Definition: SC = service-contract
Authorities
-acs-authentication can have multiple authorities, each one represent an specific configuration of authenticatication. For instance, in your openacs installation you can have users related to different authorities, some of them might authenticate locally since they are external or invited, others belongs to your corporate network and already have users, so might authenticate against LDAP and others in your own work office might use PAM for authentication because your local system authentication. Plus you might define an specific implementation (using the set of SC) to connect to your client DB, which is in another DB, and allow your clients login to certain parts of your website. Then, this is right way to handle all those set of users, that already might have an account in another place and you just want them to authenticate against that external system.
+
acs-authentication can have multiple authorities, each one represent a specific configuration of authenticatication. For instance, in your openacs installation you can have users related to different authorities, some of them might authenticate locally since they are external or invited, others belongs to your corporate network and already have users, so might authenticate against LDAP and others in your own work office might use PAM for authentication because your local system authentication. Plus you might define a specific implementation (using the set of SC) to connect to your client DB, which is in another DB, and allow your clients login to certain parts of your website. Then, this is right way to handle all those set of users, that already might have an account in another place and you just want them to authenticate against that external system.
The idea is: each user belongs to a given authority, and just one .
To add an authority in your installation go to /acs-admin/auth/ and click on "Create new authority".
@@ -48,7 +48,7 @@Those configurations simply will perform the tcl proc that is defined in the SC above described for the given SC implementation that you choose. In other words:
+Those configurations simply will perform the Tcl proc that is defined in the SC above described for the given SC implementation that you choose. In other words:
Then you can enter your specific values for your server, is likely that the recomemded ones will work fine.
Hint: nssha (SSHA) doesn't work well with LDAP use ns_passwd or another encryption method (MD5...)
-You can make your users to logging using the email or username, by changing the parameter at the kernel named: UseEmailForLoginP under Security section. If username is used for logging, it will ask for the authority to use, since username is unique by authority but not for the entire openacs installation (can exists several identic usernames but each one belongs to a different authority).
+You can make your users to logging using the email or username, by changing the parameter at the kernel named: UseEmailForLoginP under Security section. If username is used for logging, it will ask for the authority to use, since username is unique by authority but not for the entire openacs installation (can exists several identical usernames but each one belongs to a different authority).
acs-authentication defines a set of SC to interact with the different authentication implementations (LDAP or PAM):