Passwording an application

[njw]

I would like to include a user table with passwords to allow, or not, access to the application. Are there any guidelines on how to do this - working on the web, rather than a LAN based system?

Many thanks

Neil

[shannah]

Currently Dataface doesn't officially deal with permissions or authentication. This will be added in the next release. Thus you are free to implement whatever form of authentication you like. There is a permissions() framework with Dataface that is not documented yet but this framework is independent of how you authenticate.

The forthcoming authentication framework will also be flexible for your implementation. It will allow you to specify the user table and username and password columns and handle the authentication from there. The logged in username will be stored inside the $_SESSION variables.

The permissions framework will allow you to define permissions on records using a getPermissions() method in the delegate class. I'll try to get some examples up soon.

[njw]

Thanks Steve. Any idea on timings?

[njw]

I have been taking a little break from Dataface and work to focus on my courses for the past few days. My plan was to release Dataface 0.5.4 for April 5/6. If the authentication framework doesn't make it into 0.5.4 it will be added in 0.5.5 which will be around April 20.

[njw]

Thanks Steve. Understand that the day job takes precedence!

The thing I'd most like to do is to allow more than one person access to the database, and use the MySQL security mechanism to restrict access. I have had a look at the code, and it doesn't look easy to put a login screen into the app without editing the dataface code. Am I right?

Many thanks

Neil

[shannah]

" method="POST">

Login

Username:
Password:

[njw]

Thanks a lot Steve. I don't need permissions at the moment, so no issue waiting for 0.5.4.

Thanks again

Neil

[shannah]

If you don't need permissions, why not use .htaccess files for authentication? That way you wouldn't have to modify any PHP code.

[njw]

All my users, including myself, are coming in over the web and don't have consistent IP addresses. What I am trying to avoid is holding the MySQL passwords in clear text, even though the php file is protected by a .htaccess directive.

Alternatively, I do know very little about these matters, so I accept I could be being naive!