Re: SSO & HTTPS on pear.php.net

Hi Martin Jansen! You wrote: >> a) Enable HTTPS for PEARWeb. There are so many places (espacially when >> using >> wifi) where you have non-secure network connections. I hope that works on >> the server? > Most of the things for SSL support is already in place. Basically I > only need to get around to rebuild Apache+mod_ssl on the box. Sounds cool! When can you do it? :) >> b) Invent a real authentication method for the RPC connections of >> PEARWeb. > Please define "real". I thought about this a bit and I came up with the > idea of having something like > boolean user.isValid(string username, string password_hash) That's what is 'real' for me. :) > which returns true if username/password_hash are valid and false if > not. This still makes it possible to guess the password by flooding the > RPC server with requests, but it at least makes things a bit more > complicated. > Additionally one might restrict access to user.isValid to certain IP > addresses. Right. >>I >> guess that's a very usefull service, for services related with PEAR. In >> this >> case the wiki, but may be we get sometimes a messageboard and even an >> integration into PEARBot would be cool (so that you authenticate in #pear >> and are not bind to the hostmask). > Guys, I'm not sure if I like the idea of using the login database for > this sort of stuff. > And pear-dev is really not the place for such a discussion. Correct. That's why I switched to pear-webmaster now. :) Regards, Toby -- Tobias Schlitt a passion for php http://www.schlitt.info