[haiku-web] Re: Drupal-Trac Single Sign-On...

Hi Curtis,

2008/3/23, Curtis Wanner <katisu@xxxxxxxxxxx>:
> Nielx wrote:
>  > The current login method we use does this: it hijacks the login
>  > procedure. It connects to the drupal database, authenticates a user
>  > against that database, and then collects the user name and stores the
>  > email address in the session table. During subsequent calls, the email
>  > address is maintained and updated.
>
>
> Ah.  Sounds like it is more secure with the shared login.  I thought it was
>  more convenience than anything.  Changes my view of things quite a bit.

Well, it is more secure than the default, but the alternative has the
same merits, so we do not have to hang on to the old method for the
security. Furthermore, Trac does recognise the difference between
anonymous and authenticated users, and because of the way permissions
are configured on our system, it will not break open security. The
only thing is that using Trac's built in system, we would have to
manually keep a password file up to date.

>  > I also agree that the inconvenience would not be for the 'user', since
>  > they would register anyway. The only real inconvenience would be for
>  > me (or us), when we have to manually generate accounts for all the
>  > currently registered users :-).
>  >
>  > So I'm in favor for dropping the current link, even though it is still
>  > possible.
>
>
> So what exactly would the effect be on security without it?

Well, we would probably use the TracAccountmanager plugin, which sort
of does the same as our database login: it also hijacks the internal
procedures. It can be configured to use a large number of backends.
One of those backends is in the session table on the database itself,
others will allow it to store login data in a separate file.

So in essence the security will not change.

Niels.
-----------------------------------------------------------------------
haiku-web@xxxxxxxxxxxxx - Haiku Web & Developer Support Discussion List

Other related posts: