CakePHP3.x: authentication required popup

Question

Sometimes, maybe when I stay long time enough without action, or when I try to access directly to a specific page, an "authentication required" popup is displayed asking for my login and password.

But even if I fill in the required fields, the authentication is not done and the refresh just display "Unauthorized.

It seems this popup doesn't call my login method.

Can you tell me how the credentials are supposed to be transmited to my user login controller?

Regards,

EDIT My login Form

<div class="container-fluid">
    <br/>
    <div class="container-fluid col-md-4 col-md-offset-4">
    <h1>Se connecter</h1>

        <div class="row">
            <div class="col-md-12">
                <?= $this->FormB->create(); ?>
                    <div class="panel panel-default">
                        <div class="panel-heading">
                            <h2><?= __("Saisissez vos identifiants") ?></h2>
                        </div>
                        <div class="panel-body">

                            <?= $this->FormB->input('username', ['label' => __("Nom d'utilisateur :"), 'placeholder' => __("Nom d'utilisateur")]); ?>

                            <?= $this->FormB->input('password', ['label' => __("Mot de passe :"), 'placeholder' => __("Mot de passe")]); ?>

                            <p><em><?= $this->Html->link(__("Mot de passe oublié ?"), ['action' => 'forgotPassword']); ?></em></p>

                            <br/>

                            <?php if ($activeLink == 1): ?>

                            <p><em><?= $this->Html->link(__("Renvoyer l'email d'activation ?"), ['controller' => 'Users', 'action' => 'resend', 'username' => $username]); ?></em></p>

                            <br/>

                            <?php endif ?>              
                        </div>
                    </div>
                    <div>
                        <?= $this->Form->button(isset($btnlabel) ? __("$btnlabel") : __("Enregistrer"), ["class" => "btn btn-primary btn-block"]) ?>
                    </div>
                <?= $this->FormB->end() ?>          
            </div>
        </div>
    </div>
</div>

** EDIT ** When I enter my login/password in the popup opened by the browser, Cake generates the following error

2016-03-24 16:53:11 Error: [Cake\Network\Exception\UnauthorizedException] Unauthorized
Request URL: /pros/Owners/account
Stack Trace:
#0 /home/MyApp/vendor/cakephp/cakephp/src/Controller/Component/AuthComponent.php(359): Cake\Auth\BasicAuthenticate->unauthenticated(Object(Cake\Network\Request), Object(Cake\Network\Response))
#1 /home/MyApp/vendor/cakephp/cakephp/src/Controller/Component/AuthComponent.php(296): Cake\Controller\Component\AuthComponent->_unauthenticated(Object(App\Controller\Pros\OwnersController))
#2 /home/MyApp/vendor/cakephp/cakephp/src/Controller/Component/AuthComponent.php(258): Cake\Controller\Component\AuthComponent->authCheck(Object(Cake\Event\Event))
#3 /home/MyApp/vendor/cakephp/cakephp/src/Event/EventManager.php(385): Cake\Controller\Component\AuthComponent->startup(Object(Cake\Event\Event))
#4 /home/MyApp/vendor/cakephp/cakephp/src/Event/EventManager.php(355): Cake\Event\EventManager->_callListener(Array, Object(Cake\Event\Event))
#5 /home/MyApp/vendor/cakephp/cakephp/src/Event/EventDispatcherTrait.php(78): Cake\Event\EventManager->dispatch(Object(Cake\Event\Event))
#6 /home/MyApp/vendor/cakephp/cakephp/src/Controller/Controller.php(495): Cake\Controller\Controller->dispatchEvent('Controller.star...')
#7 /home/MyApp/vendor/cakephp/cakephp/src/Routing/Dispatcher.php(109): Cake\Controller\Controller->startupProcess()
#8 /home/MyApp/vendor/cakephp/cakephp/src/Routing/Dispatcher.php(87): Cake\Routing\Dispatcher->_invoke(Object(App\Controller\Pros\OwnersController))
#9 /home/MyApp/webroot/index.php(37): Cake\Routing\Dispatcher->dispatch(Object(Cake\Network\Request), Object(Cake\Network\Response))
#10 {main}

So how am I supposed to intercept this authentication attempt?

Answer 1

The problem was caused by a modification I made in AppController to authenticate from API request:
Normally, you should load Auth component like that:

    $this->loadComponent('Auth', [
        'authorize' => ['Controller'],
        'authenticate' => [
           'Form' => [
                'scope' => ['Users.active' => 1]
            ],
        ],
        'loginRedirect' => [
           'controller' => 'Users',
           'action' => 'account'
        ],
        'logoutRedirect' => [
            'controller' => 'Index',
            'action' => 'index'
        ]
    ]);

That way, you authenticate filling your credential in a Form.

Another way is to use Basic authentication. it's less used but it can be implemented like that.

    $this->loadComponent('Auth', [
        'authorize' => ['Controller'],
        'authenticate' => [
            'Basic' => [
                'fields' => ['username' => 'username', 'password' => 'password'],
                'userModel' => 'Users'
            ],
        ],
        'storage' => 'Memory',
        'unauthorizedRedirect' => false
    ]);

Doing like that, causes the login popup to be displayed if you try to access a web page.

I don't know if loading both Form and Basic authentication really makes sense, but it's what I did first and it's because I sometimes saw the popup displayed, notably when the session authenticated by Form expired.

If you need a normal authentication mechanism for your website, load Auth component with Form in your AppController.php. If you need a basic authentication mechanism for API access, I advise to create an ApiController.php where you will load Auth component with Basic as given above. Then, you API controller will extend ApiController instead of AppController.

It's what I can say from my knowledge. CakePHP guru could add more infos or correct me if necessary.

Answer 2

I have completely same issue as post. I was considered helping by someone and I fixed that problem.

My config auth component before:

$this->loadComponent('Auth', [
            'authenticate' => array(
                'Form' => array(
                    // 'fields' => array('username' => 'email'),
                    'scope' => array('is_delete' => '0')
                )
            ),

and after I edited it, it was run perfectly.

$this->loadComponent('Auth', [
            'authenticate' => array(
                'Form' => array(
                'userModel' => 'MUsers', //Add this line
                'fields' => array('username' => 'username',
                                   'password' => 'password'), //Edited this line
                    'scope' => array('is_delete' => '0')
                )
            ),

If someone want to know to to fix please review my post at:

Cakephp 3 - Auth session cannot destroy