From e502d5b46efdddacdd874d9c4ffc07afd4f452b8 Mon Sep 17 00:00:00 2001
From: Adrien Ferrand <aferrand@ecomundo.eu>
Date: Thu, 8 Jun 2017 21:08:28 +0200
Subject: [PATCH] Version 4.1.3-2, with updated documentation about
 authentication.

---
 README.md           | 30 +++++++++++++++++++++++++++++-
 VERSION             |  2 +-
 files/entrypoint.sh |  3 ---
 3 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 6853f6e..2ece234 100644
--- a/README.md
+++ b/README.md
@@ -97,12 +97,40 @@ docker run \
 
 ## UI authentication/authorization
 
-By default, a single user with admin rights is created during the first start of the container. Its username is *backuppc* and its password is *password*. The credentials are stored in the file `/etc/backuppc/htpasswd` to allow the embedded lighttpd server to handle Basic Authentication, and the Backuppc config variable `$Conf{CgiAdminUsers}` is setted to this username to instruct Backuppc to give it admin rights. 
+By default, a single user with admin rights is created during the first start of the container. Its username is *backuppc* and its password is *password*. The credentials are stored in the file `/etc/backuppc/htpasswd` to allow the embedded lighttpd server to handle Basic Authentication, and the Backuppc config variable `$Conf{CgiAdminUsers}` is setted to this username to instruct BackupPC to give it admin rights. 
 
 You can modify the admin user credentials by setting the environment variables `BACKUPPC_WEB_USER (default backuppc)` and `BACKUPPC_WEB_PASSWD (default password)` when creating the container.
 
 The admin user credentials can be modified on an existing container by modifying the relevant environment variables, then re-creating the container. However please note that if you modify the username, you will need to manually remove the old username from the file `/etc/backuppc/htpasswd` in the container after its re-creation.
 
+### Advanced UI authentication/authorization
+
+One may need more advanced authentication/authorization on Backuppc Web UI, for instance several *normal* users allowing operations on backups, and an *admin* user to parameterize BackupPC.
+
+In theses cases, authentication and admin granting must be configured manually.
+* Authentication is configured by providing credentials in the file `/etc/backuppc/htpasswd` of the container. You should use Apache `htpasswd` utility to fill it.
+* All authenticated users are considered as *normal* users if not telling otherwise. Add a username in the `$Conf{CgiAdminUsers}` variable of `/etc/backuppc/config.pl` file to grant this user admin rights.
+* Then default admin user creation is not needed : unset environment variables `BACKUPPC_WEB_USER` and `BACKUPPC_WEB_PASSWD` to avoid adding an additional user in the `htpasswd` file, and reconfigure admin rights in `config.pl`.
+
+For instance, with two *normal* users `user1` and `user2` + one *admin* user `admin`, you can do the following steps on the host. It is assumed that `/etc/backuppc` is mounted on `/var/docker-data/backuppc/etc` on the host and Apache `htpasswd` utility is installed on it.
+
+```bash
+htpasswd -b -c /var/docker-data/backuppc/etc/htpasswd admin admin_password
+htpasswd -b /var/docker-data/backuppc/etc/htpasswd user1 user1_password
+htpasswd -b /var/docker-data/backuppc/etc/htpasswd user2 user2_password
+sed -ie "s/^\$Conf{CgiAdminUsers}\s*=\s*'\w*'/\$Conf{CgiAdminUsers} = 'admin'/g" /var/docker-data/backuppc/etc/config.pl
+
+docker run \
+    --name backuppc \
+    --publish 80:8080 \
+    --volume /var/docker-data/backuppc/etc:/etc/backuppc \
+    --volume /var/docker-data/backuppc/home:/home/backuppc \
+    --volume /var/docker-data/backuppc/data:/data/backuppc \
+    adferrand/backuppc  
+```
+
+Please note that Basic Authentication is still done unencrypted on HTTP port. See [UI SSL encryption](#ui-ssl-encryption) to secure the authentication.
+
 ## UI SSL encryption
 
 By default, BackupPC Admin Web UI is exposed on the non secured HTTP protocol. Two advised ways to secure this are proposed.
diff --git a/VERSION b/VERSION
index 2325db4..2c24d54 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-4.1.3-1
+4.1.3-2
diff --git a/files/entrypoint.sh b/files/entrypoint.sh
index 3269b85..cc80440 100755
--- a/files/entrypoint.sh
+++ b/files/entrypoint.sh
@@ -24,13 +24,10 @@ if [ -f /firstrun ]; then
 	configure_admin=""
 	if [ ! -f /etc/backuppc/htpasswd ]; then
 		htpasswd -b -c /etc/backuppc/htpasswd "${BACKUPPC_WEB_USER:-backuppc}" "${BACKUPPC_WEB_PASSWD:-password}"
-
 		configure_admin="--config-override CgiAdminUsers='${BACKUPPC_WEB_USER:-backuppc}'"
-
 	elif [ -n "$BACKUPPC_WEB_USER" -a -n "$BACKUPPC_WEB_PASSWD" ]; then
 		touch /etc/backuppc/htpasswd
 		htpasswd -b /etc/backuppc/htpasswd "${BACKUPPC_WEB_USER}" "${BACKUPPC_WEB_PASSWD}"
-
 		configure_admin="--config-override CgiAdminUsers='$BACKUPPC_WEB_USER'"
 	fi