additional auth scheme

[Shunde Zhang]

Hi,

I notice that currently auth schemes are tokens stored in database, e.g. SPASSWORD, GSI.

I am wondering if I can add other schemes to it, like, LDAP.

Then we need to do something when user logs in with the new scheme, for example, execute a rule?

Is this possible?

Regards,

Shunde Zhang

Australian Research Collaboration Services (ARCS), "Providing collaboration services and tools for the Australian research community"

Email: shunde...@arcs.org.au

eResearch SA (eRSA), "Enabling Discovery, Innovation and Collaboration through eResearch"

Email: shunde...@eresearchsa.edu.au

School of Computer Science, The University of Adelaide, "Life Impact"

Email: shunde...@adelaide.edu.au

Phone: +61 8 83038265

[schr...@diceresearch.org]

Shunde,

Sure. If you want to develop LDAP authentication and donate the code to
the project (as open source), we'll take a look at it and if it looks
OK, add it into iRODS. We've designed the authentication methods to be
extensible, so you can follow the pattern.

We currently support our secure password and GSI, and will plan to add
Kerberos soon. LDAP would be good to support too. There is also a
project for adding Shibboleth but that will be specific to a web
environment.

There's a lot more to it than a few tokens and rules tho. For GSI, for
example, both client and server need to handle the protocol which is
done by calling the GSI libraries (via our igsi.c functions) which in
turn call SSL libraries. We may want to have more rules involved in the
authentication some day, but currently only have the one, the GSI rule
added in 2.0.1 (which you and Graham helped with).

Thanks,

- Wayne -