Authentication

[digatle]

How is the best way to code a website for authentication based on privlidges? Like pages that some people can see and some can't. What direction should I look at?

Digatle

 

[MikeBronner]

If your users are already stored in a database and need to log in to the website, then simply at a foreign key field to your user table that refers to the priviledges table (which you might need to create, if it doesn't already exist). In the priveledges table you would store the different levels of access, i.e. 'Guest', 'User', 'Admin'.

Then in your navigation system, you do a check on what priveledges the user has, and build the menu accordingly.

I think that's what you're looking for?

Take Care,
Mike

 

[digatle]

I'm trying to get a feel for how the right way in addressing the whole authentication issue. We don't have a database per-say rather we're wanting to use Active Directory to accomplish it. We currently have a script that will enable us to get the users information (pasted below) however trying to get the right fields and such will be very much a daunting task for us.

What I'm trying to figure out is more or less like should we do a routeen that says "If logged in continue else make them login." Or put the authentication based on the particular pages you visit and if so lock it down by how?

This is simply a starting point to a long journey.

Digatle

 

[Bastien]

Best way (if the site is hi volume) is to use table based authentication...create a db table like users

User_table
userID
UserName
Userpass
UserAuthLevel
//other fields as required (like email etc)

The UserAuthLevel is set when the user signs up, usually with a default level of 0 or 1 to indicate basic access to the regular site pages.

Then with a separate ChangeAuth.php page, you could then grant the user higher levels of access
2 = forum mod access - move stuff, delete posts etc
3 = admin level - change/add pages etc
4 = superuser - control over all functions of site, bring down or start DB etc

For those pages that are protected, the script checks the UserAuthLevel for the appropriate values and then gives the user access to those functions.

Bastien

Any one have a techie job in Toronto, I need to work...being laid off sucks!

 

[MikeBronner]

ah! the active directory issue I've been there before. There are methods to do this using LDAP. Check out this thread: thread774-356151

Take Care,
Mike

 

[digatle]

Is there a way to do the same thing but using Active Directory? Here's the script I said was below (oops)

<?php
$ldap_host = &quot;dnsdhcp1&quot;;
$base_dn = &quot;DC=TFCU,DC=org&quot;;
$filter = &quot;(samaccountname=&quot;.$HTTP_GET_VARS['uname'].&quot&quot;;
//$ldap_user = &quot;CN=Joe User,OU=Sales,DC=php,DC=net&quot;;
$ldap_user = &quot;TFCU\\administrator&quot;;
$ldap_pass = &quot;focus&quot;;
$connect = ldap_connect( $ldap_host, $ldap_port)
or exit(&quot;>>Could not connect to LDAP server<<&quot;
ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($connect, LDAP_OPT_REFERRALS, 0);
$bind = ldap_bind($connect, $ldap_user, $ldap_pass)
or exit(&quot;>>Could not bind to $ldap_host<<&quot;
$read = ldap_search($connect, $base_dn, $filter)
or exit(&quot;>>Unable to search ldap server<<&quot;
$info = ldap_get_entries($connect, $read);
echo $info[&quot;count&quot;].&quot; entries returned<p>&quot;;
$ii=0;
for ($i=0; $ii<$info[$i][&quot;count&quot;]; $ii++){
$data = $info[$i][$ii];
echo $data.&quot;:&nbsp;&nbsp;&quot;.$info[$i][$data][0].&quot;<br>&quot;;
}
ldap_close($connect);
?>

Basically you goto

http://localhost/ldaptest.php?uname=bairdt

and you get all the information about my name from Active Directory. Works like a champ.

However this whole authentication issue arrises really when it comes to what they have permission to is something like a $rights variable should be defined? So like if its a common page everyone can come to make $rights = all and then when it comes to division pages say $rights = br36 where if their userID has a CN=br36 in it they can see the page.

Digatle

 

[MikeBronner]

I think you're on the right track. If you add another field to the active directory which defines the user's role, then you could authenticate against that.

Take Care,
Mike

 

[MikeBronner]

Oops, just noticed that the other thread was in ASP, and not in PHP. Sorry

Take Care,
Mike

 

[digatle]

This is PHP not ASP. The user's roll would come from the memberof: CN= value. But see we're obviously have people with multiple CN values because they have access to multiple parts of the site.

Obviously later on the road we're going to have to figure out how to actually get the value &quot;mamberof&quot; and the CN= values (multiple) into an array because of the multiple access to different area's issue.

I'm more looking now into figuring out how in PHP should we code this whole process rather as an include and fail or something else.

Digatle