RE: [PEAR-DEV] New Package Proposal: Enterprise A&A

Yeah I saw live user. There are some similar concepts and you have the benefit of at least a couple of additional heads. I didn't see a convenient link to CVS for it on the PEAR site so without seeing some of the code, it doesn't sound like it was designed to be exposed as a web service. Is that right? Regarding implied rights, the A&A system makes no assumptions about how permissions are used. It is up to the application to design appriopriate permissions as needed. That, IMHO, offers the greatest level of flexibility. All I do is get the groups a user belongs to any rights those groups may have and any rights tied directly to the user. How those rights are used is up to the application. So, now what? --Tony On Tue, 14 Jan 2003, Lukas Smith wrote: > > -----Original Message----- > > From: Tony Bibbs [mailto:tony@tonybibbs.com] > > Sent: Tuesday, January 14, 2003 8:28 PM > > To: Roberto Bertó > > Cc: PEAR Development > > Subject: Re: [PEAR-DEV] New Package Proposal: Enterprise A&A > > > > > > Like I said, I have a mostly working version of it. I need to do a > few > > CVS updates to have CVS working. In the meantime you can peep it > here: > > > > > > http://cvs.geeklog.net/chora/cvs.php/A_and_A?login=2&Horde=94843094d509d > 53 > > f118717c247cefa3d > > > > Here is an authentication sample: > > > > $user = &AAServiceInterface::authenticate($_CONF['AA_server'], > > $_CONF['AA_server_path'], $_CONF['AA_appId'], > > $_POST['username'], > > $_POST['password'], $_CONF['AA_port']); > > > > The code is pretty well structured but still could use some > approvements. > > This task is a huge one so I could use at least one other head on it > to > > help get it stable...assuming it gets approved. > > > > Authorization model is heirarchical. Groups are supported. Nested > groups > > are supported too. Privileges can be tied to groups or individuals. > > > > FYI you *can* use this for just authentication if you want. A good > > example of that would be integrating two apps which manage their own > user > > data and permissions. If you wanted a single credential set you > simply > > swap out their authentication with calls to this A&A service. > Obviously > > some customizations would be needed on account creation but it's not > that > > bad. > > > > sounds good. > There is already a package with very similar goals as yours .. its > called LiveUser. The current package is also somewhere in alpha/beta but > this is due to the large changes that were made after the author through > the package out in the open. > > I have added a lot of wacky features to it, which let to the creation > the concept of allowing different complexity levels and my stuff got > laid off for now because I did not have time to keep up with > development. > > Anyways this sounds like good stuff, but a look at LiveUser > (http://projects.21st-hq.de/liveuser/) will give you an idea about the > competition :-) > > Features that LiveUser has or should get that you haven’t listed that > spring to my mind atm are: > - Grouping rights into categories (and categories grouped in > applications) > - Implied rights (update implies read ... that was one of my wacky > features) > - Container Approach to allow easy connection to different sources for > auth and permissions > > Regards, > Lukas > > > -- ------------------------------------------------------------------------| Tony Bibbs | "I guess you have to remember that those who don't | tony@tonybibbs.com | hunt or fish often see those of us who do as | | harmlessly strange and sort of amusing. When you | | think about it, that might be a fair assessment." | | --Unknown | ------------------------------------------------------------------------|