Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:21299
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Date: Wed, 21 Dec 2005 03:56:06 -0500
To: Wez Furlong <kingwez@gmail.com>
Cc: internals@lists.php.net
Message-ID: <20051221035606.18815a25.mba2000@ioplex.com>
In-Reply-To: <4e89b4260512202258j47f6745foe3b3f4d493b6cbba@mail.gmail.com>
References: <20051221005926.4c8ad254.mba2000@ioplex.com>
	<4e89b4260512202258j47f6745foe3b3f4d493b6cbba@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Maintaining State Across Requests / An SSO Extension
From: mba2000@ioplex.com (Michael B Allen)

On Wed, 21 Dec 2005 01:58:41 -0500
Wez Furlong <kingwez@gmail.com> wrote:

> Just curious, why aren't you writing this as an apache module?
> 
> Is this of any use; it seems a bit dated, but could save you some effort:
> http://meta.cesnet.cz/cms/opencms/en/docs/software/devel/negotiate.html

Well for one, mod_auth_gss_krb5 only does authentication. My *real*
product is Windows integration libraries for non-Windows environments
(i.e. LAMP). So, for example, this SSO module is going to include Windows
authorization functionality for integration with AD. Meaning the developer
can restrict content based on group membership of groups defined in an
AD domain:

  $auth = sso_authenticate();
  if (!sso_is_member($auth, "Authenticated Users")) {
      header("Location: /login.php");
      die("You are not authorized to access this content.");
  }

  ...

  if (sso_is_member($auth, "FOONET\\Engineers")) {
      echo "Engineers rule!";
  } else if (sso_is_member($auth, "FOONET\\Consultants")) {
      echo "Consultants rule!";
  }

Also I think there's also alot of polish that can go into failing over to
other authentication methods and redirecting to login pages and so on. You
just can't do any of this well unless your at the language level.

Mike