[pmwiki-users] Rethinking passwords and authorization

[Michael Brenner]

Hello,

I mention this just to make sure it isn't left. If spaces for usernames are 
allowed it should be the same for groupnames e. g.: @"my group"

Regards - mik

Am Montag, 9. Oktober 2006 23:29 schrieb Patrick R. Michaud:
> I looking at how to provide a "list of all pages with
> passwords" capability, as well as a few other features, it
> occurs to me that *maybe* we should just revamp the entire
> password system we're using to become a little more regular.
>
> At the moment things get a bit complex because we have three
> ways of authorizing access:
>
>    - based on a password              ("secret_pw")
>    - based on an authenticated id     ("id:alice")
>    - based on membership in a group   ("@authors")
>
> So, someone can use ?action=attr to set an edit password like:
>
>     quick id:alice @authors id:bob
>
> and this means that "alice", "bob", anyone in the "@authors" group,
> or anyone who knows the password "quick" is allowed to edit
> the page.
>
> The above looks clean, but we start to run into difficulty
> when people expect to be able to mix the syntax at will:
>
>     id:alice,bob, at authors quick
>
> This gets very difficult for PmWiki to parse.  It will get worse
> when we try to allow userids with spaces in them:
>
>     id:"Alice Adams", at authors,"Bob Barker" "multi word password"
>
> or when we try to revoke access:
>
>     @authors id:"Alice Adams",-carol,"Bob Barker"
>
> Does anyone have any suggestions for how we might clean up
> the syntax a bit?  Or is this about the best we can do given
> the overall flexibility desired?
>
> Just for background:  I think we need to be able specify
> authorization based on (1) knowledge of a password, (2) authenticated
> identity (userid), and/or (3) membership in a group.  It would also be
> nice to have a way to revoke access based on userid or group
> membership (e.g., "everyone in this group except XYZ").
>
> Thanks in advance for any suggestions,
>
> Pm
>
> _______________________________________________
> pmwiki-users mailing list
> pmwiki-users at pmichaud.com
> http://www.pmichaud.com/mailman/listinfo/pmwiki-users