Re: Some docs help

Guyren G Howe wrote:
> 
> On Sep 12, 2005, at 2:16 AM, Lukas Kahwe Smith wrote:
> 
>>> In the table liveuser_perm_users, what is the purpose of the  fields  
>>> auth_container_name and perm_type? auth_container_name  would seem 
>>> to  be something to do with the source of authorization  for the 
>>> user. But  since the authorization system-specific info  about a user 
>>> goes (I  understand) in liveuser_users, I can't  fathom what this 
>>> field is for.
>>>
>>
>> yes, all auth specific data is stored in the liveuser_users table.  
>> however remember that the purpose of liveuser_perm_users is to map  a 
>> specific auth user from a specific auth container to a perm user.  
>> also remember that the same auth user id could be used in multiple  
>> auth container sources and therefore to uniquely identify an auth  
>> user you need to use the auth user id _and_ auth container name.
> 
> 
> I'm afraid I'm still confused. I would have *thought* the way to  
> represent all of this was to have the following fields in the  
> liveuser_users table:
> 
> pk: a primary key
> authuserid: userid in foreign auth system
> authsystemid: fk reference (possibly implicit) to which auth system  the 
> above authuserid field refers
> perm_user_id: fk referring to which liveuser_perm user this  
> authorization applies
> 
> Then in liveuser_perm_user, we have a primary key and perm_type and  
> stuff that applies to a given user, rather than how they were  authorized.

No. Auth is separate of everything else. Auth needs no modification for 
LiveUser at all. Remember we could be authenticating against some old 
legacy database. This is the basic assumption. The authentication 
database may not be modifyable. Even if people use the LiveUser auth 
container we cannot change this assumption of course.

So all the LiveUser specific stuff is in the perm container. So what we 
do is we map every auth user from each auth container to a single 
perm_user_id. This perm_user_id is the true unique identifier for a user 
within LiveUser.

> IOW, the authuserid would seem to be a feature of a given  authorization 
> system, not of a canonical user (which is what  liveuser_perm_user is, 
> right)? Put yet another way, if a given  canonical user can access the 
> user via more than one authorization,  which authorization system's 
> auth_container_name do we put in that  field in liveuser_perm_users?

You can in theory map multiple users from multiple auth sources to the 
same perm user id. I have never tried this out myself.

>>> What is the purpose of liveuser_groups.group_type?
>>>
>>
>> this is just a metadata field to help people separate "user groups"  
>> from "roles" ..
> 
> 
> How so? What values can this field take, and what do these values  connote?

define('LIVEUSER_GROUP_TYPE_ALL',   1);
define('LIVEUSER_GROUP_TYPE_ROLE',  2);
define('LIVEUSER_GROUP_TYPE_USER',  3);

but you can store whatever you want .. like i said .. LiveUser doesnt do 
anything with the value aside from writing and reading if you request 
LiveUser todo so in the addGroup()/updateGroup() or getGroups() method.

regards,
Lukas