7 Components: the Function Pages - Developers

14.6
A Mixed Strategy for Authentication
In the following, we will consider the question as to how to accomplish
having only certain pages require a login to be edited. It would
seem obvious to use access controls alone to determine authorization
variables. The problem, however, is that web servers only remember
user names if an authentication is required. Without a user name,
there can be no authentication. Thus, if you remove the Edit script
from authentication, it cannot determine who is attempting to edit a
topic. Therefore, it assumes that editing is taking place via a guest
account and will never grant access permission to the protected
pages.
TWiki offers a preset mechanism that remembers who has logged
in. To activate this, you must go to the file Twiki.cfg and set the parameter
$doRememberRemoteLogin to the value 1. Now TWiki
will save your IP address along with your login name in a file when
an authenticated script is accessed. The next time any script is accessed
via that IP address, the corresponding user name is retrieved
from the file and is thus also known to non-authenticated scripts. So,
we could conceivably remove the .htaccess protection for the bin directory.
You can also define the storage location for the IP addresses
in Twiki.cfg. The respective parameter is $remoteUserFilename
and, by default, leads to the file remoteusers.txt in the data directory.
That leaves us with two more problems to solve. Firstly, we have
to create a login link that triggers a one-time authentication, since
the Edit script is no longer protected. Secondly, permanent storage
and authentication via IP is very insecure, since IPs can easily be
forged or, as is frequently the case, often change owners.
The first problem is relatively easy to eliminate. In the bin directory,
there is a file called viewauth, which is an exact copy of the
view scripts. You can protect the file via .htaccess:
require valid-user
You can comment on the entries for all other files with a # at the
start of the line. The file viewauth now takes care of the login for us,
since it is protected and thus prompts the browser for the registration
dialogue. From then on, the user is known and is logged in via IP.
However, you still have to insert a login link that will invoke the
Identifying users
via IP
Problems
Login link
14.6 A Mixed Strategy for Authentication �
�
�
213