPLAY_CLASS (default: Classic)
               the class used to display the login form. The alternative is "Basic" which aims
               for XHTML compliance and leaving style to CSS. See
               CGI::Application::Plugin::Authentication::Display for more details.

           TITLE (default: Sign In)
               the heading at the top of the login box

           USERNAME_LABEL (default: User Name)
               the label for the user name input

           PASSWORD_LABEL (default: Password)
               the label for the password input

           SUBMIT_LABEL (default: Sign In)
               the label for the submit button

           COMMENT (default: Please enter your username and password in the fields below.)
               a message provided on the first login attempt

           REMEMBERUSER_OPTION (default: 1)
               provide a checkbox to offer to remember the users name in a cookie so that their
               user name will be pre-filled the next time they log in

           REMEMBERUSER_LABEL (default: Remember User Name)
               the label for the remember user name checkbox

           REMEMBERUSER_COOKIENAME (default: CAPAUTHTOKEN)
               the name of the cookie where the user name will be saved

           REGISTER_URL (default: <none>)
               the URL for the register new account link

           REGISTER_LABEL (default: Register Now!)
               the label for the register new account link

           FORGOTPASSWORD_URL (default: <none>)
               the URL for the forgot password link

           FORGOTPASSWORD_LABEL (default: Forgot Password?)
               the label for the forgot password link

           INVALIDPASSWORD_MESSAGE (default: Invalid username or password<br />(login attempt %d)
               a message given when a login failed

           INCLUDE_STYLESHEET (default: 1)
               use this to disable the built in style-sheet for the login box so you can provide
               your own custom styles

           FORM_SUBMIT_METHOD (default: post)
               use this to get the form to submit using 'get' instead of 'post'

           FOCUS_FORM_ONLOAD (default: 1)
               use this to automatically focus the login form when the page loads so a user can
               start typing right away.

           BASE_COLOUR (default: #445588)
               This is the base colour that will be used in the included login box.  All other
               colours are automatically calculated based on this colour (unless you hardcode the
               colour values).  In order to calculate other colours, you will need the
               Color::Calc module.  If you do not have the Color::Calc module, then you will need
               to use fixed values for all of the colour options.  All colour values besides the
               BASE_COLOUR can be simple percentage values (including the % sign).  For example
               if you set the LIGHTER_COLOUR option to 80%, then the calculated colour will be
               80% lighter than the BASE_COLOUR.

           LIGHT_COLOUR (default: 50% or #a2aac4)
               A colour that is lighter than the base colour.

           LIGHTER_COLOUR (default: 75% or #d0d5e1)
               A colour that is another step lighter than the light colour.

           DARK_COLOUR (default: 30% or #303c5f)
               A colour that is darker than the base colour.

           DARKER_COLOUR (default: 60% or #1b2236)
               A colour that is another step darker than the dark colour.

           GREY_COLOUR (default: #565656)
               A grey colour that is calculated by desaturating the base colour.

   protected_runmodes
       This method takes a list of runmodes that are to be protected by authentication.  If a
       user tries to access one of these runmodes, then they will be redirected to a login page
       unless they are properly logged in.  The runmode names can be a list of simple strings,
       regular expressions, or special directives that start with a colon.  This method is
       cumulative, so if it is called multiple times, the new values are added to existing
       entries.  It returns a list of all entries that have been saved so far.  Calling this
       function, will not itself generate cookies or session ids.

       :all - All runmodes in this module will require authentication

         # match all runmodes
         __PACKAGE__->authen->protected_runmodes(':all');

         # only protect runmodes one two and three
         __PACKAGE__->authen->protected_runmodes(qw(one two three));

         # protect only runmodes that start with auth_
         __PACKAGE__->authen->protected_runmodes(qr/^auth_/);

         # protect all runmodes that *do not* start with public_
         __PACKAGE__->authen->protected_runmodes(qr/^(?!public_)/);

   is_protected_runmode
       This method accepts the name of a runmode, and will tell you if that runmode is a
       protected runmode (i.e. does a user need to be authenticated to access this runmode).
       Calling this function, will not itself generate cookies or session ids.

   redirect_after_login
       This method is be called during the prerun stage to redirect the user to the page that has
       been configured as the destination after a successful login.  The location is determined
       as follows:

       POST_LOGIN_RUNMODE
           If the POST_LOGIN_RUNMODE config parameter is set, that run mode will be the chosen
           location.

       POST_LOGIN_URL
           If the above fails and the POST_LOGIN_URL config parameter is set, then there will be
           a 302 redirection to that location.

       destination
           If the above fails and there is a destination query parameter, which must a taint
           check against the DETAINT_URL_REGEXP config parameter, then there will be a 302
           redirection to that location.

       original destination
           If all the above fail then there the originally requested page will be delivered.

   redirect_to_login
       This method is be called during the prerun stage if the current user is not logged in, and
       they are trying to access a protected runmode.  It will redirect to the page that has been
       configured as the login page, based on the value of LOGIN_RUNMODE or LOGIN_URL  If nothing
       is configured a simple login page will be automatically provided.

   redirect_to_logout
       This method is called during the prerun stage if the user has requested to be logged out.
       It will redirect to the page that has been configured as the logout page, based on the
       value of LOGOUT_RUNMODE or LOGOUT_URL  If nothing is configured, the page will redirect to
       the website homepage.

   setup_runmodes
       This method is called during the prerun stage to register some custom runmodes that the
       Authentication plugin requires in order to function.  Calling this function, will not
       itself generate cookies or session ids.

   last_login
       This will return return the time of the last login for this user

         my $last_login = $self->authen->last_login;

       This function will initiate a session or cookie if one has not been created already.

   last_access
       This will return return the time of the last access for this user

         my $last_access = $self->authen->last_access;

       This function will initiate a session or cookie if one has not been created already.

   is_login_timeout
       This will return true or false depending on whether the users login status just timed out

         $self->add_message('login session timed out') if $self->authen->is_login_timeout;

       This function will initiate a session or cookie if one has not been created already.

   is_authenticated
       This will return true or false depending on the login status of this user

         assert($self->authen->is_authenticated); # The user should be logged in if we got here

       This function will initiate a session or cookie if one has not been created already.

   login_attempts
       This method will return the number of failed login attempts have been made by this user
       since the last successful login.  This is not a number that can be trusted, as it is
       dependent on the underlying store to be able to return the correct value for this user.
       For example, if the store uses a cookie based session, the user trying to login could
       delete their cookies, and hence get a new session which will not have any login attempts
       listed.  The number will be cleared upon a successful login.  This function will initiate
       a session or cookie if one has not been created already.

   username
       This will return the username of the currently logged in user, or undef if no user is
       currently logged in.

         my $username = $self->authen->username;

       This function will initiate a session or cookie if one has not been created already.

   is_new_login
       This will return true or false depending on if this is a fresh login

         $self->log->info("New Login") if $self->authen->is_new_login;

       This function will initiate a session or cookie if one has not been created already.

   credentials
       This method will return the names of the form parameters that will be looked for during a
       login.  By default they are authen_username and authen_password, but these values can be
       changed by supplying the CREDENTIALS parameters in the configuration. Calling this
       function, will not itself generate cookies or session ids.

   logout
       This will attempt to logout the user.  If during a request the Authentication module sees
       a parameter called 'authen_logout', it will automatically call this method to log out the
       user.

         $self->authen->logout();

       This function will initiate a session or cookie if one has not been created already.

   drivers
       This method will return a list of driver objects that are used for verifying the login
       credentials. Calling this function, will not itself generate cookies or session ids.

   store
       This method will return a store object that is used to store information about the status
       of the authentication across multiple requests.  This function will initiate a session or
       cookie if one has not been created already.

   initialize
       This does most of the heavy lifting for the Authentication plugin.  It will check to see
       if the user is currently attempting to login by looking for the credential form fields in
       the query object.  It will load the required driver objects and authenticate the user.  It
       is OK to call this method multiple times as it checks to see if it has already been
       executed and will just return without doing anything if called multiple times.  This
       allows us to call initialize as late as possible in the request so that no unnecessary
       work is done.

       The user will be logged out by calling the "logout()" method if the login session has been
       idle for too long, if it has been too long since the last login, or if the login has timed
       out.  If you need to know if a user was logged out because of a time out, you can call the
       "is_login_timeout" method.

       If all goes well, a true value will be returned, although it is usually not necessary to
       check.

       This function will initiate a session or cookie if one has not been created already.

   display
       This method will return the CGI::Application::Plugin::Authentication::Display object,
       creating and caching it if necessary.

   login_box
       This method will return the HTML for a login box that can be embedded into another page.
       This is the same login box that is used in the default authen_login runmode that the
       plugin provides.

       This function will initiate a session or cookie if one has not been created already.

   new
       This method creates a new CGI::Application::Plugin::Authentication object.  It requires as
       it's only parameter a CGI::Application object.  This method should never be called
       directly, since the 'authen' method that is imported into the CGI::Application module will
       take care of creating the CGI::Application::Plugin::Authentication object when it is
       required. Calling this function, will not itself generate cookies or session ids.

   instance
       This method works the same way as 'new', except that it returns the same Authentication
       object for the duration of the request.  This method should never be called directly,
       since the 'authen' method that is imported into the CGI::Application module will take care
       of creating the CGI::Application::Plugin::Authentication object when it is required.
       Calling this function, will not itself generate cookies or session ids.

CGI::Application CALLBACKS

   prerun_callback
       This method is a CGI::Application prerun callback that will be automatically registered
       for you if you are using CGI::Application 4.0 or greater.  If you are using an older
       version of CGI::Application you will have to create your own cgiapp_prerun method and make
       sure you call this method from there.

        sub cgiapp_prerun {
           my $self = shift;

           $self->CGI::Application::Plugin::Authentication::prerun_callback();
        }

CGI::Application RUNMODES

   authen_login_runmode
       This runmode is provided if you do not want to create your own login runmode.  It will
       display a simple login form for the user, which can be replaced by assigning RENDER_LOGIN
       a coderef that returns the HTML.

   authen_dummy_redirect
       This runmode is provided for convenience when an external redirect needs to be done.  It
       just returns an empty string.

EXAMPLE

       In a CGI::Application module:

         use base qw(CGI::Application);
         use CGI::Application::Plugin::AutoRunmode;
         use CGI::Application::Plugin::Session;
         use CGI::Application::Plugin::Authentication;

         __PACKAGE__->authen->config(
               DRIVER         => [ 'Generic', { user1 => '123' } ],
               STORE          => 'Session',
               LOGOUT_RUNMODE => 'start',
         );
         __PACKAGE__->authen->protected_runmodes(qr/^auth_/, 'one');

         sub start : RunMode {
           my $self = shift;

         }

         sub one : RunMode {
           my $self = shift;

           # The user will only get here if they are logged in
         }

         sub auth_two : RunMode {
           my $self = shift;

           # This is also protected because of the
           # regexp call to protected_runmodes above
         }

COMPATIBILITY WITH CGI::Application::Plugin::ActionDispatch

       The prerun callback has been modified so that it will check for the presence of a prerun
       mode.  This is for compatibility with CGI::Application::Plugin::ActionDispatch. This
       change should be considered experimental. It is necessary to load the ActionDispatch
       module so that the two prerun callbacks will be called in the correct order.

RECOMMENDED USAGE

       CSS The best practice nowadays is generally considered to be to not have CSS embedded in
           HTML. Thus it should be best to set LOGIN_FORM -> DISPLAY_CLASS to 'Basic'.

       Post login destination
           Of the various means of selecting a post login destination the most secure would seem
           to be POST_LOGIN_URL. The "destination" parameter could potentially be hijacked by
           hackers.  The POST_LOGIN_RUNMODE parameter requires a hidden parameter that could
           potentially be hijacked.

       Taint mode
           Do run your code under taint mode. It should help protect your application against a
           number of attacks.

       URL and username checking
           Please set the "DETAINT_URL_REGEXP" and "DETAINT_USERNAME_REGEXP" parameters as
           tightly as possible. In particular you should prevent the destination parameter being
           used to redirect authenticated users to external sites; unless of course that is what
           you want in which case that site should be the only possible external site.

       The login form
           The HTML currently generated does not seem to be standards compliant as per RT bug
           58023. Also the default login form includes hidden forms which could conceivably be
           hijacked.  Set LOGIN_FORM -> DISPLAY_CLASS to 'Basic' to fix this.

TODO

       There are lots of things that can still be done to improve this plugin.  If anyone else is
       interested in helping out feel free to dig right in.  Many of these things don't need my
       input, but if you want to avoid duplicated efforts, send me a note, and I'll let you know
       of anyone else is working in the same area.

       review the code for security bugs and report
       complete the separation of presentation and logic
       write a tutorial
       build more Drivers (Class::DBI, LDAP, Radius, etc...)
       Add support for method attributes to identify runmodes that require authentication
       finish the test suite
       provide more example code
       clean up the documentation
       build a DB driver that builds it's own table structure.  This can be used by people that
       don't have their own user database to work with, and could include a simple user
       management application.

BUGS

       This is alpha software and as such, the features and interface are subject to change.  So
       please check the Changes file when upgrading.

       Some of the test scripts appear to be incompatible with versions of Devel::Cover later
       than 0.65.

SEE ALSO

       CGI::Application, perl(1)

AUTHOR

       Author: Cees Hek <ceeshek@gmail.com>; Co-maintainer: Nicholas Bamber
       <nicholas@periapt.co.uk>.

CREDITS

       Thanks to SiteSuite <http://www.sitesuite.com.au> for funding the development of this
       plugin and for releasing it to the world.

       Thanks to Christian Walde for suggesting changes to fix the incompatibility with
       CGI::Application::Plugin::ActionDispatch and for help with github.

       Thanks to Alexandr Ciornii for pointing out some typos.

LICENCE AND COPYRIGHT

       Copyright (c) 2005, SiteSuite. All rights reserved.  Copyright (c) 2010, Nicholas Bamber.
       (Portions of the code).

       This module is free software; you can redistribute it and/or modify it under the same
       terms as Perl itself.

       The background images in the default login forms are used courtesy of www.famfamfam.com
       <http://www.famfamfam.com/lab/icons/silk/>. Those icons are issued under the Creative
       Commons Attribution 3.0 License <http://creativecommons.org/licenses/by/3.0/>.  Those
       icons are copyrighted 2006 by Mark James <mjames at gmail dot com>

DISCLAIMER OF WARRANTY

       BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE,
       TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE
       COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF
       ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO
       THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE
       DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION.

       IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT
       HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY
       THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL,
       INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
       SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR
       LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY
       OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
       SUCH DAMAGES.

perl v5.26.1                                2018-01-CGI::Application::Plugin::Authentication(3pm)