Auth library

Authentication - as user's identity checking - login call create and return auth token, client sends this token with all subsequent calls, logout call make this token invalid

Authorization - as checking user's permission for called action on some object - that's main solved problem.

Basic model

Where:

Subject
is one user or user group (or role - in this aproach group and role are the same)
Action
is item from predefined action set
Object
is a object from tree or class of objects

Subject implementation

Subjects are divided into two types - users and groups. There is membership relation (type N:M) from subjects table to itself with "linearization" feature - for questions about it send me a mail please ;)
This approach allows inserting user to group or group to group with quick searching of direct and indirect membership.

Object implementation

For simple use with existing projects, there would be a object tree always separated from project's database tables. It would be implemented by table of objects and information about parent/child (or other) relation between objects.

There is also class table and N:M membership relation between objects and classes.

Example:

Permissions for actions

There are several ways to handle permissions - I've used this:
allow/deny - all without allow permission is denied, but more specified setting may overcome less specified
(e.g. group of users is allowed to do smth., but one specified group-member is denied)

Permissions are stored as triple [subject, action, object] and allow/deny flag.

Procedure of permission checking:

Select all permissions on corresponding object + all objects in tree path
for actual user + all groups, where user have direct or indirect membership.
Sort it by:
1. diference in tree levels for object
2. membership level for subject
3. record with '_all' action have lower priority
4. 'deny' records have higher priority then 'allow'
If no record found then repeat similar query with class table instead of object tree table. (+ similar sorting)
If record on the top of sorted sequence have 'allow' type then return allow else deny

Auth system usage

There are 3 main types of usage:

authorization of called action
automatic modification of user interface in dependence on user permissions
automatic generation of admin interface for permissions settings

Important part of API:

function Alib(&$dbc, $config) returns object
constructor
function login($login, $pass) returns token
function logout($sessid) returns boolean
function checkToken($sessid) returns boolean
check validity of the token
function addObj($name, $type, $parid, $aftid, $param) returns int
adds object to tree as child of object with id=$parid after object with id=$aftid
function removeObj($id) returns boolean
function addSubj($login, $pass) returns int
add user (or group - with $pass=null)
function removeSubj($login) returns boolean
function addPerm($sid, $action, $oid, $type) returns int
add permission record - type is A(allow) or D(deny)
function removePerm($permid, $subj, $obj) returns null
remove permission record
function checkPerm($sid, $action, $oid) returns boolean
check permission for action on object with id=$oid for subject with id=$sid
function copyObj($id, $newParid, $after) returns int
function renameObj($id, $newName) returns boolean
function getParent($oid) returns string
function getPath($id, $flds) returns array
function getDir($id, $flds, $order) returns array
function addClass($cname) returns int
function removeClass($cname) returns boolean
function addObj2Class($cid, $oid) returns boolean
function removeObjFromClass($oid, $cid) returns boolean
function addSubj2Gr($login, $gname) returns int
function removeSubjFromGr($login, $gname) returns boolean
function isGroup($gid) returns boolean
function listGroup($gid) returns array

All methods may return PEAR::error object if fails ...

Connection to existing applications

PHP applications could include Alib class and call API methods directly.
Other programming platforms should call XMLRPC or HTTP layer above this API.

Auth library - request for comments

Authentication & authorization