Lazy sessions and authorization (Drupal)

[Laas Toom]

On 05.11.2013, at 0:03, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 11/4/13, 3:31 PM, "Laas Toom" <Laas.Toom at ut.ee> wrote:
> 
>> Basically, lets forget Drupal for the moment and consider a simple PHP
>> script that relies on HTTP Basic Auth with .htpasswd specifically for
>> this page. Anybody gets to view the page, but POSTing comments is allowed
>> only if REMOTE_USER is set.
> 
> But you don't implement that by using a single resource and ruleset for
> both, you have separate resources (or limit the rules to POST) for the
> commenting. So it's not one script, it's logically two.

You are fixating my contrived example and telling me that the app is wrong.

What I am trying to tell you is that there are a multitude of apps out there that have only binary authorization built in: anonymous and logged in.
They do not expose different URLs (or even HTTP verbs) for authorization levels, only show additional content for logged in users.

To some extent this is even possible with Auth Basic, by using mod_authn_anon and a special anonymous username - everybody who don’t have entry in the .htaccess file can use the anonymous username and still get access. Of course, the application must now consider the anonymous user as unauthorized, but that is essentially the same as considering blank username unauthorized.

If the app was built with a single point of entry that sets up application session, federating it is relatively easy.

But I was talking about the group of apps that for one reason or the other assume lazy sessions and still retain the binary authorization scheme as was the case with shib_auth module + Drupal: shib_auth did not provide authorization and Drupal granted additional access to all logged in users.


But enough of that.
I can see that conditionally not exporting data is both technically difficult to implement and questionable from usage point of view (considering how hard it is for me come up with plausable example). ;-)

As it was in my case, it’s probably always possible to change something in the setup so that lazy sessions and authorization are not required at the same time.


Thank you for your patience and explanations,
Laas Toom