Re: PEAR::LiveUser authentification/authorization

Hi

On 4.4.2006 13:58 Uhr, qMax wrote:
> Hi.
> 
> I'm far not satisfied with existed auth/perm system:
> 1. it does not support user groups
>    (although perm module can determine groups by userid, for each request)
> 2. it relies on numeric values of uid,
>    (this also avoids #3)
> 3. it cannot get credentials (username AND groups) from external existed database,
>    for instance - ldap
> 4. it does not support roles other then 'edit' and 'admin', because
>    bxcmsauth action used in main sitemap in output stage(!)

It's called *simple*perm for a reason :)

The main idea behind the permission framework was, that the perm modules 
are exchangeable, depending on what you need. simpleperm was just a 
quick solution for this. a more advanced perm is on our TODO list, but 
still it will just be another permmodule. The main advantage is, that 
simpleperm is fast and is enough for a lot of use-cases.

> The closest framework i've found to satisfy these needs is PEAR::LiveUser.

Yes, but it's a beast :)

> It seems like not much modifications should happen in core.
> (beside writing LiveUser backends/wrappers for bxcms)

You just have to write a new permission and evt. auth module. Basically 
there's no need to change something in the core (more about that below)

> /*
> although,
> it is possible to refactor auth and perm interfaces to better support
> random credentials (user,group,ip-range,or ever referer)
> */

referer? OMG :) I agree with the rest, but that should be handled in the 
isAllowed method of your perm module and not somewhere in the core.

Basically, if you don't need permissions, it shouldn't slow down Flux 
CMS. Maybe some more isAllowed calls, but the "true" perm-module just 
returns true there. always.

> Has anyone tried to integrate it into bxcms ?

I looked once into LiveUser but as i said, it's a beast :)

> And also there's a question:
> How could i configure custom roles,
> for instance - 'post' and 'comment' for blog
> (supposed to be in user-space, not an admin interface)

we need  some common "ground" for the roles in the isAllowed calls, 
currerntly we only have "admin", "read" and "read_navi" there. We 
certainly need more (and they have to be integrated into the 
plugins/etc) for more advanced perm-modules. But all should use the same 
roles. If you have any good suggestions for that, we're more than happy 
to hear about it.


> /* here im again crying that bxcms does not use popoon directly :) */

We have our reasons for that and I know, I still owe you an answer to that.

chregu

> 

-- 
christian stocker | Bitflux GmbH | schoeneggstrasse 5 | ch-8004 zurich
phone +41 44 240 56 70 | mobile +41 76 561 88 60 | fax +41 1 240 56 71
http://www.bitflux.ch | [email protected] |  GPG 0x5CE1DECB
-- 
bitflux-cms mailing list
[email protected]
http://lists.bitflux.ch/cgi-bin/listinfo/bitflux-cms