Design notes for Authentication of pcxperience.Net apps in the portal
In the future each application may be hosted on one or more servers in order to farm out the workload. The authentication module must be able to determine the validity of a user as well as the apps he/she has access to. After authentication a session id is issued for the user and is used for authentication in the apps.
Start screen would look something like this.
Company Welcome to PC X.....
User
Pass
Sign UP!
index.html passes off to cgi-bin/index.cgi. It will take the input company, username, and password, authenticate, write to the database and pass back a session id.
Session ID
will have two parts. Part 1 is a static number perhaps a time stamp or some random number. The second part is a random number that is changed each time the user submits to the backend.
Cookie
The cookie will hold the static and random parts of the session id. (Maybe two cookies) If no cookie is set, or part of the info is missing, the system invalidates that session id and pushes the user back to the login screen.
Index.cgi
This script will use the authentication methods then show the proper available applications for the user. Also shown will be updates, news, ads, etc...
When the user chooses an app index.cgi writes the session id static and random into the database. NEED to work on this . How to pass off and still have correct ids to not have to reauthenticate..?
auth_db.apps_tb
name
number
default_server
cost
units
company_tb
number
name
phone
address
city
state
zip
company_apps_tb
app
user_max
server
number
company
user_tb
number
uname
passwd
active
admin
/index.html
/portal/index.cgi
/auth/sandsurfer.pm
/sandsurfer
/accounting
/company/name.html
Screen layout
|------------|-------------------|
|static | Menu |
|quickchange | |
|-------------------------------|
| APPPLICATION HAPPENINGS
|-------------------------------|
|Output messages |
|-------------------------------|
Copyright (c) 2001 HLR
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.1;
A copy of the license is available at
http://www.gnu.org/licenses/licenses.html#FDL.
Updated: $Id: auth.html,v 1.1.1.1 2001/08/09 19:02:30 moreejt Exp $