Configure como os usuários fazem login na sua instalação do Mapas Culturais.

O Mapas Culturais delega a autenticação a provedores de autenticação plugáveis. Cada provedor é uma classe PHP que estende a classe abstrata AuthProvider e é responsável por identificar usuários, criar contas no primeiro login e gerenciar sessões.

Defina o provedor ativo em config/config.php, usando a chave auth.provider. Apenas um provedor pode ficar ativo por vez.

Provedores disponíveis

Fake

Class: MapasCulturais\AuthProviders\Fake

O provedor Fake ignora toda autenticação externa. Quando uma pessoa acessa a página de login, vê uma lista pesquisável de todas as contas no banco de dados e um formulário para criar novas contas na hora.

'auth.provider' => 'Fake',

Atalho de desenvolvimento: variável de ambiente FAKE_AUTH

Em ambientes de desenvolvimento baseados em Docker, você pode habilitar a autenticação fake via módulo FakeAuthentication definindo a variável FAKE_AUTH, em vez de editar arquivos de configuração.

FAKE_AUTH=true

OpauthOpenId

Class: MapasCulturais\AuthProviders\OpauthOpenId

Esse provedor usa a biblioteca Opauth com a estratégia OpenID. Ele funciona com qualquer provedor OpenID aderente ao padrão, incluindo instâncias auto-hospedadas do Id da Cultura.

'auth.provider' => 'OpauthOpenId',
'auth.config' => [
    // Replace with your OpenID provider domain
    'login_url'  => 'https://id.example.org/openid/',
    'logout_url' => 'https://id.example.org/accounts/logout/',
    'salt'       => 'RANDOM_SECURITY_STRING_AT_LEAST_40_CHARS',
    'timeout'    => '24 hours',
],

OpauthLoginCidadao

Class: MapasCulturais\AuthProviders\OpauthLoginCidadao

Login Cidadão is the Brazilian federal government's single sign-on service, also marketed as ID Cultura when used by the Ministry of Culture. Authentication uses OAuth 2.0 with dedicated token and user-info endpoints.

'auth.provider' => 'OpauthLoginCidadao',
'auth.config'   => [
    'client_id'         => 'YOUR-CLIENT-ID',
    'client_secret'     => 'YOUR-CLIENT-SECRET',
    'auth_endpoint'     => 'https://id.cultura.gov.br/oauth/v2/auth',
    'token_endpoint'    => 'https://id.cultura.gov.br/oauth/v2/token',
    'user_info_endpoint'=> 'https://id.cultura.gov.br/api/v1/person.json',
    'timeout'           => '24 hours',
    'salt'              => 'RANDOM_SECURITY_STRING_AT_LEAST_40_CHARS',
],

Logout inside the application

Login Cidadão does not support federated logout automatically. To log a user out of the identity provider from within Mapas Culturais, add a JavaScript function to your theme's header template.

vi src/themes/YOUR_THEME/layouts/parts/header-main-nav.php

<script type="text/javascript">
function logoutForce() {
    window.open('https://YOUR_LC_DOMAIN/logout', '_blank');
    alert('Logout efetuado com sucesso!');
    location.reload();
}
</script>

<a href="<?php echo $app->createUrl('auth', 'logout'); ?>"
   onclick="return logoutForce()">Sair</a>

OpauthAuthentik

Class: MapasCulturais\AuthProviders\OpauthAuthentik

Authentik is an open-source identity provider that supports OAuth 2.0 and OIDC. Use this provider when your organization self-hosts Authentik.

'auth.provider' => 'OpauthAuthentik',
'auth.config'   => [
    'client_id'           => 'YOUR-CLIENT-ID',
    'client_secret'       => 'YOUR-CLIENT-SECRET',
    'login_url'           => 'https://authentik.example.org',
    'logout_url'          => 'https://authentik.example.org/application/o/YOUR_APP/end-session/',
    'change_password_url' => 'https://authentik.example.org/if/user/#/settings',
    'timeout'             => '24 hours',
    'salt'                => 'RANDOM_SECURITY_STRING_AT_LEAST_40_CHARS',
],

Session configuration

All providers share a timeout option that controls how long an authenticated session remains valid. The value is a human-readable duration string parsed by PHP's strtotime.

'auth.config' => [
    // ...
    'timeout' => '8 hours',  // or '30 minutes', '7 days', etc.
],

After the timeout elapses, the user is treated as a guest and redirected to the login page on the next request that requires authentication.

Provider capabilities often implemented in custom integrations

The legacy documentation included a dedicated guide for a richer local-auth setup (MultipleLocalAuth). Even if that exact plugin is not part of the new canonical tree, the underlying capabilities are still relevant when evaluating an auth provider strategy.

Common capabilities that may live in a custom provider, installation plugin, or theme integration include:

• multiple sign-in methods on the same screen
• password strength policies and recovery UX
• CPF or local identifier login
• reCAPTCHA on login or registration flows
• federated login buttons for external providers
• custom logout behavior inside the active installation theme

When documenting or debugging authentication, separate core provider behavior from installation-specific UX and policy layers. In RedeMapas, those layers often meet in the theme and surrounding configuration rather than in the provider class alone.

How the auth provider is called

The application resolves the active provider through App::getAuth(). Controllers call $controller->requireAuthentication() at the top of any action that needs a logged-in user; this redirects anonymous visitors to the login page and resumes execution after authentication.

// Retrieve the active auth provider
$auth = $app->getAuth();

// Get the currently authenticated user (returns GuestUser if not logged in)
$user = $auth->getAuthenticatedUser();

// Check whether a user is logged in
$isLoggedIn = $auth->isUserAuthenticated();

On successful login, the provider fires the auth.successful hook, which updates lastLoginTimestamp and sends any pending notifications.