The mailing list for listmasters using Sympa

[Chris Hastie <address@concealed>]

On 19/05/08 06:50, Serge Aumont wrote:
> Chris Hastie wrote:
>   
>> The other application has been 'integrated' with the older sympa
>> installation in that on login it sets the sympauser cookie to an
>> appropriate value so that the user is also authenticated against sympa.
>> According to
>> http://www.sympa.org/manual/authentication#sharing_wwsympa_s_authentication_with_other_applications
>> this method looks like it should still work. But it doesn't. 
>>     
> So one of the method to relace the login you have is to fetch session 
> attribute from Sympa table ; the field email_session will give you the 
> login id of the user. Note that not only authenticated users are using 
> Sympa session.
>
>   

Thanks Serge.

Login is done by the other app. The other app sets the sympauser cookie.
Very often the user visits the other app first and logs in there. So no
sympa session will yet have been started.

>> Is there any way to configure sympa to use the old behaviour?
>>     
> No
>   

And I was so hoping you were going say "Yes, of course. We went to great
lengths to preserve backwards compatability" ;)

>> Failing
>> that, is there any documentation on the new system and how to allow
>> other apps to handle the authentication? Looks like I might need my app
>> to write to sympa's session_table, which doesn't fill me with joy :(
>> What's my best option?
>>   
>>     
> I am goin,g to update the documentation and I will send you information 
> about it as soon as ready. Why do you say you are going to "write" into 
> session_table ? Read is enough.
>   

Is it? When I may need to authenticate users who haven't yet visited
/wws so do not have a session yet? Perhaps I'm missing something but I
can't see how I can achieve this without writing to it. And I'd like to
keep the number of webserver readable configuration files with database
passwords in clear text to a minimum, so I'd really like to avoid having
to write.

I've wondered about hacking Sympa to create an option
"recognise_legacy_sympauser_cookie" or something that will cause Sympa
to automatically authenticate and set appropriate session information
for any user presenting a valid sympauser cookie. Is there any mileage
in this, and if so have you any pointers?

Thanks
-- 
Chris