[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: auth report.
-----BEGIN PGP SIGNED MESSAGE-----
On Thu, 4 Mar 1999, Jason Pincin wrote:
> Hold up a sec. Will the different permissions for each role still be
> stored in the permissions table?
The mod_perl setup would still query the DB if that's what you're asking.
Basically it would cross reference the URL to the RoleID. If the user had
equal to or greater access than what was being requested then the user
would be authorized.
Make sense?
> On Thu, Mar 04, 1999 at 08:54:05AM -0800, Aaron D. Turner wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> >
> >
> > Happy days.
> >
> > After doing some research, I learned that we can do basically whatever we
> > want. So here's my proposal for how it will work:
> >
> > 1) One authentication zone for users to log in to (per virtual host)
> > 2) Protected files of the same "level" will be in the same directory
> > 3) Protected files of different security levels will be in different
> > directories.
> > 4) The server security configuration will be done via .htaccess files in
> > the protected directories.
> >
> > What this means:
> >
> > for cgi's we'd have:
> >
> > /cgi-bin/ - anyone can run (no protection)
> > /cgi-bin/comment/ - commenting scripts
> > /cgi-bin/add/ - adding content to DB
> > etc.
> >
> >
> > What this means to the user:
> >
> > 1) Single login
> > 2) We can authorize them seperately per-role
> >
> > What this means to us:
> >
> > 1) Security settings are placed in CVS.
> > 2) No scripts are even aware of the security.
> > 3) We can create directories to support static HTML pages too.
> > 4) Security is done by a mod_perl module called via .htaccess
> > 5) Authentication is done by user/passwd and cross-referencing the
> > directory to the User->RoleID.
> > 6) Super fast since mod_perl allows caching of auth information, reducing
> > DB lookups.
> >
> > Micah, does this answer all your concerns? Is there something I'm
> > missing?
> >
> > - --
> > Aaron Turner | Either which way, one half dozen or another.
> > aturner@pobox.com | Check out the Red Hat Linux User's FAQ Online!
> > www.pobox.com/~aturner | http://www.pobox.com/~aturner/RedHat-FAQ/
> > All emails from this account are PGP signed. Lack of a signature is "bad".
> > PGP Key fingerprint = FB E1 CE ED 57 E4 AB 80 59 6E 60 BF 45 1B 20 E8
> >
> >
> >
> > -----BEGIN PGP SIGNATURE-----
> > Version: 2.6.2
> >
> > iQCVAwUBNt66rjM3jpXy1kJtAQFCNgQAmUTukAQB7S6AAC08eU+Q7cV/tBq1jz+a
> > awBIa9UyfPnLcB8clk6I48dTCkMZ4+NhLcUbulqbLa582+2HaiEIbrkcET2brB6m
> > JOiHORHQevqZf5gCfA09s7b39/nlLA6mdj+Lk7JseU38/ESLBD8jY1VznY/8R6Ym
> > RCUrMM6i4wQ=
> > =CA7r
> > -----END PGP SIGNATURE-----
> ---end quoted text---
>
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBNt/7TzM3jpXy1kJtAQEzawQAplRZZW/VqU0ge0TUHabn+TehUBiHrM8w
Bseu49STcG45DG7BiDuNXjaU4Rc8WyzMru/H+E48ekCeYK14/+wz85w7Tpg5fQGR
kvi+322X+NqOK1pUYuzhafzQ4OUGP95kACACpDNGn84w8Fr5WEvmR/RXMrnobTi4
pZ/QgVqYPmM=
=b7fy
-----END PGP SIGNATURE-----