Debian and Ubuntu

Most Debian and Ubuntu versions include a phpMyAdmin package, but be aware thatthe configuration file is maintained in/etc/phpmyadmin and may differ insome ways from the official phpMyAdmin documentation. Specifically, it does:

• Configuration of a web server (works for Apache and lighttpd).

• Creating ofphpMyAdmin configuration storage using dbconfig-common.

• Securing setup script, seeSetup script on Debian, Ubuntu and derivatives.

More specific details about installing Debian or Ubuntu packages are availablein our wiki.

OpenSUSE

OpenSUSE already comes with phpMyAdmin package, just install packages fromtheopenSUSE Build Service.

Gentoo

Gentoo ships the phpMyAdmin package, both in a near-stock configuration as wellas in awebapp-config configuration. Useemergedev-db/phpmyadmin toinstall.

Mandriva

Mandriva ships the phpMyAdmin package in theircontrib branch and can beinstalled via the usual Control Center.

Fedora

Fedora ships the phpMyAdmin package, but be aware that the configuration fileis maintained in/etc/phpMyAdmin/ and may differ in some ways from theofficial phpMyAdmin documentation.

Red Hat Enterprise Linux

Red Hat Enterprise Linux itself and thus derivatives like CentOS don’tship phpMyAdmin, but the Fedora-driven repositoryExtra Packages for Enterprise Linux (EPEL)is doing so, if it’senabled.But be aware that the configuration file is maintained in/etc/phpMyAdmin/ and may differ in some ways from theofficial phpMyAdmin documentation.

Docker environment variables

You can configure several phpMyAdmin features using environment variables:

PMA_ARBITRARY

Allows you to enter a database server hostname on login form.

See also

$cfg['AllowArbitraryServer']

PMA_HOST

Hostname or IP address of the database server to use.

See also

$cfg['Servers'][$i]['host']

PMA_HOSTS

Comma-separated hostnames or IP addresses of the database servers to use.

Note

Used only ifPMA_HOST is empty.

PMA_VERBOSE

Verbose name of the database server.

See also

$cfg['Servers'][$i]['verbose']

PMA_VERBOSES

Comma-separated verbose name of the database servers.

Note

Used only ifPMA_VERBOSE is empty.

PMA_USER

User name to use forConfig authentication mode.

PMA_PASSWORD

Password to use forConfig authentication mode.

PMA_PORT

Port of the database server to use.

PMA_PORTS

Comma-separated ports of the database server to use.

Note

Used only ifPMA_PORT is empty.

PMA_SOCKET

Socket file for the database connection.

PMA_SOCKETS

Comma-separated list of socket files for the database connections.

Note

Used only ifPMA_SOCKET is empty.

PMA_ABSOLUTE_URI

The fully-qualified path (https://pma.example.net/) where the reverseproxy makes phpMyAdmin available.

See also

$cfg['PmaAbsoluteUri']

PMA_QUERYHISTORYDB

When set totrue, enables storing SQL history to$cfg['Servers'][$i]['pmadb'].Whenfalse, history is stored in the browser and is cleared when logging out.

See also

$cfg['Servers'][$i]['history']

See also

$cfg['QueryHistoryDB']

PMA_QUERYHISTORYMAX

When set to an integer, controls the number of history items.

See also

$cfg['QueryHistoryMax']

PMA_CONTROLHOST

When set, this points to an alternate database host used for storing the “phpMyAdmin configuration storage” database.

See also

$cfg['Servers'][$i]['controlhost']

PMA_CONTROLUSER

Defines the username for phpMyAdmin to use for the “phpMyAdmin configuration storage” database.

See also

$cfg['Servers'][$i]['controluser']

PMA_CONTROLPASS

Defines the password for phpMyAdmin to use for the “phpMyAdmin configuration storage” database.

See also

$cfg['Servers'][$i]['controlpass']

PMA_CONTROLPORT

When set, will override the default port (3306) for connecting to the control host.

See also

$cfg['Servers'][$i]['controlport']

PMA_PMADB

When set, define the name of the database to be used for the “phpMyAdmin configuration storage” database.When not set, the advanced features are not enabled by default: they can still potentially be enabled by the user when logging in with theZero configuration feature.

Note

Suggested values:phpmyadmin orpmadb

See also

$cfg['Servers'][$i]['pmadb']

HIDE_PHP_VERSION

If defined, this option will hide the PHP version (expose_php = Off).Set to any value (such asHIDE_PHP_VERSION=true).

UPLOAD_LIMIT

If set, this option will override the default value for apache and php-fpm (this will changeupload_max_filesize andpost_max_size values).

Note

Format as[0-9+](K,M,G) default value is2048K

MEMORY_LIMIT

If set, this option will override the phpMyAdmin memory limit$cfg['MemoryLimit'] and PHP’smemory_limit.

Note

Format as[0-9+](K,M,G) whereK is for Kilobytes,M for Megabytes,G for Gigabytes and1K = 1024 bytes. Default value is512M.

MAX_EXECUTION_TIME

If set, this option will override the maximum execution time in seconds for phpMyAdmin$cfg['ExecTimeLimit'] and PHP’smax_execution_time.

Note

Format as[0-9+]. Default value is600.

PMA_CONFIG_BASE64

If set, this option will override the defaultconfig.inc.php with the base64 decoded contents of the variable.

PMA_USER_CONFIG_BASE64

If set, this option will override the defaultconfig.user.inc.php with the base64 decoded contents of the variable.

PMA_UPLOADDIR

If set, this option will set the path where files can be saved to be available to import ($cfg['UploadDir'])

PMA_SAVEDIR

If set, this option will set the path where exported files can be saved ($cfg['SaveDir'])

APACHE_PORT

If set, this option will change the default Apache port from80 in case you want it to run on a different port like an unprivileged port. Set to any port value (such asAPACHE_PORT=8090).

PMA_SSL_DIR

Define the path used for SSL files generated from environment variables, default value is/etc/phpmyadmin/ssl.

PMA_SSL

When set to1, defines SSL usage for the MySQL connection.

See also

$cfg['Servers'][$i]['ssl']

PMA_SSLS

Comma-separated list of0 and1 defining SSL usage for the corresponding MySQL connections.

PMA_SSL_VERIFY

When set to1, enables SSL certificate verification for the MySQL connection.

See also

$cfg['Servers'][$i]['ssl_verify']

PMA_SSL_VERIFIES

Comma-separated list of0 and1 to enable or disable SSL certificate verification for multiple MySQL connections.

See also

$cfg['Servers'][$i]['ssl_verify']

PMA_SSL_CA

In the context of mutual TLS security, allows setting your CA file as a string inside the defaultconfig.inc.php.

See also

$cfg['Servers'][$i]['ssl_ca']

PMA_SSL_CAS

In the context of mutual TLS security, allows setting multiple CA files as a comma-separated list of strings inside the defaultconfig.inc.php.

PMA_SSL_CA_BASE64

In the context of mutual TLS security, allows setting your CA file as a base64 string inside the defaultconfig.inc.php.

See also

$cfg['Servers'][$i]['ssl_ca']

PMA_SSL_CAS_BASE64

In the context of mutual TLS security, allows setting multiple CA files as a comma-separated list of base64 strings inside the defaultconfig.inc.php.

PMA_SSL_CERT

In the context of mutual TLS security, allows setting your CERT file as a string inside the defaultconfig.inc.php.

See also

$cfg['Servers'][$i]['ssl_cert']

PMA_SSL_CERTS

In the context of mutual TLS security, allows setting multiple CERT files as a comma-separated list of strings inside the defaultconfig.inc.php.

PMA_SSL_CERT_BASE64

In the context of mutual TLS security, allows setting your CERT file as a base64 string inside the defaultconfig.inc.php.

See also

$cfg['Servers'][$i]['ssl_cert']

PMA_SSL_CERTS_BASE64

In the context of mutual TLS security, allows setting multiple CERT files as a comma-separated list of base64 strings inside the defaultconfig.inc.php.

PMA_SSL_KEY

In the context of mutual TLS security, allows setting your KEY file as a string inside the defaultconfig.inc.php.

PMA_SSL_KEYS

In the context of mutual TLS security, allows setting multiple KEY files as a comma-separated list of strings inside the defaultconfig.inc.php.

See also

$cfg['Servers'][$i]['ssl_key']

PMA_SSL_KEY_BASE64

In the context of mutual TLS security, allows setting your KEY file as a base64 string inside the defaultconfig.inc.php.

See also

$cfg['Servers'][$i]['ssl_key']

PMA_SSL_KEYS_BASE64

In the context of mutual TLS security, allows setting multiple KEY files as a comma-separated list of base64 strings inside the defaultconfig.inc.php.

TZ

If defined, this option will change the default PHPdate.timezone fromUTC.

See also

$cfg['Servers'][$i]['SessionTimeZone']

By default,Cookie authentication mode is used, but ifPMA_USER andPMA_PASSWORD are set, it is switched toConfig authentication mode.

Customizing configuration

Additionally configuration can be tweaked by/etc/phpmyadmin/config.user.inc.php. Ifthis file exists, it will be loaded after configuration is generated from aboveenvironment variables, so you can override any configuration variable. Thisconfiguration can be added as a volume when invoking docker using-v /some/local/directory/config.user.inc.php:/etc/phpmyadmin/config.user.inc.php parameters.

Note that the supplied configuration file is applied afterDocker environment variables,but you can override any of the values.

For example to change the default behavior of CSV export you can use the followingconfiguration file:

<?php$cfg['Export']['csv_columns']=true;

You can also use it to define server configuration instead of using theenvironment variables listed inDocker environment variables:

<?php/* Override Servers array */$cfg['Servers']=[1=>['auth_type'=>'cookie','host'=>'mydb1','port'=>3306,'verbose'=>'Verbose name 1',],2=>['auth_type'=>'cookie','host'=>'mydb2','port'=>3306,'verbose'=>'Verbose name 2',],];

Docker Volumes

You can use the following volumes to customize image behavior:

/etc/phpmyadmin/config.user.inc.php

Can be used for additional settings, see the previous chapter for more details.

/sessions/

Directory where PHP sessions are stored. You might want to share thisfor example when usingSignon authentication mode.

/www/themes/

Directory where phpMyAdmin looks for themes. By default only those shippedwith phpMyAdmin are included, but you can include additional phpMyAdminthemes (seeCustom Themes) by using Docker volumes.

Docker Examples

To connect phpMyAdmin to a given server use:

dockerrun--namephpmyadmin-d-ePMA_HOST=dbhost-p8080:80phpmyadmin:latest

To connect phpMyAdmin to more servers use:

dockerrun--namephpmyadmin-d-ePMA_HOSTS=dbhost1,dbhost2,dbhost3-p8080:80phpmyadmin:latest

To use arbitrary server option:

dockerrun--namephpmyadmin-d--linkmysql_db_server:db-p8080:80-ePMA_ARBITRARY=1phpmyadmin:latest

You can also link the database container using Docker:

dockerrun--namephpmyadmin-d--linkmysql_db_server:db-p8080:80phpmyadmin:latest

Running with additional configuration:

dockerrun--namephpmyadmin-d--linkmysql_db_server:db-p8080:80-v/some/local/directory/config.user.inc.php:/etc/phpmyadmin/config.user.inc.phpphpmyadmin:latest

Running with additional themes:

dockerrun--namephpmyadmin-d--linkmysql_db_server:db-p8080:80-v/some/local/directory/custom/phpmyadmin/themeName/:/var/www/html/themes/themeName/phpmyadmin:latest

Using docker-compose

Alternatively, you can also use docker-compose with the docker-compose.yml from<https://github.com/phpmyadmin/docker>. This will run phpMyAdmin with anarbitrary server - allowing you to specify MySQL/MariaDB server on the login page.

dockercomposeup-d

Customizing configuration file using docker-compose

You can use an external file to customize phpMyAdmin configuration and pass itusing the volumes directive:

phpmyadmin:image:phpmyadmin:latestcontainer_name:phpmyadminenvironment:-PMA_ARBITRARY=1restart:alwaysports:-8080:80volumes:-/sessions-~/docker/phpmyadmin/config.user.inc.php:/etc/phpmyadmin/config.user.inc.php-/custom/phpmyadmin/theme/:/www/themes/theme/

Running behind haproxy in a subdirectory

When you want to expose phpMyAdmin running in a Docker container in asubdirectory, you need to rewrite the request path in the server proxying therequests.

For example, using haproxy it can be done as:

frontend http    bind *:80    option forwardfor    option http-server-close    ### NETWORK restriction    acl LOCALNET  src 10.0.0.0/8 192.168.0.0/16 172.16.0.0/12    # /phpmyadmin    acl phpmyadmin  path_dir /phpmyadmin    use_backend phpmyadmin if phpmyadmin LOCALNETbackend phpmyadmin    mode http    reqirep  ^(GET|POST|HEAD)\ /phpmyadmin/(.*)     \1\ /\2    # phpMyAdmin container IP    server localhost     172.30.21.21:80

When using traefik, something like following should work:

defaultEntryPoints = ["http"][entryPoints]  [entryPoints.http]  address = ":80"    [entryPoints.http.redirect]      regex = "(http:\\/\\/[^\\/]+\\/([^\\?\\.]+)[^\\/])$"      replacement = "$1/"[backends]  [backends.myadmin]    [backends.myadmin.servers.myadmin]    url="http://internal.address.to.pma"[frontends]   [frontends.myadmin]   backend = "myadmin"   passHostHeader = true     [frontends.myadmin.routes.default]     rule="PathPrefixStrip:/phpmyadmin/;AddPrefix:/"

You then should specifyPMA_ABSOLUTE_URI in the docker-composeconfiguration:

version:'2'services:phpmyadmin:restart:alwaysimage:phpmyadmin:latestcontainer_name:phpmyadminhostname:phpmyadmindomainname:example.comports:-8000:80environment:-PMA_HOSTS=172.26.36.7,172.26.36.8,172.26.36.9,172.26.36.10-PMA_VERBOSES=production-db1,production-db2,dev-db1,dev-db2-PMA_USER=root-PMA_PASSWORD=-PMA_ABSOLUTE_URI=http://example.com/phpmyadmin/

Manually creating the file

To manually create the file, simply use your text editor to create thefileconfig.inc.php (you can copyconfig.sample.inc.php to geta minimal configuration file) in the main (top-level) phpMyAdmindirectory (the one that containsindex.php). phpMyAdmin firstloads the default configuration values and then overrides those valueswith anything found inconfig.inc.php. If the default value isokay for a particular setting, there is no need to include it inconfig.inc.php. You’ll probably need only a few directives to get going; asimple configuration may look like this:

<?php// The string is a hexadecimal representation of a 32-bytes long string of random bytes.$cfg['blowfish_secret']=sodium_hex2bin('f16ce59f45714194371b48fe362072dc3b019da7861558cd4ad29e4d6fb13851');$i=0;$i++;$cfg['Servers'][$i]['auth_type']='cookie';// if you insist on "root" having no password:// $cfg['Servers'][$i]['AllowNoPassword'] = true;

Or, if you prefer to not be prompted every time you log in:

<?php$i=0;$i++;$cfg['Servers'][$i]['user']='root';$cfg['Servers'][$i]['password']='changeme';// use here your password$cfg['Servers'][$i]['auth_type']='config';

For a full explanation of possible configuration values, see theConfiguration of this document.

Using the Setup script

Instead of manually editingconfig.inc.php, you can use phpMyAdmin’ssetup feature. The file can be generated using the setup and you can download itfor upload to the server.

Next, open your browser and visit the location where you installed phpMyAdmin,with the/setup suffix. The changes are not saved to the server, you need touse theDownload button to save them to your computer and then uploadto the server.

Now the file is ready to be used. You can choose to review or edit thefile with your favorite editor, if you prefer to set some advancedoptions that the setup script does not provide.

1. If you are using theauth_type “config”, it is suggested that youprotect the phpMyAdmin installation directory because using configdoes not require a user to enter a password to access the phpMyAdmininstallation. Use of an alternate authentication method isrecommended, for example with HTTP–AUTH in a.htaccess file or switch to usingauth_type cookie or http. See theISPs, multi-user installationsfor additional information, especially4.4 phpMyAdmin always gives “Access denied” when using HTTP authentication..

2. Open the main phpMyAdmin directory in your browser.phpMyAdmin should now display a welcome screen and your databases, ora login dialog if usingHTTP orcookie authentication mode.

/usr/sbin/pma-configure

/usr/sbin/pma-secure

Zero configuration

In many cases, this database structure can be automatically created andconfigured. This is called “Zero Configuration” mode and can be particularlyuseful in shared hosting situations. “Zeroconf” mode is on by default, todisable set$cfg['ZeroConf'] to false.

The following three scenarios are covered by the Zero Configuration mode:

• When entering a database where the configuration storage tables are notpresent, phpMyAdmin offers to create them from the Operations tab.

• When entering a database where the tables do already exist, the softwareautomatically detects this and begins using them. This is the most commonsituation; after the tables are initially created automatically they arecontinually used without disturbing the user; this is also most useful onshared hosting where the user is not able to editconfig.inc.php andusually the user only has access to one database.

• When having access to multiple databases, if the user first enters thedatabase containing the configuration storage tables then switches toanother database,phpMyAdmin continues to use the tables from the first database; the user isnot prompted to create more tables in the new database.

Manual configuration

Please look at your./sql/ directory, where you should find afile calledcreate_tables.sql. (If you are using a Windows server,pay special attention to1.23 I’m running MySQL on a Win32 machine. Each time I create a new table the table and column names are changed to lowercase!).

If you already had this infrastructure and:

• upgraded to MySQL 4.1.2 or newer, please usesql/upgrade_tables_mysql_4_1_2+.sql.

• upgraded to phpMyAdmin 4.3.0 or newer from 2.5.0 or newer (<= 4.2.x),please usesql/upgrade_column_info_4_3_0+.sql.

• upgraded to phpMyAdmin 4.7.0 or newer from 4.3.0 or newer,please usesql/upgrade_tables_4_7_0+.sql.

and then create new tables by importingsql/create_tables.sql.

You can use your phpMyAdmin to create the tables for you. Please beaware that you may need special (administrator) privileges to createthe database and tables, and that the script may need some tuning,depending on the database name.

After having imported thesql/create_tables.sql file, youshould specify the table names in yourconfig.inc.php file. Thedirectives used for that can be found in theConfiguration.

You will also need to have a controluser($cfg['Servers'][$i]['controluser'] and$cfg['Servers'][$i]['controlpass'] settings)with the proper rights to those tables. For example you can create itusing following statement:

And for any MariaDB version:

CREATEUSER'pma'@'localhost'IDENTIFIEDVIAmysql_native_passwordUSING'pmapass';GRANTSELECT,INSERT,UPDATE,DELETEON`<pma_db>`.*TO'pma'@'localhost';

For MySQL 8.0 and newer:

CREATEUSER'pma'@'localhost'IDENTIFIEDWITHcaching_sha2_passwordBY'pmapass';GRANTSELECT,INSERT,UPDATE,DELETEON<pma_db>.*TO'pma'@'localhost';

For MySQL older than 8.0:

CREATEUSER'pma'@'localhost'IDENTIFIEDWITHmysql_native_passwordAS'pmapass';GRANTSELECT,INSERT,UPDATE,DELETEON<pma_db>.*TO'pma'@'localhost';

Note that MySQL installations with PHP older than 7.4 and MySQL newer than 8.0 may requireusing the mysql_native_password authentication as a workaround, see1.45 I get an error message about unknown authentication method caching_sha2_password when trying to log in for details.

HTTP authentication mode

• UsesHTTP Basic authenticationmethod and allows you to log in as any valid MySQL user.

• Is supported with most PHP configurations. ForIIS (ISAPI)support usingCGI PHP see1.32 Can I use HTTP authentication with IIS?, for using with ApacheCGI see1.35 Can I use HTTP authentication with Apache CGI?.

• When PHP is running under Apache’smod_proxy_fcgi (e.g. with PHP-FPM),Authorization headers are not passed to the underlying FCGI application,such that your credentials will not reach the application. In this case, you canadd the following configuration directive:

  SetEnvIfAuthorization"(.*)"HTTP_AUTHORIZATION=$1

• See also4.4 phpMyAdmin always gives “Access denied” when using HTTP authentication. about not using the.htaccess mechanism along with‘HTTP’ authentication mode.

Cookie authentication mode

• Username and password are stored in cookies during the session and passwordis deleted when it ends.

• With this mode, the user can truly log out of phpMyAdmin and logback in with the same username (this is not possible withHTTP authentication mode).

• If you want to allow users to enter any hostname to connect (rather than onlyservers that are configured inconfig.inc.php),see the$cfg['AllowArbitraryServer'] directive.

• As mentioned in theRequirements section, having theopenssl extensionwill speed up access considerably, but is not required.

Signon authentication mode

• This mode is a convenient way of using credentials from anotherapplication to authenticate to phpMyAdmin to implement a single signonsolution.

• The other application has to store login information into sessiondata (see$cfg['Servers'][$i]['SignonSession'] and$cfg['Servers'][$i]['SignonCookieParams']) or youneed to implement script to return the credentials (see$cfg['Servers'][$i]['SignonScript']).

• When no credentials are available, the user is being redirected to$cfg['Servers'][$i]['SignonURL'], where you should handlethe login process.

The very basic example of saving credentials in a session is available asexamples/signon.php:

<?php/** * Single signon for phpMyAdmin * * This is just example how to use session based single signon with * phpMyAdmin, it is not intended to be perfect code and look, only * shows how you can integrate this functionality in your application. */declare(strict_types=1);/* Use cookies for session */ini_set('session.use_cookies','true');/* Change this to true if using phpMyAdmin over https */$secure_cookie=false;/* Need to have cookie visible from parent directory */session_set_cookie_params(0,'/','',$secure_cookie,true);/* Create signon session */$session_name='SignonSession';session_name($session_name);// Uncomment and change the following line to match your $cfg['SessionSavePath']//session_save_path('/foobar');@session_start();/* Was data posted? */if(isset($_POST['user'])){/* Store there credentials */$_SESSION['PMA_single_signon_user']=$_POST['user'];$_SESSION['PMA_single_signon_password']=$_POST['password'];$_SESSION['PMA_single_signon_host']=$_POST['host'];$_SESSION['PMA_single_signon_port']=$_POST['port'];/* Update another field of server configuration */$_SESSION['PMA_single_signon_cfgupdate']=['verbose'=>'Signon test'];$_SESSION['PMA_single_signon_HMAC_secret']=hash('sha1',uniqid(strval(random_int(0,mt_getrandmax())),true));$id=session_id();/* Close that session */@session_write_close();/* Redirect to phpMyAdmin (should use absolute URL here!) */header('Location: ../index.php');}else{/* Show simple form */header('Content-Type: text/html; charset=utf-8');echo'<?xml version="1.0" encoding="utf-8"?>'."\n";echo'<!DOCTYPE HTML><html lang="en" dir="ltr"><head><link rel="icon" href="../favicon.ico" type="image/x-icon"><link rel="shortcut icon" href="../favicon.ico" type="image/x-icon"><meta charset="utf-8"><title>phpMyAdmin single signon example</title></head><body>';if(isset($_SESSION['PMA_single_signon_error_message'])){echo'<p class="error">';echo$_SESSION['PMA_single_signon_error_message'];echo'</p>';}echo'<form action="signon.php" method="post">Username: <input type="text" name="user" autocomplete="username" spellcheck="false"><br>Password: <input type="password" name="password" autocomplete="current-password" spellcheck="false"><br>Host: (will use the one from config.inc.php by default)<input type="text" name="host"><br>Port: (will use the one from config.inc.php by default)<input type="text" name="port"><br><input type="submit"></form></body></html>';}

Alternatively, you can also use this way to integrate with OpenID as showninexamples/openid.php:

<?php/** * Single signon for phpMyAdmin using OpenID * * This is just example how to use single signon with phpMyAdmin, it is * not intended to be perfect code and look, only shows how you can * integrate this functionality in your application. * * It uses OpenID pear package, see https://pear.php.net/package/OpenID * * User first authenticates using OpenID and based on content of $AUTH_MAP * the login information is passed to phpMyAdmin in session data. */declare(strict_types=1);if(false===@include_once'OpenID/RelyingParty.php'){exit;}/* Change this to true if using phpMyAdmin over https */$secure_cookie=false;/** * Map of authenticated users to MySQL user/password pairs. */$AUTH_MAP=['https://launchpad.net/~username'=>['user'=>'root','password'=>'',],];// phpcs:disable PSR1.Files.SideEffects,Squiz.Functions.GlobalFunction/** * Simple function to show HTML page with given content. * * @param string $contents Content to include in page */functionShow_page($contents):void{header('Content-Type: text/html; charset=utf-8');echo'<?xml version="1.0" encoding="utf-8"?>'."\n";echo'<!DOCTYPE HTML><html lang="en" dir="ltr"><head><link rel="icon" href="../favicon.ico" type="image/x-icon"><link rel="shortcut icon" href="../favicon.ico" type="image/x-icon"><meta charset="utf-8"><title>phpMyAdmin OpenID signon example</title></head><body>';if(isset($_SESSION['PMA_single_signon_error_message'])){echo'<p class="error">'.$_SESSION['PMA_single_signon_message'].'</p>';unset($_SESSION['PMA_single_signon_message']);}echo$contents;echo'</body></html>';}/** * Display error and exit * * @param Exception $e Exception object */functionDie_error($e):void{$contents="<div class='relyingparty_results'>\n";$contents.='<pre>'.htmlspecialchars($e->getMessage())."</pre>\n";$contents.="</div class='relyingparty_results'>";Show_page($contents);exit;}// phpcs:enable/* Need to have cookie visible from parent directory */session_set_cookie_params(0,'/','',$secure_cookie,true);/* Create signon session */$session_name='SignonSession';session_name($session_name);@session_start();// Determine realm and return_to$base='http';if(isset($_SERVER['HTTPS'])&&$_SERVER['HTTPS']==='on'){$base.='s';}$base.='://'.$_SERVER['SERVER_NAME'].':'.$_SERVER['SERVER_PORT'];$realm=$base.'/';$returnTo=$base.dirname($_SERVER['PHP_SELF']);if($returnTo[strlen($returnTo)-1]!=='/'){$returnTo.='/';}$returnTo.='openid.php';/* Display form */if((!count($_GET)&&!count($_POST))||isset($_GET['phpMyAdmin'])){/* Show simple form */$content='<form action="openid.php" method="post">OpenID: <input type="text" name="identifier"><br><input type="submit" name="start"></form>';Show_page($content);exit;}/* Grab identifier */$identifier=null;if(isset($_POST['identifier'])&&is_string($_POST['identifier'])){$identifier=$_POST['identifier'];}elseif(isset($_SESSION['identifier'])&&is_string($_SESSION['identifier'])){$identifier=$_SESSION['identifier'];}/* Create OpenID object */try{$o=newOpenID_RelyingParty($returnTo,$realm,$identifier);}catch(Throwable$e){Die_error($e);}/* Redirect to OpenID provider */if(isset($_POST['start'])){try{$authRequest=$o->prepare();}catch(Throwable$e){Die_error($e);}$url=$authRequest->getAuthorizeURL();header('Location: '.$url);exit;}/* Grab query string */if(!count($_POST)){[,$queryString]=explode('?',$_SERVER['REQUEST_URI']);}else{// Fetch the raw query body$queryString=file_get_contents('php://input');}/* Check reply */try{$message=newOpenID_Message($queryString,OpenID_Message::FORMAT_HTTP);}catch(Throwable$e){Die_error($e);}$id=$message->get('openid.claimed_id');if(empty($id)||!isset($AUTH_MAP[$id])){Show_page('<p>User not allowed!</p>');exit;}$_SESSION['PMA_single_signon_user']=$AUTH_MAP[$id]['user'];$_SESSION['PMA_single_signon_password']=$AUTH_MAP[$id]['password'];$_SESSION['PMA_single_signon_HMAC_secret']=hash('sha1',uniqid(strval(random_int(0,mt_getrandmax())),true));session_write_close();/* Redirect to phpMyAdmin (should use absolute URL here!) */header('Location: ../index.php');

If you intend to pass the credentials using some other means than, you have toimplement wrapper in PHP to get that data and set it to$cfg['Servers'][$i]['SignonScript']. There is a very minimal exampleinexamples/signon-script.php:

<?php/** * Single signon for phpMyAdmin * * This is just example how to use script based single signon with * phpMyAdmin, it is not intended to be perfect code and look, only * shows how you can integrate this functionality in your application. */declare(strict_types=1);// phpcs:disable Squiz.Functions.GlobalFunction/** * This function returns username and password. * * It can optionally use configured username as parameter. * * @param string $user User name * * @return array */functionget_login_credentials($user){/* Optionally we can use passed username */if(!empty($user)){return[$user,'password',];}/* Here we would retrieve the credentials */return['root','',];}

Config authentication mode

• This mode is sometimes the less secure one because it requires you to fill the$cfg['Servers'][$i]['user'] and$cfg['Servers'][$i]['password']fields (and as a result, anyone who can read yourconfig.inc.phpcan discover your username and password).

• In theISPs, multi-user installations section, there is an entry explaining howto protect your configuration file.

• For additional security in this mode, you may wish to consider theHost authentication$cfg['Servers'][$i]['AllowDeny']['order']and$cfg['Servers'][$i]['AllowDeny']['rules'] configuration directives.

• Unlike cookie and http, does not require a user to log in when firstloading the phpMyAdmin site. This is by design but could allow anyuser to access your installation. Use of some restriction method issuggested, perhaps a.htaccess file with the HTTP-AUTH directive or disallowingincoming HTTP requests at one’s router or firewall will suffice (bothof which are beyond the scope of this manual but easily searchablewith Google).

Users with column-specific privileges are unable to “Browse”

If a user has only column-specific privileges on some (but not all) columns in a table, “Browse”will fail with an error message.

As a workaround, a bookmarked query with the same name as the table can be created, this willrun when using the “Browse” link instead.Issue 11922.

Trouble logging back in after logging out using ‘http’ authentication

When using the ‘http’auth_type, it can be impossible to log back in (when the logout comesmanually or after a period of inactivity).Issue 11898.