Authentication and Security - Mastering phpMyAdmin 3.1 for Effective MySQL Management - page 24

When our control user is created in the MySQL server, we fill in the parameters as in
the following example:

$cfg['Servers'][$i]['controluser'] = 'pma';
$cfg['Servers'][$i]['controlpass'] = 'bingo';

I use the bingo password when I teach phpMyAdmin; it is recommended
to avoid using the same password for your own installation.

Logging out
Since version 2.10, a mechanism is available to indicate phpMyAdmin, as to which
URL it should pass control after a logout. This feature works for all authentication
types. Here is an example:

$cfg['Servers'][$i]['LogoutURL'] = 'http://www.mydomain.com';

This directive must contain an absolute URL, including the protocol.

HTTP authentication
This mode— http —is the traditional mode offered in HTTP, in which the browser
asks for the username and password, sends them to phpMyAdmin, and keeps
sending them until all the browser's windows are closed.

To enable this mode, we simply use the following line:

$cfg['Servers'][$i]['auth_type'] = 'http';

This mode has some limitations:

• PHP, depending on the version, might not support HTTP authentication. It

works when PHP is running as a module under Apache; for other cases, we
should consult the PHP documentation for our version.
If we want to protect phpMyAdmin's directory with a •

.htaccess file (see the
Security section in this chapter), this will interfere with HTTP authentication
type; we cannot use both.

• There is not a true logout, as we will have to close all browser windows to be

able to login again with the same username.