The way I like to do it is to use a LDAP server for authentication and
entitlement. In addition to both username and password being stored, you
can create attributes that will allow you to define the level of access for
each user.
Also, with a centralized LDAP service, all your web servers are accessing
the same data. Furthermore, you don't need session objects to maintain
state across web servers. You just store their state information in the
ldap server and it's available to all web servers. Oh yeah, you can use a
database for similiar function, but I prefer LDAP. It's faster for searches
of large databases, plus the majority of the ldap protocol is supported
across various implementations.
Nothing is as trivial as it sounds, but check it out. Best of all... it's
free.
fsk
-----Original Message-----
From: Joe Schulman [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, June 06, 2001 4:57 PM
To: Beginners-Cgi
Subject: Usernames and Passwords
Hey~
This is mainly a question directed to those with experience in this sort of
thing.
In general, how should one go about authenticating a user and then allowing
them to view separate pages under that particular login?
I know that cookies aren't 100% reliable, and I also know that sending
secret and often vital information like that over open,
non-encrypted streams is not the best way to go.
Encryption, sadly, is not an option for this particular case.
Could anyone please help me in this matter?
TIA,
Joe
*******************************************************************************
<<Disclaimer>>
This message is intended only for the use of the Addressee and
may contain information that is PRIVILEGED and/or
CONFIDENTIAL or both.
This email is intended only for the personal and confidential use
of the recipient(s) named above.
If the reader of this email is not an intended recipient, you have
received this email in error and any review, dissemination,
distribution or copying is strictly prohibited.
If you have received this email in error, please notify the sender
immediately by return mail and permanently deleting the copy
you received.
Thank you.
*******************************************************************************
