Multiple levels of website authentication - possible?

StevenRaith

Sorry if this is a very stupid question, but allow me to explain myself.

I'm a screwdriver monkey - I normally do desktop support, rollouts, hardware troubleshooting, etc etc- I'm not a coder, A/P, DBA or anything like that. I have, in fact, tried to avoid scripting, databases and programming as I don't really have the mental spatial awareness for all those recursions and subroutines and stuff.

However, being the office techy, I have been roped into this: there is a site which has a front page with links to the four private subsections, and at the moment each page is authenticated by it's own 'passwords.txt' file. Obviously not brilliant in terms of security [it's all plain text, not MD5'd or owt...] and updating it is a pain as some users have access to sites 1+4, some only have access to site 3, others have access to all sites.

Is it possible to combine all the user details from these text files into one, say, MySQL database [with user, pass and 'access level' fields] and use PHP as a frontend to login/redirect to these sub-sites? Or am I barking up the wrong tree?

Any help is appreciated - I've had three days of google-greasing and apart from now being able to create a MySQL DB and set it up with phpBB3 I'm not really much further than I was Friday afternoon when this was thrown at me! 😃

Sneaky edit: I'm experimenting in the office with Win2k8/IIS7, and the real site is hosted on W2k3/IIS6 by an external hosting company - so anyone suggesting hosing the MS stuff and getting loved up to LAMP will be wasting their time - I'm stuck with MS stuff.

bpat1434

Yes, it is possible. One of the easiest ways would be to make each site have a number:

1: member_section
2: another_section1
4: another_section2
8: final_section

Now, if you have a user that is just allowed to be in member_section, they have an access level of 1. If they can go to just final_section, it's an access level of 8. If they can go to more than one site, then you just add the numbers together. So final_section and another_section2 would be 12. And another_section1 and another_section2 is 6.

So now you have an auth system set up, you can check it by seeing if a specific bit is set inside the access level. So if they're trying to access file_section, you could check it like this:

if(8 & $user['access_level'])
{
    // Allow entry
}

The "&" is a bitwise operator meaning that the same bit is set in both the integer 8 and the access_level.

Later today, I can explain more. But it is possible. And it doesn't even have to be this intricate.

StevenRaith

Ah, bitmasking of sorts, I did have this suggestion thrown at me - but as I have sod all useful experience of coding of any kind I wasn't sure where to start.

Something more specific would be a great help - the only problem i now have is trying to work out how the current authentication is done [I can't find any reference to it in the HTML code], and how to kill it so I can implement something like you describe, which would be a lot less rubbish than the current setup - and if I can make it talk to a MySQL DB, a lot nicer to admin.

And again I repeat, until two days ago I had never even looked at MySQL and PHP, nor even web stuff of any ilk from a coding side, so imagine I have the mental age of a nine year old when it comes to this stuff, thanks 😃

laserlight

One limitation of bpat1434's suggestion is that there are a limited number of bits available, so while it will work when you have 4 sections, it may not work if the site is expanded to 40 sections (or perhaps each of the 4 sections have their own 10 subsections). Another limitation is that it only has two states: entry allowed or not allowed. You might want more fine grained control, e.g., to deny access to everyone by default, to allow some read access, others write access, yet others might have some kind of admin/full/special access.

Other factors to consider: do you want to control access individually, or by group, or both? If groups are involved, can a user belong to more than one group? What happens if an individual's access level conflicts with the group?

StevenRaith

Good point Laserlight, but this is really very simple stuff - it's just some guidelines and tools that it's probably best to keep out of the public eye [nothing hugely private, it just gives an insight to our work] that are used by staff when working from home or off the corporate intramanet thingy. It's maintained by our departmental staff, rather than our IT dept, hence why it's not anything terribly complex ; I work with web content managers, rather than full on web devs, as it were.

I appreciate the limitations of bitmasking you have pointed out, but there are only a few areas that the site will ever have, it will most likely only ever be read only access and per user based on site access across those four areas should be sufficient.

The main concern is that it might go from about 50 users [IE around 150-200 entries in the text files] to 1000 users at some stage in the future - and god knows, keeping track of the text files then would be a genuine nightmare!

Hence the idea of a simple-ish database oriented system - something that can be queried and updated with more ease, as opposed to requiring something with serious flexability in terms of administration.

Good points though, nice to know what the potential limitations are 🙂

laserlight

bpat1434's suggestion could be implemented in a relational database with just one table:
Users: id, name, permissions

The permissions column would then hold the permission sum for bitmasking.

A more flexible yet still simple system would use three tables:
Users: id, name
Sections: id, name
Users_Sections: user_id, section_id

The Users_Sections table would be a join table that has a row for each permission granted to a user.

StevenRaith

I think mucking around with the three table solution would be beyond my capabilities at the moment - at least until I get my head around the whole PHP-->MySQL thingy. As I say, my experience of DBs and PHP [from a creative/admin side at least] is, beyond the last couple of days, uttely nil.

I don't have a terribly tight timescale however, so no rush, which is nice.

I'm not trying to ask you guys to do 'my job' [not that DBs and scripting are my job, but...] for me, but would it be possible to just drop that bit of PHP that bpat suggests into one of the hundreds of 'php and mysql authentication' code examples that are but a Google away [I'll try and find a couple - of freely available ones, that is - once I get a coffee in me] or would I need to set it up very specifically?

I'm rather hoping that toying with this will end up with the whole scripting and DB stuff 'clicking' in my head the same way that OS and hardware stuff did many years ago - to date, I look at stuff like Java and PHP and it just makes my eyes itch 😃

Oh, and cheers again for the info, I appreciate how annoying it can be when a newbie is asking what appear to be obvious questions! I get it all the time WRT Windows/Linux desktop, network and hardware problems :quiet:

laserlight

I think mucking around with the three table solution would be beyond my capabilities at the moment - at least until I get my head around the whole PHP-->MySQL thingy. As I say, my experience of DBs and PHP [from a creative/admin side at least] is, beyond the last couple of days, uttely nil.

That would rule out any database solution, but you want to use a database 😉

The three table solution is not harder than bitmasking, in my opinion. We can easily help you craft the SQL query needed in both cases. Both cases require you to specify some identifier for the section, be it a number that is a power of two, or an id corresponding to the section (or the section name, if it is unique). Both cases require the same logic and code to establish a database connection, select a database, execute the query, and process the result.

Providing a web based admin interface for managing the user permissions may be a little more work, but it means less work and potential errors figuring out what permission numbers to assign to a user in the long run. A mistake in calculation could be costly if the temp hire gets access to something only the boss should see.

I'm not trying to ask you guys to do 'my job' [not that DBs and scripting are my job, but...] for me, but would it be possible to just drop that bit of PHP that bpat suggests into one of the hundreds of 'php and mysql authentication' code examples that are but a Google away [I'll try and find a couple - of freely available ones, that is - once I get a coffee in me] or would I need to set it up very specifically?

One problem is that it is usually easier to write code than it is to read code (and in fact some code is so badly written as to be "write-only"), and without reading and understanding the code you would not know how to properly modify it.

Still, you could give modifying the current system a try. You would need to choose a database interface, e.g., the [man]PDO[/man] extension. From there we can help you to learn how to use it. Remember to take a backup (or even use a version control system), and if you have to come back here for help, describe the system as well as you can. (E.g., does it use sessions and cookies?)