Re: Status & CVS & objects

[Jason Pincin <chardros@linuxkb.org>]

> Personally, I say "Why re-invent the wheel?".  HTTP Auth is EASY to
> impliment, is cross platform (yes even Lynx support it), and doesn't have
> any wierd issues like some people redirecting their cookie file to

Thats fine.  As long as it works well.  I'm not a fan of kludges.

> Well, then what do you need to know?

A lot.

> Basically to do this in PHP you have to:
> 1) Check to see if URL is "protected".
>   - if no, then do nothing.
>   - yes, then:

OK - I was under the impression that we were changing this.  There will be
no "protected" url's.  All permissions and security will be stored in the
Database.  The URL will mean nothing.  The only thing we were going to use
http_auth for was to track which user was logged in.  We were only going
to have one "protected" zone, and thats where auth's would occur.  Nothing
else.

> a. see what "domain" it is protected under.  This is analogus to
> 	/etc/groups

huh?  I think my statement above voids this no?

> b. see if user is already logged in (look for the http-auth header the
> 	client sends to the server)
>   - if no, then force http auth, client will resend query
>   - if yes, then:

This is easy.

> 	1) Lookup user in password table & verify password matches
> 		-if no, then send error
> 		-if yes, continue:
> 	2) Lookup user in groups table & verify user is in the "domain"
> 		-if no, then send "you're not authorized" error
> 		-if yes, then serve the page.
> 

What I don't understand - is HOW PHP IS GOING TO SET THE PROPER HTTP AUTH
FLAGS OR whatever in the browser.  ?????  Am I missing something really
dumb?


-- 
Jason
http://vodka.linuxkb.org/~chardros