Changes between Version 31 and Version 32 of S3/S3AAA

Timestamp:

01/18/11 00:38:17 (12 years ago)

Author:

Dominic König

Comment:

--

S3/S3AAA

@@ -151 +151 @@
 In case of failure, a well-defined response action must take place:
 
-  - in interactive formats:
-    - the user should be informed that he has insufficient permissions (if already logged-in)
-    - the user should be requested to login (+forwarded to the login page)
-  - in non-interactive formats
-    - the client must receive a HTTP 401 (Authorization Required) error if not logged-in in order to trigger an authentication attempt
-    - the client must receive a HTTP 403 (Forbidden) error code to cancel its attempt properly
+  - in '''interactive''' formats:
+    - already authenticated users should be informed about the insufficient permissions, and redirected to a (unrestricted) landing page
+    - unauthenticated users should be requested to login, and thus forwarded to a login page
+  - in '''non-interactive''' formats:
+    - authenticated clients must receive a HTTP 403 (Forbidden) error code to cancel the request properly
+    - unauthenticated clients must receive a HTTP 401 (Authorization Required) error in order to trigger an authentication attempt
 
 All this is covered by the {{{auth.permission.fail()}}} method:
@@ -166 +166 @@
 }}}
 
-For interactive modes, you can set the destinations for redirection before calling {{{auth.permission.fail()}}}:
+For interactive modes, you can alter the destinations for redirection by setting:
 
-  - {{{auth.permission.homepage = URL(...)}}} for the case where the user is logged-in, but has insufficient privileges (defaults to {{{default/index}}}).
-  - {{{auth.permission.loginpage = URL(...)}}} for the case where the user is not logged-in (defaults to {{{default/user/login}}}).
+  - {{{auth.permission.homepage}}} for redirection when the user is logged-in, but has insufficient privileges (defaults to {{{default/index}}}).
+  - {{{auth.permission.loginpage}}} for redirection when the user is not logged-in (defaults to {{{default/user/login}}}).
 
 Example: redirect to {{{my/index}}} rather than to {{{default/index}}} in case of insufficient privileges of an authenticated user: