Re: Authentication

[Micah Yoder <LYoder@cyberis.net>]

"Aaron D. Turner" wrote:

> Weren't you there when we discussed this via IRC?  We shot it down then,

Maybe, I don't remember.

> but I'd be willing to re-open discussions.  The main problem with http
> auth, is inserting records and verification.  Flat files will not give us
> the performance we need.  This gives us two options:

Minor misunderstanding here.  By HTTP authentication, I'm not talking
about letting Apache handle it for us.  The PHP script actually does the
checking.   (or more accurately, the included connect.php3)

PHP sets variables - $PHP_AUTH_USER and $PHP_AUTH_PASSWD or something
like that.  If the password variable != the user's password in the DB,
we send back the access denied screen.  Really pretty easy.  It's pretty
much EXACTLY the same code we'd use if they were logging in via a form
or used cookies.

I'd assume there's a Perl module that will also extract that info and
put it in Perl variables, but if not, it should be easy to parse the
headers.

Are there still objections????  I *could* be wrong, but I *think* it's
the easiest way to do it.