Per-API authentication about zf-mvc-auth HOT 7 CLOSED

One interesting note: we currently only define two types of authentication, "http" and "oauth2". "http" encompasses both basic and digest. We may need to change this to allow defining each of basic, digest or oauth2.

Ping @ezimuel — thoughts?

from zf-mvc-auth.

I'm guessing OAuth1 is not in the cards, on the server side?

from zf-mvc-auth.

@EMCP there is not a zf-oauth1 library and I'll go on to opinion we shouldn't promote such old technology in zfcampus.

from zf-mvc-auth.

I feel such old technology has advantages over OAuth2, but I hear your opinion.

from zf-mvc-auth.

#59 was created to address this.

from zf-mvc-auth.

@EMCP There are good and bad things about OAuth v1.x; the request signing was great, but it was also incredibly brittle for implementors. All that said: because authentication is an event, you can implement it and drop it in to listen at priority > 1; so long as your listener returns one of either the GuestIdentity or AuthenticatedIdentity, the default options will be omitted. However, it means you cannot configure it in the admin UI, nor, as the state of #59 currently stands, opt-in to per-API authentication types. I'll take that latter into consideration as we test the patch, as I think it could be useful to specify custom types, even if we don't handle them in the default listener.

from zf-mvc-auth.

Addressed in #59 — including custom types and adapters, @EMCP!

from zf-mvc-auth.