I completely agree with this PR, however we're going to need to be careful as far as version management is concerned. We'll need to document the change and the upgrade path for people using the current versions, so we may want to do this at a point release point.

It seems this is the same as the "Builtin" authentication.

Yes, but it's different from what phpvirtualbox currently does, so some user migration will be required. No?

I don't use it, but as far as I can see from the code, the username and password are stored in the extradata section of virtualbox.

If there is a difference, you have to explain it a bit more detailed.

I have just tested this new authentication module.

It is totally different from the 'Builtin' authentication module which store username and password hash in virtualbox's extradata.

Instead of setting var $username and var $password in config.php, you can directly log in as the user running Virtualbox webserver, so that you don't have to store username and password in plain text in config.php.

Of course, this module is only relevant for a single user configuration.

However, the "vboxmanage" commands stated by @xqus are useless. The provided code doesn't look at Virtualbox "extradatas", it only checks that the given username and password are accepted by vboxwebsrv.