Re: Authentication vs. Authorization

Martin Jansen made pretty good arguments in the past in regards to Authentication vs Authorization... http://marc.theaimsgroup.com/?l=pear-general&m=100252782901898&w=2 SUB: Re: [PEAR] a user class DATE: 2001-10-08 7:58:54 http://marc.theaimsgroup.com/?l=pear-general&m=100893621520427&w=2 SUB: Re: [PEAR] Pear Auth DATE: 2001-12-21 12:03:09 Until I actually sat down and read ALL the threads in PEAR:GENERAL about Auth, I too had the thought that Auth should have some Authorization method to it. But, after some thought, and reading the history here, I've come to agree that Auth should stick to what it does best and something else can handle Authorization. I've even taken this a step farther and have concluded that addUser() and remove User() should not even be in PEAR:Auth. But it might be a little late for that now. Now, with the new auth in CVS, I see that changePassword() has been added. (Yes, I know, I asked for it some time ago. But I've "seen the light!") Since Martin and a few others convinced me that the route to take is to create an extension to Auth to handle authorization, have spent the last few months, on and off, doing just that. AuthUser is mostly complete, it handles the complete gambit of operation for authentication and authorization. It builds off Auth to handle the authentication side, and then it handles the authorization. There could be containers to handle the various backends (I can't test against many, so I will need some help there), just like Auth. All I have is DB right now. (Yes, I know LiveUser exists) One thing I do have in AuthUser, and I think it should be in Auth is... // How many times will we allow a login attempt? // ZERO (default) - no limit //$objAuth->setLoginAttemptsMax(4); If a user fails the given times, login will not happen again. It needs to have something to stop a user from simply closing a browser and trying again. But, it's my first stab at this. I figure the security gurus here could solve this issue in about 10 seconds. Anyway. I would appreciate some feedback on this. Thanks Walter ====================================================================== Torres Development Group Systems Design & Development Services web.torres.ws C++ Perl PHP V:708-288-5859 F:714-908-8403 [d]HTML CSS Javascript ======================================================================