On Wed, Feb 27, 2002 at 10:47:15PM +0100, Magnus Lie Hetland wrote: > Mike Orr <[EMAIL PROTECTED]>: > [...] > > That sounds familiar too... > > > > In any case, when we figure it out we need to put it on the wiki as an > > alternate authentication method. > > Yeah. I would even go so far as to suggest perhaps a utility method or > two... No real need to go through all this explicit header-passing and > environment variable-parsing if you could just have a method that > dealt with it... E.g. instead of having req.remoteUser() raise an > exception if the user isn't log in, how about asking the user for a > username and password? (This may not be the most appropriate place to > put the code -- I don't know.) > > > > But there is no such standard for the password, IIRC. > > > > If you need the password, van you use database authentication and look up the > > password in the database by the username? > > If I have a database authentication solution, I will no longer need > the password. The problem is that I'm currently using a plain vanilla > binary rpm installation of Apache, and would rather not mess around > with compiling and installing modules unless I really have to. If I > could solve this all in Webware, that would be preferrable. > (Otherwise, mod_auth_pgsql sounds like a very good alternative.)
Debian has packages for all the major auth modules -- even a lesser distribution like RedHat probably has the same ;) So it's pretty easy. > Anyhow: Whether it be based on HTTP authentication, or a standard > cgi/form/session solution, it seems to me that a fully encapsulated > and extremely simple authentication mechanism would be useful in > Webware. The example from the distribution is nice enough (and I've > recoded it into a custom version), but not exactly dead simple; if I > were a newbie trying to set up a password-protected PSP page, I would > probably give up very quickly. I have a decent solution for the way I make my pages -- but what I'd *like* to be able to do in a page is throw an exception that would cause a login page (and the same for a redirect). Doing this with the current system (dictated by Page and somewhat by Servlet) is difficult and crude. I use a special method I coded into HTTPResponse that catches all the .write()s and I wrap both the awake()s and writeContent()s in try's, and I set a instance variable if something happens... but it's crude and has had a number of subtle bugs. Having awake() and writeContent() seperate makes it difficult -- I kind of like the pattern of using awake() for actions, but I sometimes wish I didn't do it that way and just put everything in writeContent(). -- Ian Bicking Colorstudy Web Design [EMAIL PROTECTED] http://www.colorstudy.com 4869 N Talman Ave, Chicago, IL 60625 / (773) 275-7241 _______________________________________________ Webware-discuss mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/webware-discuss
