[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Authentication
-----BEGIN PGP SIGNED MESSAGE-----
On Mon, 1 Mar 1999, Micah Yoder wrote:
> "Aaron D. Turner" wrote:
>
> > Weren't you there when we discussed this via IRC? We shot it down then,
>
> Maybe, I don't remember.
>
> > but I'd be willing to re-open discussions. The main problem with http
> > auth, is inserting records and verification. Flat files will not give us
> > the performance we need. This gives us two options:
>
> Minor misunderstanding here. By HTTP authentication, I'm not talking
> about letting Apache handle it for us. The PHP script actually does the
> checking. (or more accurately, the included connect.php3)
We'll HTTP authentication *IS* where you let the web server do it for you.
:-)
> PHP sets variables - $PHP_AUTH_USER and $PHP_AUTH_PASSWD or something
> like that. If the password variable != the user's password in the DB,
> we send back the access denied screen. Really pretty easy. It's pretty
> much EXACTLY the same code we'd use if they were logging in via a form
> or used cookies.
Now I'm confused. Isn't what you're talking about above exactly what
we've been talking about for the past few weeks? Basically having a web
page which the user login's and then some means of cookies/variables/URL
to keep track that the user is "logged in" or not?
Basically these PHP variables:
1) How do you access them from a Perl/CGI script?
2) How to you access them from a plain HTML file?
3) How do you keep state?
4) What if someone bookmarks a "protected" page and thereby by-passes
the login page? What happens then? They *SHOULD* get a query to login
and then be presented the page they requested.
> I'd assume there's a Perl module that will also extract that info and
> put it in Perl variables, but if not, it should be easy to parse the
> headers.
Sure, but why bother? HTTP Authentication is much better. Why? Because
the only thing we need to worry about is defining the Authorization Zones
(via .htaccess files in the directories). We let the web server do the
authentication and authorization. As Roger showed, in his email, this is
done via the httpd.conf file, so NO code is necessary for any PHP/CGI/HTML
page.
The only problem we had in the past is that we couldn't interface our
MySQL DB with HTTP Authentication. Now, with mod_perl and the
Apache::Authen module we can.
> Are there still objections???? I *could* be wrong, but I *think* it's
> the easiest way to do it.
Consider this email an objection. Plain-jane http auth that we've all
come to know and love is the best IMHO.
- --
Aaron Turner | Either which way, one half dozen or another.
aturner@pobox.com | Check out the Red Hat Linux User's FAQ Online!
www.pobox.com/~aturner | http://www.pobox.com/~aturner/RedHat-FAQ/
All emails from this account are PGP signed. Lack of a signature is "bad".
PGP Key fingerprint = FB E1 CE ED 57 E4 AB 80 59 6E 60 BF 45 1B 20 E8
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBNtszmDM3jpXy1kJtAQFMUQP9HDUnA9PVu/afcs1GXeZ2O+L+YhAAmW38
A1zGjGE1+yBJPRAejkV6yt7kQYhvGlKgtmhEeQUMv+dSDbUyFC2XiPYJXHI2/75B
3W2EiggKmNYYOQZ/zSCNj0phpeZgER3qbCFN+bpkDpgsHm5HEs/Jm06WXIrhESnV
W3iBJCz74nw=
=unl+
-----END PGP SIGNATURE-----