Re: Anybody working on SSO class/project ???

Martin Jansen said: >>unfortunately I must have missed the start of this discussion... > > Nicols' email, on which Tomas replied, was basically the start of > the discussion. BTW: You can always browse/search the archive of > the PEAR mailing lists on http://news.php.net/ and > http://marc.theaimsgroup.com/. I know, thanks, I´ve catched up now. >>what´s the "user" thing? > > Some time ago we discussed about a flexible system to manage > permission handling and we came to the conclusion that this > shouldn't be > integrated in the Auth package but that it should be a package on > its own. After that discussion took place, there were no news > lately, but right now it seems as if the topic emerged from the > dust again :). So it´s the same old story that we have seen happening with many many discussions so far ;-) I guess it´ll stay that way until someone says loud and clear "okay, I´ll reschedule my life and do it for PEAR", which is how it works in open source business... >>I´ve invested quite some time in this topic >>and have already built a user and access rights management class >>that is very flexible so that it can easily integrated into the >>most different applications. >>[...] > > I also developed such a thingie for the company I'm working for and > we are using it in several applications. It supports different > storage containers and so on and I'll review it if we can re-use > something for PEAR::User (or however the package will be called). Yep, maybe we can join forces for such a package. For example, I have no experience (at all) with LDAP servers - so all I could do is provide the technical possibility to conncet to one, but I wouldn´t know how to properly implement data storage and retrieval. Do you have experience in that? >>This depends on how you define user data. What information would >>you like to store about the user? > > When I think of User management, I consider permission handling as > an integral and the perhaps most important task. Apart from that it > would be nice to store the personal information (email address, day > of birdth, social number, number of current girlfriends etc.). But > actually it should be possible to also store additional data on a > per-application base: Some applications might need a way to store > personal preferences, prefered HTML theme etc. for personalized > websites and so on. My thoughts exactly. What I´d do is provide a unique user identifier that is always the same no matter what kind of storage container you use for your user data. Applications can then store any additional information they want in any way they want and can cross-reference that user profile with the access rights and login information using that unique identifier. The rights system that I have works this way: - There can be an unlimited number of applications - Each application can have an unlimited number of authorization areas - In each area, you can have an unlimited number of rights All applications, areas and rights are identified by their names. A name only has to be unique in its own namespace, ie. you can have an autharea "usermanagement" in two different applications, but not two areas of the same name within the same application. You can then define usergroups and assign to them rights within any area of any application. Users can belong to an unlimited number of usergroups and automatically inherit all rights of the groups they belong to. However, you can also assign rights on a per-user-basis. That means, you can give a user individual rights that he doesn´t inherit from any group membership. Also, you can define rights that a user may never, ever have - even if he´s a member of a usergroup that he normally would inherit these rights from. Regards, Markus -- *21st Media* | Consulting, Konzeption, Produktion für die Bereiche: Markus Wolff | Internet, Intranet, eCommerce, Content Management, Hamburg,Germany | Softwareentwicklung, 3D-Animation, Videostreaming http://21st.de | Tel. [+49](0)40/6887949-0, Fax: [+49](0)40/6887949-1