Authenticator

We expect Kimai v2 to be in a stable feature state by mid of 2019. Consider upgrading to v2, as our support for v1 will slowly expire until end of 2019.

By default kimai uses its internal user management, where users and passwords are stored in the Kimai database. But there are more authenticators, which can be used to connect to existing user repositories.

Configuration

The authenticator that will be used is configured in includes/auth.php within the key $authenticator.

$authenticator = 'kimai';

kimai is the last part of the classname without the namespace and the first character in lowercase. For example “ldap” comes from Kimai_Auth_Ldap: remove Kimai_Auth_ and lowercase the first character in the word “ldap”.

If the used authenticator supports configuration parameters, you can set those with the file includes/auth.php (supported since Kimai > 1.0.1).

Therefor you need to create the file includes/auth.php with the content:

<?php
return array(
    'key_1' => 'value',
    'key_2' => 'value',
);

Set the parameters according to the authenticator documentation below (‘key_1’ and ‘key_2’ can be safely removed, they are just examples for the structure of the file).

If you use Kimai 1.0.1 or lower, you have to set these Configuration-parameters in the PHP files directly, for example in the LDAP class here.

Kimai

The built-in authenticator, using the Kimai database.

Change $authenticator = "kimai"; in includes/autoconf.php

It has no configuration parameters and is working out-of-the-box.

HTTP

A Basic-Auth authenticator

Change $authenticator = "http"; in includes/autoconf.php
create .htaccess

AuthType Basic
AuthName "kimai"
AuthUserFile  /absolute/path/to/.htpasswd
Require valid-user

Create a .htpasswd file online generator
Login with http://admin:changeme@kimai.localhost/index.php

Configuration-parameters

HTAUTH_ALLOW_AUTOLOGIN: Set true to allow web server authorized automatic logins
HTAUTH_FORCE_USERNAME_LOWERCASE: Set true to search for lower-case usernames only
HTAUTH_USER_AUTOCREATE: Set true to create Kimai user for web server authorized users
HTAUTH_PHP_AUTH_USER: Check for PHP_AUTH_USER server variable
HTAUTH_REMOTE_USER: Check for REMOTE_USER server variable
HTAUTH_REDIRECT_REMOTE_USER: Check for REDIRECT_REMOTE_USER server variable

Default settings and full example for includes/auth.php:

<?php
return array(
    'HTAUTH_ALLOW_AUTOLOGIN' => true,
    'HTAUTH_FORCE_USERNAME_LOWERCASE' => false,
    'HTAUTH_USER_AUTOCREATE' => false,
    'HTAUTH_PHP_AUTH_USER' => false,
    'HTAUTH_REMOTE_USER' => true,
    'HTAUTH_REDIRECT_REMOTE_USER' => false,
);

LDAP

Basic LDAP authenticator.

Change $authenticator = "ldap"; in includes/autoconf.php

Configuration-parameters

LDAP_SERVER: URL of your LDAP-Server
LDAP_FORCE_USERNAME_LOWERCASE: Case-insensitivity of some server may confuse the case-sensitive-accounting system
LDAP_USERNAME_PREFIX: Prefix for user LDAP query
LDAP_USERNAME_POSTFIX: Postfix for user LDAP query
LDAP_LOCAL_ACCOUNTS: Accounts that should be locally verified
LDAP_USER_AUTOCREATE: Automatically create a user in Kimai after successful login

Default settings and full example for includes/auth.php:

<?php
return array(
    'LDAP_SERVER' => 'ldap://localhost',
    'LDAP_FORCE_USERNAME_LOWERCASE' => true,
    'LDAP_USERNAME_PREFIX' => 'cn=',
    'LDAP_USERNAME_POSTFIX' => ',dc=example,dc=com',
    'LDAP_LOCAL_ACCOUNTS' => array('admin'),
    'LDAP_USER_AUTOCREATE' => true,
);

Advanced LDAP-Authentication

An advanced LDAP authenticator, that allows further configuration options.

Change $authenticator = "ldapadvanced"; in includes/autoconf.php

Configuration-parameters

host: This is the URI to connect with your LDAP-Server. This can be something like ldap://ldap.example.com or ldaps://ldap.example.com:1234
bindDN: This is the DN of a user with read access to the LDAP. Leave empty when your LDAP supports anonymous bind
bindPW: the password for the user with read access to the LDAP. Leave empty also for anonymous bind
searchBase: Where do your searches start in the ldap. This is normaly something like o=example,c=org
userFilter: What filter shall be used to search for a user. The string %1$s will be replaced with what the user entered as login name. You can use that string multiple times to enable login by UID and email. The filter would then be (|(uid=%1$s)(mail=%1$s))
groupFilter: What filter shall be used to heck for group memberships. The string %1$s will be replaced by the value of the attribute defined by usernameAttribute of the user-entry. The string %2$s will be replaced by the DN of the users entry;
usernameAttribute: The attribute to be sed to check for group memberships as well as retrieving the username to be used by kimai
commonNameAttribute: This attribute defines the alias of the user in kimai
groupidAttribute: This attribute contains the value that is represented in the allowedGroupIds
mailAttribute: This attribute holds the users email-address that will be ported to kimai
allowedGroupIds: An array of values defined by groupidAttribute. Members of the LDAP-groups referenced here will be allowed access to kimai!
forceLowercase: Whether the username for kimai shall be lowercased or not.
nonLdapAcounts: A list of kimai-usernames that shall not be autehnticated via LDAP but via the default kimai-authentication-adapter
autocreateUsers: Shall uses authenticated via LDAP be created automatically in kimai. If set to false the users have to be added manually to kimai and only password-verification will be handled via LDAP
defaultGlobalRoleName: The name of the default role newly created users will be associated with
defaultGroupMemberships: An array of group=>role mappings the user shall also be associated with

Default settings and full example for includes/auth.php:

<?php
return array(
    'host' => 'ldap://localhost',
    'bindDN' => '',
    'bindPW' => '',
    'searchBase' => 'dc=example,c=org',
    'userFilter' => 'uid=%s',
    'groupFilter' => 'memberUid=%1$s',
    'usernameAttribute' => 'uid',
    'commonNameAttribute' => 'cn',
    'groupidAttribute' => 'cn',
    'mailAttribute' => 'mail',
    'allowedGroupIds' => array('kimai-access'),
    'forceLowercase' => true,
    'nonLdapAcounts' => array('admin'),
    'autocreateUsers' => true,
    'defaultGlobalRoleName' => 'User',
    'defaultGroupMemberships' => array('Users' => 'User'),
);

Active Directory

Kimai support authentication with Microsofts Active Directory through LDAP.

Change $authenticator = "activeDirectory"; in includes/autoconf.php

Configuration-parameters

enhancedIdentityPrivacy: Supports the “Enhanced Identity Privacy” option, see Microsoft Technet

Default settings and full example for includes/auth.php:

<?php
return array(
    'enhancedIdentityPrivacy' => 'false',
);

As this class is a subclass of the LDAP-Advanced authenticator (see above), you can set all Configuration-parameters from there as well, for example the host:

<?php
return array(
    'host' => 'ldap://localhost',
    'enhancedIdentityPrivacy' => 'false',
);