Open brynwhyman opened 5 years ago
A better fix would be to change the 'Allow users to use their accounts to access the UAT server' permissions flag, to 'Allow users to use their accounts to bypass basic auth' and have something like the second solution suggested.
These are two ways that developers have implemented this:
E.g.
entire_site_protected: true
entire_site_protected_code: CMS_ACCESS_CMSMain
We changed it to use the same flag that allows users access on the UAT server ('Allow users to use their accounts to access the UAT server'):
SilverStripe\Security\BasicAuth:
entire_site_protected: true
entire_site_protected_code: ACCESS_UAT_SERVER
Hi team - just giving this a bump. The old (incorrect) instructions are still on the CWP site. The second of the two solutions was the one we implemented (and which works fine), so maybe just update the docs to suggest that config?
The docs are maintained in this repo:
https://github.com/silverstripe/cwp/blob/master/docs/en/03_How_tos/basic_auth.md
We welcome any contributions to update the docs 🙂
"Enabling in production" section is outdated, and needs to be updated to reference BasicAuthMiddleware configuration instead.
https://www.cwp.govt.nz/developer-docs/en/2/how_tos/basic_auth/