Re: Authentication

[Micah Yoder <LYoder@cyberis.net>]

"Aaron D. Turner" wrote:

> Now I'm confused.  Isn't what you're talking about above exactly what
> we've been talking about for the past few weeks?  Basically having a web
> page which the user login's and then some means of cookies/variables/URL
> to keep track that the user is "logged in" or not?

No...

With this method, the browser still pops up the window asking for
user/passwd, but the script handles the authentication.  Much like the
login form method, only the browser displays the form so we don't need
to code it in HTML.

> Basically these PHP variables:
> 
> 1)  How do you access them from a Perl/CGI script?

You'd need to parse HTTP headers to get them.  Again, I assume there's
Perl code for it somewhere.

> 2)  How to you access them from a plain HTML file?

You don't, nor do you need to.  Plain HTML files aren't protected.

> 3)  How do you keep state?

The browser sends the info every time you access the site AFTER the
first time a login is requested...   OK....

Bozo goes to http://linuxkb.org
Browses and searches articles, no problem
Loads the comment page
Code notices that he needs to be logged in.  Sends an "HTTP
Authentication Required" message.  Bozo enters his handle and password.
Code checks his password, and if successful, posts comment.
From here on out, every time he accesses ANY page, the info will be
there.  Browser will not pop up auth window again.

> 4)  What if someone bookmarks a "protected" page and thereby by-passes
> the login page?  What happens then?  They *SHOULD* get a query to login
> and then be presented the page they requested.

There isn't a login page.  Any time they try to load a protected page,
and he is not logged in, he'll get an HTTP auth error and will get a
Passwd entry dialog box.

> Sure, but why bother?  HTTP Authentication is much better.  Why?  Because
> the only thing we need to worry about is defining the Authorization Zones
> (via .htaccess files in the directories).  We let the web server do the
> authentication and authorization.  As Roger showed, in his email, this is
> done via the httpd.conf file, so NO code is necessary for any PHP/CGI/HTML
> page.
> 
> The only problem we had in the past is that we couldn't interface our
> MySQL DB with HTTP Authentication.  Now, with mod_perl and the
> Apache::Authen module we can.
> 
> > Are there still objections????  I *could* be wrong, but I *think* it's
> > the easiest way to do it.
> 
> Consider this email an objection.  Plain-jane http auth that we've all
> come to know and love is the best IMHO.

Now I'm REALLY confused.  I though you were arguing against doing it
that way, mainly because of DB issues and whatever else.  Now you're
saying this is the best way to do it?  I thought you wanted just a
single HTML login page and then propagate login info with URLs or POST
variables.

Anyway, I think the method I described is probably marginally better
than "standard" server driven HTTP auth.  With this method, we'll be
able to check the user's RoleID with the same query that grabs his
password.  Using standard HTTP auth, we'd still have to run a query
AFTER he logs in to get the RoleID.