Hi there Zopers,
I'm currently trying to develop a LoginMethod for LoginManager which
uses CoreSessionTracking to store/access credentials, rather than
Basic HTTP Authorization or Basic Cookie Authorization. Here's why:
- Basic HTTP auth is unacceptable because we need form-based login.
- I've looked at other user folders which support cookies, and at
CookieCrumbler, and at the BasicCookieLogin class bundled with
LoginManager, but they all share the problem (in my mind) that
they store the username/password encoded in the cookie itself,
which isn't very secure - and doesn't extend well into storing
other information if I wanted to.
- I'd much rather use a token-based scheme where all sensitive
information is stored on the server, and the cookie is just a
token which can be mapped to that data. This seems to me to be
what CoreSessionTracking offers.
- The CST documentation mainly talk about CST as a way of tracking
anonymous sessions, but I see no reason why it couldn't be used
in this way too...?
If we assume that the above reasoning is sound and that this is
A Good Thing To Do, then I have the following problems:
- I haven't written a fully-fledged disk-based product yet. I've
looked at the tutorials and howtos but they're pretty basic.
Helpful, but basic. I've successfully created a stripped-down
do-nothing copy of the BasicCookieLogin class, but it's adding
the extra (CST-related) parts that I'm having difficulty with.
- If I could do it with a ZClass I reckon I could make it work,
but I can't see a way to create a ZClass which LoginManager can
use as a LoginMethod. There are subclasses for UserSources, but
not LoginMethods.
- Ideally I want it to be self-contained, so the LoginMethod
instance would contain a SessionIdManager and a
SessionDataManager - but I don't know how to do this properly/
morally/legally, or if it's even possible.
- Another approach would be to have the LoginMethod pick up a
SessionDataManager outside of it, but I'm having problems with
this too... I tried hard-coding an expected ID in the
LoginMethod and created a SessionDataManager with that ID in
the LoginManager, but the acquisition didn't work. Maybe I'm
missing something simple?
Basically I have too many gaps in my knowledge to pull this together
properly on my own, so it's time to ask for help. I'll be happy to
expand on any of the above if necessary... I've sure learnt a lot
about LoginManager and CST over the last few days, but I don't
quite the skills to suit action to intent... :-(
I'm assuming that this would be useful to other people if I could
get it to fly? If that's the case, I'd love to release it.
Similarly, if anyone wants to see the source of what I've tried so
far, let me know. Other than that, all input appreciated.
Thanks in advance,
Andy
--
Andy Gimblett - Programmer - Frontier Internet Services Limited
Tel: 029 20 820 044 Fax: 029 20 820 035 http://www.frontier.net.uk/
Statements made are at all times subject to Frontier's Terms and
Conditions of Business, which are available upon request.