[Phpgroupware-developers] My recent ACL implementation is probably dead

[Dan Kuykendall]

I recently completed the core of a new ACL class which is more flexible 
and faster. I have been dieing for a standard to use and last year I had 
looked at XACML, but too much had been incomplete and I couldnt tell if 
it would be the one to succeed. There have been a couple XML based 
ACL/security solutions which have all failed to take off, but this time 
it looks like XACML is going win and has good support thru a Java 
implementation that Sun sponsored.

I am immediately jumping into the spec and the java source to see what 
it will take to create a PHP implementation. From my review thus far it 
looks like a good deal of work. We have a couple options to consider at 
this point and here are my current opinions about what we can do.

1) I can re-work my new ACL a little bit so that it will basicly follow 
the rules of XACML in terms of how it decides if a user has rights. We 
can use this ACL as an internal/default implementation. Then I can write 
a XACML client which would be a drop in replacement to our ACL like we 
have for accounts and auth. So then our users can have the choice of 
setting up a XACML server and then having phpGW pull from that.

2) Implement XACML in PHP, then use that.

3) Hell with standards!

Dan