PHP login class

Question

I'm looking for a good PHP login class via MySQL, and I'm not yet completely satisfied with anything I've found. This prior SO question doesn't really address my needs, as I'd prefer to stay away from PEAR and CodeIgniter, and just have a simple and small PHP class to do the job.

There's a TalkPHP forum that has several to choose from, but they all seem to have something or other lacking.

• PHP Login Class by daz: seems a little tricky to extend, and doesn't support multiple user roles
• TalkPHP.com_Login_Script.PHP5.Beta_1 by Wildhoney: looks very extensible, supports configurable user roles, but no db support and stores passwords in plaintext in an XML file!
• authclass by Sam Granger: again, no support for multiple user roles, but does use MySQL

Now, my first instinct was to just dive in a re-code the last one in that list (authclass), but fortunately, my second instinct was to ask stackoverflow :)

So here's the big question: is there a secure, open source, multiple-user-role login class for PHP5 and MySQL that anyone is using? Thanks in advance, and I appreciate any kind of comments here, even if you don't have a particular piece of code to point to!

Answer 1

Take a look at Zend_Auth:

Zend_Auth is concerned only with authentication and not with authorization. Authentication is loosely defined as determining whether an entity actually is what it purports to be (i.e., identification), based on some set of credentials. Authorization, the process of deciding whether to allow an entity access to, or to perform operations upon, other entities is outside the scope of Zend_Auth.

For a multiple-user-role (authorization) implementation take a look at Zend_Acl:

Zend_Acl provides a lightweight and flexible access control list (ACL) implementation for privileges management. In general, an application may utilize such ACL's to control access to certain protected objects by other requesting objects.

Please keep in mind that it's possible to make use of those without having to commit to using the entire Zend_Framework, as it's not a full-stack framework, and I'm in no way trying to encourage you to use the above, or any framework for that matter. Just thought I would mention those as they haven't been already.

Answer 2

I would suggest taking a look into how Drupal handles their log-in service. I'm quite fond of that whole message board setup - you may be able to take some of their ideas and make your own class