User Management Meeting Logs
Gw
2004-09-28: Teammeating
Attendants: Allmost everybody Done:- Integration of our backend with our frontend.
- JUnit tests
- Completion of documentation
- ACL. We are going to use a property called 'acl' that contains a few lines, where each line start with a certain action (e.g. read), an equal sign and a list of users that are allowed to do just that. At the moment, we will use a separate filesystem file for ACLs until we can use storage code. Descission: an empty ACL means that only the initial owner of the file is allowed to edit it.
- Password. We are going to handle passwords in a special manner. Instead of stored in a file, we implement it by using a special property for it. In this property we store a hash of the password. Changing a password cannot be done by the user using editing directly. We'll use a special servlet to: request a new password (reset) and to change a password (by specifying the old one).
- Authentication. At some point in the application a specific autherization might be required to complete a certain action. If this happends, we can redirect to a login page where the user can fill in an username and password and on submit time, redirect back. The problem is, is that the first request that might contain some additional parameters, is replaced by a second request, such that the input to the original request is lost. Unless we either store that input into a session (but that has the disadvantage of having to remove it from the session as well) or publish all previous input as hidden values to the login screen.
2004-09-27: Teammeating
Attendants: Everybody Build 1 Things Done:- Add user page
- Creation of users
- List users
- Edit user -> through the Wiki System
- Delete users
- Integration with other teams
- List users
- JUnit testcases
- Documentation
- Flow
- Class
- Storage of passwords
- ACL storage/structure
- ACL creation/initial
- User login
- Integration with Storage
2004-09-16: Not official design-session
Attendants: John van Schie, Arie Middelkoop John and I scetched a raw model of the usermanagement subsystem. The attached picture identifies some components. It is not finished, but we wanted to publish it, so the entire group can discuss it. Time is short, so I only draw the components. Probably there will be some more pictures, text and discisions added to it soon. See TheUserManagementModel. -- ArieMiddelkoop - 16 Sep 20042004-09-13 : Teammeeting
Attendants: Everybody Written down by: John van Schie Decisions:- Users and Groups are stored globally (e.g. in the main WikiWeb? )
- Groups can include Groups. With this system a kind of inheritance is possible (see action #1)
- The target for build 1 will be the creation of users. This includes creation of the UserPages? in the main WikiWeb? (see action #2) and it's GUI.
- Maybe we can use the work of the Wiki Form group later on, but for now, we will start with our own format for user management.
- A decision must be made in the inheritance tree of groups. What do groups do with conflicting rights?
- Where do we store the sensitive data, like passwords?
- How are we going to store the ACL's? Valid options are RDMS, files, special file when a WikiPage? is a directory or the subversion-metadata.
- Authentication? Client-side SSL authentication is a (very cumbersome) option. HTTP-authentication (HTTP headers 401-403) are options, just like custom forms.
- Timetables, what-to-do-next, split-ups, coding standards?
- [Not very important now] With a rollback, will an old ACL be valid again, or do we take into account the latest ACL
2004-09-21 : Teammeeting
Attendants: Everybody Written down by: Laurence Cabenda Decisions:- Issue’s on Jira will be posted by Laurence Cabenda
- Logging will be done by John van Schie
- The Notes from the meetings will be taken by everybody. It's a rotating system
- Build 1 will be finished on Monday the 27th
- The meetings notes will posted on our wiki Page
- Documentation will be discussed in Mondays meeting