Re: Status & CVS & objects

[Aaron Turner <aturner@linuxkb.org>]

On Thu, 4 Nov 1999, Jason Pincin wrote:

> We obviously have a lot to talk about regarding authentication.
> 
> No one seems to be agreeing.  We could just ditch http_auth altogether and
> go back to some kinda custom auth scheme... 

Personally, I say "Why re-invent the wheel?".  HTTP Auth is EASY to
impliment, is cross platform (yes even Lynx support it), and doesn't have
any wierd issues like some people redirecting their cookie file to
/dev/null.  
 
> I don't know enuf about http_auth to talk about it much.  I need to school
> myself or have someone explain it all to me before I say much more...

Well, then what do you need to know?

Basically to do this in PHP you have to:

1) Check to see if URL is "protected".
  - if no, then do nothing.
  - yes, then:

a. see what "domain" it is protected under.  This is analogus to
	/etc/groups

b. see if user is already logged in (look for the http-auth header the
	client sends to the server)
  - if no, then force http auth, client will resend query
  - if yes, then:

	1) Lookup user in password table & verify password matches
		-if no, then send error
		-if yes, continue:
	2) Lookup user in groups table & verify user is in the "domain"
		-if no, then send "you're not authorized" error
		-if yes, then serve the page.