Home » Authentication » LiveUser

User authentication and permission management framework

This package is unmaintained.

Download latest release 0.16.14 (archived versions might be outdated)

License: LGPL

Description

LiveUser is a set of classes for dealing with user authentication
and permission management. Basically, there are three main elements that
make up this package:

* The LiveUser class
* The Auth containers
* The Perm containers

The LiveUser class takes care of the login process and can be configured
to use a certain permission container and one or more different auth containers.
That means, you can have your users' data scattered amongst many data containers
and have the LiveUser class try each defined container until the user is found.
For example, you can have all website users who can apply for a new account online
on the webserver's local database. Also, you want to enable all your company's
employees to login to the site without the need to create new accounts for all of
them. To achieve that, a second container can be defined to be used by the LiveUser class.

You can also define a permission container of your choice that will manage the rights for
each user. Depending on the container, you can implement any kind of permission schemes
for your application while having one consistent API.

Using different permission and auth containers, it's easily possible to integrate
newly written applications with older ones that have their own ways of storing permissions
and user data. Just make a new container type and you're ready to go!

Currently available are containers using:
PEAR::DB, PEAR::MDB, PEAR::MDB2, PECL::PDO, PEAR::XML_Tree, PEAR::Auth, Session.

Documentation

Manual

Maintainers

• Markus Wolff (mw21st) — lead, inactive
• Arnaud Limbourg (arnaud) — lead, active
• Lukas Kahwe Smith (lsmith) — lead, inactive
• Helgi Þormar (dufuz) — lead, active
• Bjoern Kraus (krausbn) — developer, inactive
• Matthias Nothhaft (mahono) — developer, active

Dependencies

Required

• PHP (>= 4.2.0)
• PEAR Installer (>= 1.4.0b1)
• PEAR (>= 1.3.3)
• Event_Dispatcher

Optional

• Log (>= 1.7.0)
• DB (>= 1.6.0)
• MDB (>= 1.1.4)
• MDB2 (>= 2.0.0)
• MDB2_Schema
• XML_Tree
• Crypt_RC4
• mcrypt (extension)
• hash (extension)

Releases

• 0.16.14 (beta, 2010-10-15)
  Release notes

  License: LGPL

  QA release
  Bug #9517 Config Parameter permContainer=>storage=>PDO=>prefix doesn't work dufuz
  Bug #13014 PHP Warning on setcookie() dufuz
  Bug #13154 Example 4:schema validation error dufuz
  Bug #13391 example 5 - MDB2_Schema Error in demodata.xml dufuz
  Bug #13650 Examples (demodata script) problem dufuz
  Doc Bug #14954 mention ACL in the description/documention kguest
  Bug #15126 Assigning the return value of new by reference is deprecated doconnor
  Bug #15127 Parse error: syntax error, unexpected T_RETURN in ./LiveUser/Perm/Storage/Cache doconnor
  Bug #17723 Patch: Avoid ereg in favor of preg_match olleolleolle

• 0.16.13 (beta, 2008-01-28)
• 0.16.12 (beta, 2006-08-22)
  Release notes

  License: LGPL

  - wrong use of pdo fetch method, when no result could be fetched it returns
  false with no error. Swith to using fetchAll and check for an empty array
  - we cannot decrypt most of the encryption method used by the hash extension so
  we default to returning the unmodified string
  - the wrong variable was used to report the type of permission container when an
  error occured
  - push an error on the stack when the encryption method cannot be found
  - make sequence columns primary key
  - properly disconnect the pdo object
  - make it possible to set the status message mapping
  - register options for create (Bug #7704)
  - use the hash extension if it is present for the password encryption
  - refactored decryptPW() and encryptPW() into static methods in the LiveUser class
  - force null instead of false for PDO fetch() calls that return empty sets
  - fixed logging into example1
  - debug => false in conf doesn't work (Bug #7564; thx to Matthias)
  - added support for user defined handle fields
  in DB, MDB, MDB2 and PDO containers you can set a list of fields in your auth
  container storage config, default is 'handle', example:
  'handles' => array('handle', 'auth_user_id', 'email')
  these fields are now used to find the right user on login (Request #7781)
  - fixed LiveUser::decryptPW(): added missing third parameter 'secret'
  - check if safe_mode is enabled in fileExists() to determine what algo to use (Bug #8296)

• 0.16.11 (beta, 2006-04-19)
  Release notes

  License: LGPL

  - parse error typo fix in PEARAuth container (bug #6968)
  - minor improvements to the phpdoc comments in PEARAuth container
  - use ugly fopen() hack in fileExists()
  http://marc.theaimsgroup.com/?l=pear-dev&m=114148949106207&w=2
  - changed API for readuserData(), auth_user_id parameter now contains the
  auth_user_id to use
  - login() now supports passing in an auth_user_id instead of the handle/password
  - made stack property public
  - typo fix in PDO container readImplyingRights() method (bug #7195)
  - expanded error handling in Log instance creation
  - handle if no proper credentials where passed to readUserData() (bug #7262)
  - replace isset() with array_key_exists() where applicable
  - disable __autoload() in class_exists() calls (bug #7304)
  - brought property names in line s/rights/right_ids *BC break*
  - MDB2_Schema 0.5 and MDB2 2.0.1 handles nulls in schema files properly so
  there is no need to disable MDB2_PORTABILITY_EMPTY_TO_NULL in the installer

• 0.16.10 (beta, 2006-02-27)
  Release notes

  License: LGPL

  - Do not include Cache.php since its only a concept and not implemented yet
  - fixed serious issue with right reading in the Medium and Complex container
  - right_level may not be null in schema (use default if not explicitly set)
  - phpdoc improvements
  - bumped dependency for MDB2 to first stable release
  - added missing optional dependency on mcrypt
  - made admin user a superadmin in example4
  - bumped copyright to 2006

• 0.16.9 (beta, 2006-02-21)
  Release notes

  License: LGPL

  This releases fixes a minor security issue that is limited to the optional
  remember me feature. This issue was report to us by GulfTech Security Research.

  The issue would allow an attacker to determine the existance of files inside the
  file system, as well as being able to delete files:
  - if the relativ path is shorter than 32 characters (including a null
  byte)
  - if null bytes are handled inside the "_COOKIE" superglobal, for example
  through usage of magic_quotes_gpc, the issue becomes essentially limited to
  files ending with ".lu".

  All installations using the remember me feature are strongly urged to update.
  This release also changes some other aspects including a BC break so developers
  can optionally patch their current installations from the changes in the
  following commit:
  http://cvs.php.net/viewcvs.cgi/pear/LiveUser/LiveUser.php?r1=1.148&r2=1.149&diff_format=u

  - fixed major bug in PEARAuth container: auth_user_id is not an optional property
  - added passwordEncryptionMode and secret to phpdoc comment
  - made cryptRC4() method public to match usage in auth common in the client and admin api
  - fixed handling of the secret user defineable property (bug #6551)
  - added support for user_group_ids (bug #6517)
  - allow grouprights and groupusers table to join eachother
  - updateProperty doesn't update the session (bug #6612)
  - renamed "connection" config option to "dbc" *BC BREAK*
  - cleaned up and unified init() in the storage classes
  - added example for dumping SQL to a file to installer
  - add support for force_seq to installer
  - removed allowDuplicateHandles and allowEmptyPasswords options, they are now
  handled through the table definition in the given Globals.php (overwriteable
  via the config array) *BC BREAK*
  - initial untested support for PDO in the installer
  - added examples for setting length and defaults to installer
  - use overwrite when unlink is enabled in the installer
  - reworked handling of merging user with group rights *BC BREAK*
  When using the Medium or Complex container a user may gain rights through direct
  assignment or through membership in a group that has rights assigned. The user
  and group rights are merged with the following logic:
  * if the right is only assigned to a member group but not the user the right is
  available to the user at the level at which the group has the right
  * if the right is only assigned to the user at a level greater than zero but not
  to a member group the right is available to the user at the level at which
  user has the right
  * if the right is only assigned to the user at a level equal to zero but not
  to a member group the right is available to the user at the level at which
  user has the right
  * if the right is only assigned to the user at a level lower than zero but not
  to a member group then the right is unavailable to the user
  * if the is assigned to a member group and the user and the level at which the
  user has the right is greater than zero, then the right is available to the
  user at higher level of the two
  * if the is assigned to a member group and the user and the level at which the
  user has the right is equal to zero, then the right is unavailable to the user
  * if the is assigned to a member group and the user and the level at which the
  user has the right is lower than zero, then the right is available to the
  user at the minimum of the group assigned level and the addition of the
  negativ user level and the maximum level
  Example:
  The user as the following right_id => level pairs
  array
  1 => 3
  2 => -2
  3 => 0
  5 => -1

  The groups he is a member of have the following right_id => level pairs
  array
  1 => 1
  2 => 3
  3 => 3
  4 => 2

  The final right_id => level pairs are as follows
  array
  1 => 3 // user has a higher level (3) than the group level (1)
  2 => 1 // 3 - 2 means a maximum possible level of 1
  4 => 2 // only group has the right at level 2
  5 => 2 // only user has the right at level 3 - 1 = 2

• 0.16.8 (beta, 2005-12-21)
  Release notes

  License: LGPL

  - clearer status and error messages
  - fix a bug with the passed Log object being discarded
  - extra debug info when the auth container is instantiated
  - more helpful error message when the class cannot be loaded
  - make the PEAR::Auth wrapper use the passed handle and password
  - fixed phpdoc typo in singleton method (bug #5668)
  - fixed ability to call singleton() with only the conf parameter set, even if
  singleton was never called before (bug #5669)
  - fixed issue in factoryStorage() that would lead to modifying the config array (bug #5526)
  - added ability to disable executing the sql commands on installSchema()
  - set status after logging out not before
  - tweaked error messages for failed factory method calls
  - fix for calling singleton without a signature string (bug #5905)
  - attempt at checking if it is safe to start the session, add an error to the stack if not and return
  - minor performance tweak in login()
  - reordered code inside login() to make onFailedMapping events more powerful
  - improved handling of INACTIVE status
  - stop using backendArrayIndex infavor of containerName property in the auth instance
  - removed loginTimeout feature (disable lastlogin if you are concerned about
  the cost of updating the lastlogin time)
  - handle option user data properties in readUserData() in the PEAR::Auth wrapper
  - added a few return true's for method that returned void so far
  - tons of phpdoc and whitespace fixes and additions
  - add missing css file in example5
  - only read remember me cookie in login() if remember was passed as true (bug #6215)
  - handle and password are passed to reeadUserData in the PEARAuth container
  - reworked file loading in loadClass() to work around issues in safe_mode with
  LiveUser::fileExists() (bug #6226)
  - moved all explict handling of logout() and login() out of the init() method *BC BREAK*
  - made setRememberCookie(), readRememberCookie() and deleteRememberCookie public
  - setRememberCookie() no longer accepts a remember parameter
  - added PDO backend and optional pdo based config for example5

• 0.16.7 (beta, 2005-10-10)
• 0.16.6 (beta, 2005-09-02)
• 0.16.5 (beta, 2005-08-17)
• 0.16.4 (beta, 2005-08-15)
• 0.16.3 (beta, 2005-08-09)
• 0.16.2 (beta, 2005-07-20)
• 0.16.1 (beta, 2005-07-05)
• 0.16.0 (beta, 2005-06-21)
• 0.15.1 (beta, 2005-03-30)
• 0.15.0 (beta, 2005-03-15)
• 0.14.0 (beta, 2004-12-20)
• 0.13.3 (beta, 2004-10-23)
• 0.13.2 (beta, 2004-10-13)
• 0.13.1 (beta, 2004-10-02)
• 0.13.0 (beta, 2004-09-30)
• 0.12.0 (beta, 2004-06-19)
• 0.11.1 (beta, 2004-04-28)
• 0.11.0 (beta, 2004-04-28)
• 0.10.0 (beta, 2004-03-11)
• 0.9 (beta, 2003-10-08)
• 0.8.1 (beta, 2003-08-28)
• 0.8 (beta, 2003-08-26)
• 0.7 (alpha, 2003-06-01)
• 0.6 (alpha, 2003-03-17)
• 0.5.1 (alpha, 2003-03-10)
• 0.5 (alpha, 2003-03-10)
• 0.3 (alpha, 2002-10-09)

Bugs