Comments on: ErkanaAuth Version 2.0a

By: Michael Wales

Michael Wales — Mon, 03 May 2010 02:42:26 +0000

@Nick
Your issue sounds like a Linux vs. Windows issue with capatilization (Linux views capitals as a different character than lowercase). This is probably an issue with the model and I will look into whether this is inherent to ErkanaAuth itself, or release a number of guidances if it is a user-generated error.

I will continue to issue releases here on the blog but if you want the most up-to-date release, the BitBuck repository is the way to go.

By: Nick Jennings

Nick Jennings — Sun, 02 May 2010 21:28:21 +0000

Hi Michael,

Many thanks for the work! I’ve got a small project I’m working on at the moment, and didn’t want to go for something too crazy with features. A simple “in or out” authentication mechanism (aka. Erkana auth) is just what I needed!

I had a problem however, where the Erkana_auth library was referring to $this->CI->account (and throwing an error), capitalizing ‘Account’ wherever the the load->model was called, and references to $this->CI->Account seemed to fix everything. I’m a bit curious why I got this problem and no one else seemed to mention it above

Other than that, was just wondering why there is no logout library method? seems like it would be as simple as a call to $this->CI->session->unset_userdata() – or would this somehow be a bad idea?

Is there somewhere I should be checking for newer releases? I haven’t taken the plunge into mercurial yet, and still prefer downloading “releases” – do you make regular release of erkanaauth?

Thanks again for your lightweight authentication library. I’ve been thinking of releasing a CI library of my own and plan to use yours as an example.

By: Jason H

Jason H — Sat, 01 May 2010 02:39:32 +0000

Love it man, keep up the good work. A solid, well thought out auth library for CodeIgniter will help it go far!

By: vecima

vecima — Tue, 27 Apr 2010 22:50:03 +0000

haha, I’d consider it an honor to contribute something to ErkanaAuth! I don’t have any of the accounts you mentioned, but I’ll look into ‘em. I need to roll out the security update for the client I mentioned earlier tonight, but I’ll definitely look into it in the next couple days.

By: Michael Wales

Michael Wales — Tue, 27 Apr 2010 21:49:31 +0000

@vecima
Glad to see your contributions to the library! If you use Mercurial and have a BitBucket account, it would be great if you could fork the project, commit your changes and send me a pull request. This is the easiest way for me to accept and vet community contributions.

By: vecima

vecima — Tue, 27 Apr 2010 17:36:48 +0000

I don’t mean to spam up the place, but I thought I’d let you know that I implemented a get_identifer (to return the email or username) and a change_password method. I posted about it here:
http://codeigniter.com/forums/viewthread/144518/

Also, I’m not sure if it’s a bug or just something up with the way I’m using ErkanaAuth, but I have a library called Auth_wrapper that loads ErkanaAuth, and the first time I tried to log in, I got an error about a call on an undefined object in validate_login. I added a check that the CI_Session class exists (as you did in other methods) and it seems to have fixed it:

if (!class_exists(‘CI_Session’)) {
$this->CI->load->library(‘session’);
}

By: vecima

vecima — Tue, 27 Apr 2010 15:57:01 +0000

Thanks for the quick reply. Luckily in my case I don’t need a feature rich authentication system. Just a simple, secure login that I can easily fit into my existing site – and you’ve already provided that! In the time since my first post I’ve gotten it working on my localhost. I’ll probably go production later tonight.

Thanks again!

(ps – just noticed the phrase “whom which” in my first post… I don’t know what a whom which is, but it sounds delicious!)

By: Michael Wales

Michael Wales — Tue, 27 Apr 2010 15:44:17 +0000

@vecima There is nothing inherently wrong or insecure in this release, so I would say you will be okay in using it. My concern simply lies in the fact that it has not been tested much and it could, potentially, have bugs. It's also not very configurable at the moment, locking you into a very specific set of ideas (controller naming, etc.) but this is easily changed within the library files themselves. Keep an eye on the BitBucket repository for future development.

By: vecima

vecima — Tue, 27 Apr 2010 15:22:15 +0000

Hey Michael, I’m a big fan of Erkanaauth, and I have to say that I find 2.0 much more easy to wrap my head around.

I realize that alpha code shouldn’t be used in production, but I have a client for whom which security was a secondary concern to just getting the website online (there is no personal data, no financial data or transactions – purely product / location information). I made an admin controller so he could log in and maintain that information himself, and included a very rudimentary login system that wasn’t very secure. Security isn’t my strong point, and with smart guys like you inventing the wheel (or maybe in the case of erkana the “zen” of the wheel), I’m happy to use a library, so long as it’s demonstrably secure.

I guess my question is this: would using erkana 2.0 on a production site be the lesser evil to my hackneyed attempt at security? you seem to cover many more of the bases than my attempt did anyway.

Also, how long / how far away, until you post that you’re happy with the code, and it’s got the stamped seal of approval for use in production code?

By: Michael Wales

Michael Wales — Thu, 01 Apr 2010 19:37:29 +0000

@Patrick Yep - super easy. The only thing Erkana requires is an id field and either a username or email field.