[pmwiki-users] Rethinking passwords and authorization

[Neil Herber]

At 2006-10-10  01:00 PM -0500, Patrick R. Michaud is rumored to have said:
>The main difficulty with requiring a prefix for passwords
>is that it doesn't quite work from an author perspective with a
>non-AuthUser-based PmWiki.
>
>In other words, on the ?action=attr form, how do we explain to
>authors/admins that in order to set a password they have to
>prefix it with "pw:"?  I think that many authors will be confused
>about why the prefix is needed, since PmWiki already "knows"
>that it's a password field.

OK, here is a way-out-in-left-field idea:

If the wiki is not using AuthUser, then only passwords apply and 
everything stays like it is now.

If the wiki is using AuthUser, then they may allow by authenticated 
id, by user group, or by shared password.
When someone displays the "attr" page, instead of having a single 
"password" box per "level" (level being read, edit, etc. - not sure 
of the correct word here) there will be 3 boxes per level -  one for 
passwords, one for ids and one for user groups.

Now there is no need for any prefix whatsoever, although PmWiki may 
internally use them to keep track of things.

The next question that should arise is, "What happens on the 
Site/AuthUser page?"

Since the page would only be of concern if AuthUser was in use, then 
I think the prefixes could be used with no confusion.
pw:
id:
gp:
or some other similar set. These could be the prefixes that the 
"attr" page uses "invisibly".



Neil Herber
Corporate info at http://www.eton.ca/