Re: Auth

Quoting Mikhail Zabaluev <mookid@sigent.ru>: > Well, I did some scratching on that. In my vision, it could be a bunch of > classes with generic interface(s). Different classes would cover DB-based > authentication, tokens supplied via standard HTTP auth, storage of auth > data in session etc. We could team up on the design of this thing. It seems there are two pieces needed, something like Auth_Store and Auth_Token. Both of these should be abstract classes, and any Auth_Store should be able to work with any Auth_Token (although I can think of a few scenarios where this wouldn't be the case, but I don't think it breaks the design). Auth_Store would be subclassed into SQL, LDAP, File, Htpasswd - any backends imaginable. Auth_Token would have Cookie, Get, and HTTP subclasses, to think of a few. We'd probably want some way of verifying tokens (md5 signature?) so that you don't need login information or to hit the backend on every single page. How's this for a start? -chuck -- Charles Hagenbuch, <chuck@horde.org> "If you can't stand the heat, get out of the chicken!" - Baby Blues