Design notes for Authentication of pcxperience.Net apps in the portal



In the future each application may be hosted on one or more servers in order to farm out the workload. The authentication module must be able to determine the validity of a user as well as the apps he/she has access to. After authentication a session id is issued for the user and is used for authentication in the apps.

Start screen would look something like this.

Company Welcome to PC X.....

User

Pass

Sign UP!



index.html passes off to cgi-bin/index.cgi. It will take the input company, username, and password, authenticate, write to the database and pass back a session id.

Session ID

will have two parts. Part 1 is a static number perhaps a time stamp or some random number. The second part is a random number that is changed each time the user submits to the backend.

Cookie

The cookie will hold the static and random parts of the session id. (Maybe two cookies) If no cookie is set, or part of the info is missing, the system invalidates that session id and pushes the user back to the login screen.

Index.cgi

This script will use the authentication methods then show the proper available applications for the user. Also shown will be updates, news, ads, etc...

When the user chooses an app index.cgi writes the session id static and random into the database. NEED to work on this . How to pass off and still have correct ids to not have to reauthenticate..?



auth_db.apps_tb

name

number

default_server

cost

units



company_tb

number

name

phone

address

email

city

state

zip



company_apps_tb

app

user_max

server

number

company



user_tb

number

uname

passwd

active

email

admin

/index.html

/portal/index.cgi

/auth/sandsurfer.pm

/sandsurfer

/accounting

/company/name.html



Screen layout

|------------|-------------------|

|static                   | Menu                               |

|quickchange        |                                         |

|-------------------------------|

| APPPLICATION HAPPENINGS

|-------------------------------|

|Output messages |

|-------------------------------|


Copyright (c) 2001 HLR
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1; A copy of the license is available at http://www.gnu.org/licenses/licenses.html#FDL.

Updated: $Id: auth.html,v 1.1.1.1 2001/08/09 19:02:30 moreejt Exp $