[MKDoc-dev] Using cookie/ticket authentication rather than Basic Auth

[Charlie Garrison]

Good morning,

I am looking for feedback on whether to add new functionality as part of MKDoc
or create my own modules that subclass MKDoc.

I have a need to use cookie/ticket based authentication (due to systems used
in related sites). So that MKDoc can integrate better with the related sites,
I want to use our existing ticket based authentication. In this case I think
it makes sense to create new modules, eg:

MKDoc::Auth::Handler::AuthenticateTkt
MKDoc::Auth::Handler::AuthenticateOptTkt

And a new plugin:

MKDoc::Auth::Plugin::LoginTkt

I'm still looking into it so I don't have clear ideas yet on the best way to
do what I want. The apache mod_auth_tkt module sets the user credentials and
REMOTE_USER when a valid cookie/ticket is received. I did a quick test with
mod_auth_tkt and MKDoc v1.6 and it seemed to work fine. That was using my
external login scripts, and I want to make the login script (& related
modules) part of MKDoc.

So I just need to know whether I should make changes in the mkd source tree,
or create my own modules as subclass of MKDoc. Any suggestions or opinions?

Thanks,
Charlie


PS. I'm not making any comments on http authentication by choosing a
cookie-based approach. Personally, I think the way MKDoc gets around the
logout limitation of http auth is quite clever. It's just not what I need in
this case.
-- 
   Charlie Garrison  <garrison at zeta.org.au>
   PO Box 141, Windsor, NSW 2756, Australia