Re: [phplib] Thoughts about Auth merging to PEAR From: giancarlo pinerolo (ping <email protected>)
Date: 07/22/01

Björn Schotte wrote:

> After that, there's need to carefully see how easy Auth
> could be ported to PEAR - i.e. not relying on PHPLIB:Session
> but relying on PHP4 native Session system or, for compatibility
> reasons in the first step, using session4.inc with session4_custom.inc.

You started from the hardest point eh?

There is no compatibility between Session4_custom and PHPLIB session3,
because the first uses PHP4 serialize() function for objects and PHP4
encode() for values.
PHPlib session3 stores backslashed PHP code.

I dunno how many can be interested in saving user stuff in /tmp or
wherever on the filesystem, so I'd start with Session4_custom straight.

I'd find a way to have it work with php4session(filesystem) /
php4session_custom(db).
Then, afterwards, think eventually how to extend it for backward
compatibility to PHPLIB3session

Why do you not mention session?

Do you mean you want to part auth from session?
You want to have an auth that can work with any other PEAR session
module? it is not impossible.

An Auth with no/default perm or a pluggable perm is easier

Of course one that works with PHPLIB session (3 or 4) is easy, in facts
is done.

What can be the goals?

Minimal, pluggable auth needs:
-A container to store its data
-You cannot part auth from the existance of any session. So you must
have a session capable of keeping the auth object once yo've been
authenticated.
-an auth_user table (container)

To cut it immediately, I'd have it be a default_auth, with a default
perms, inf not other perm module is specified or plugged. So with
'nobody' with no level, or a real username of level 'user'.
defalt_auth is a superset of auth, and I wouldn't do all this work to
loose the very best feature.
I want to use the same scripts for both authenticated an not
authenticated user, was it only for the benefit of not having to keep
two up-to-date copies of them.

There is to think here about this. I saw that the Example_Auth entry
for 'nobody' in the table tend to fill up (eg.: the $u counter in
kris/test for 'nobody' gets to very high numbers after a while, being
hitted by every 'nobody' that passes there, as it does never garbage
collected, an can erroneously contain other things as objects used by
other 'nobodies'). To avoid this you end up in swapping objects from the
'session' space' (for the not yes authenticated visitor) to the 'auth'
space aafter he is authenticated and after every $perm->check. ANd some
methods to do that were highly desirable.

But maybe I am wrong on this, as the 'nobody' AKA default_auth in PHPLIB
looks like being added later, and having thought of it beforehand
might have given better results.

So you must define what is your goal. It can be:

-having an aut that works with phplib(PEARified?) session4
-have an auth that works with 'any' other session module available to
PEAR
-having/not default_auth, or with a default perm scheme (mothing/user)

add more....

Giancarlo 

-- 
Abbestellen mit Mail an:   phplib-unsubscribe <email protected>
Kommandoliste mit Mail an: phplib-help <email protected>