Re: auth report.

[Micah Yoder <LYoder@cyberis.net>]

Looks OK to me.  I'm not 100% sure how to implement it.  If you know
how, go for it.

We probably shouldn't call the directory cgi-bin though.  Neither PHP
nor mod-perl uses CGI techniques.  CGIs are external programs, not
module scripts.

"Aaron D. Turner" wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> Happy days.
> 
> After doing some research, I learned that we can do basically whatever we
> want.  So here's my proposal for how it will work:
> 
> 1)  One authentication zone for users to log in to (per virtual host)
> 2)  Protected files of the same "level" will be in the same directory
> 3)  Protected files of different security levels will be in different
> directories.
> 4)  The server security configuration will be done via .htaccess files in
> the protected directories.
> 
> What this means:
> 
> for cgi's we'd have:
> 
> /cgi-bin/               - anyone can run (no protection)
> /cgi-bin/comment/       - commenting scripts
> /cgi-bin/add/           - adding content to DB
> etc.
> 
> What this means to the user:
> 
> 1) Single login
> 2) We can authorize them seperately per-role
> 
> What this means to us:
> 
> 1) Security settings are placed in CVS.
> 2) No scripts are even aware of the security.
> 3) We can create directories to support static HTML pages too.
> 4) Security is done by a mod_perl module called via .htaccess
> 5) Authentication is done by user/passwd and cross-referencing the
> directory to the User->RoleID.
> 6) Super fast since mod_perl allows caching of auth information, reducing
> DB lookups.
> 
> Micah, does this answer all your concerns?  Is there something I'm
> missing?