How many sites have you built lately that don't require some sort of user authentication? Most likely the site requires at least an admin interface of some sort, which requires some sort of user authentication mechanism. You could just stick a .htaccess file in the directory and deal with adding and removing users using htpasswd. This solution is cumbersome and not very secure. Writing your own authentication and user management system is also a possibility, but this requires time and effort to develop, test and implement. I recommend using Uma. Uma is an open source authentication and user management system that I have written been using for several years and recently released under the LGPL.
Uma is a user management and authentication system written in PHP. It's completely object-oriented, supports MySQL and is flexible, powerful and easy to implement. Uma allows you to have a single database managing access to an unlimited number of web sites, applications and users. Uma is actively developed and paid professional support is available if you need help. Learn more about support here.
If you have several sites, you can have one Uma database and one Uma code installation to service all of your sites. You manage all of your users and sites through one administrative tool, and can grant users access to multiple sites giving the user a single username and password.
Plugging Uma into your site is pretty easy, and it gets easier all the time. You need to have the following files in your PHP include path: Connection.class.php, DataObject.class.php, Utils.class.php, Uma.inc.php, config.php and authenticator.php. I suggest placing all of these files, other than the authenticator.php, outside of your web server's document root.
Connection.class.php - Handles all MySQL PHP function calls.
DataObject.class.php - Provides the common interface for database abstraction. Extends Connection.class.php.
Uma.inc.php - provides all the classes that Uma needs to do its job. All of the classes extend DataObject. You have to include this file for any page that you wish to protect with Uma, or any page that you wish to have access to Uma's objects or session data.
config.php - Provides all of the configuration options for Uma like database connection parameters, e-mail address for errors, text for error messages, etc. Dig around in here and become familiar with the configuration settings.
authenticator.php - Include this file in any page you wish to protect with a Uma login. If the user is not authenticated, this file loads the login page. This is where you set the $permissionLevel required to access the page and the $serviceId corresponding the 'id' column of the service associated with this page.
You will also need to have a login.php file that provides the login page. You can start by using the files I have included in the admin directory. Grab the login.php and the login.html.php and just modify the login.html.php file to give it your site's look and feel.
You should take notice of the file called mepath.php. I use this file
to set the location of my Uma files. If you look at index.php
in the admin directory, you will see what I am doing.
There is a line that looks like this: ini_set('include_path', @current(file('mepath.php')));
This technique keeps me from having to hardcode the include_path in multiple files.
Why not just edit the php.ini file? Often times I don't have access to modify
the php.ini file. This is the best solution I have found so far to deal
with the include path settings. I recommend using the mepath.php file,
but you are free to set your include_path any way you chose.
Although these files aren't necessarily required, you should have a loginerr.php and error.php file in case something bad happens, the user has some place to land. You can do some reporting and logging in the loginerr.php file. When getting started, copy the files I have in the admin directory.
User access is granted to services based on permission levels. For instance, if you have a bowling web site called Bowl4Beer you could create a service called Bowl4Beer using the Uma admin tool. Now all you need to do to protect your site from unauthorized bowlers is simply edit the authenticator.php file and set the $serviceId to correspond to the 'id' column in the Service table for the Bowl4Beer record. The 'id' for Bowl4Beer will appear in parentheses in the admin tool next to service name.
Uma uses the value of $permissionLevel (set in authenticator.php) to determine if the user logging in has a high enough permission to access the page. The user's permissions are stored in the Perm table, and can be set using the Uma admin tool. Access is granted for users who have a permission greater than or equal to the value assigned to $permissionLevel in authenticator.php. User's can have different levels of permissions for different services.
Uma allows you to benefit from the vast number of sites that have implemented Uma and use it everyday. Uma continues to improve month after month and is gaining popularity all the time. I hope you will find Uma to be as useful as I have.
My name is Keith Vance and I own Vance Consulting LLC with my wife Mandy. You can learn more about Vance Consulting at http://vanceconsulting.net/ or you can e-mail at keith@vanceconsulting.net.