Login button and User Identification

For as long as I've been using and designing and building web-based systems I've had to deal with programmers and user who simply "don't get it" that the Web is a stateless machine, not like a telnet session. You don't have a Login - pesistence of identity, authentication and authorization - Logout. Preaching about the web being stateless doens't help. Often it just aleinates them.

The trouble is

• they expect it to work like a connection oriented session
• they see applications that seem to similate it

The real problem is that word "simulate". What the users, programmers, and security people see are very different things. Anyone who has ever tried to deal with e-commerce knows about hijacking and editing cookies. Some applications solve this by downloading a java applet that does set up a persistent connection to the server.

An ideal ?

Ideas about visually resticting "edit-ability" by blanking the "edit" in the menu or replacing it with an icon that may or may not be visible have been discussed. All well and good, but they don't solve a very basic problem. (Personally I think menus should even show you what they promptly tell you you can't do, but we can argue that seperately.)

If there has been no identification and authentication - that is when the code in the library tried to determine the user - if it comes up blank it substitutes "TWikiGuest". That, for example is wht pages that don't have metadata identifying the person who edited/created them appear to have been edited/created by TWikiGuest.

What this means internally is that "TWikiGuest" is really a flag meaning "_no user identity available_". The problem is that users don't see it like that. Especially when they end up with a personalized elft menu bar entry belonging to main.TWikiGuest. They come back having registered and either expect the sytem to remember them from past logins or re-direct them to a login page which then returns them to the page they wanted to view or edit. They see other system what work like that.

The same problem with TWikiGuest as a flag applies to the default view. An entry of %WIKIUSERNAME% in a topic would apepar as TWikiGuest to someone who had just connected. And remember, one of the strengths of TWiki is that you don't have to go through a login portal to view a page. I can copy a URL and mail it to someone and they can view that page.

The "TWikiGuest" entry can be pernicious. Users that have logged in in the past, perhspa from a different machine, with a different browser, don't get asked to lgoin. Some of my users are complaing that their customized left bar has been altered. In reality they are returning, the system doesn't know who they are yet, and the left menu bar picks up the customized version for TWikiGUest? . To them it appears that they've lost their customization. There is nothing saying "You aer not logged in so the system is assuming you are TWikiGuest"

A Suggested Interface

One idea would be to have an entry in the WebTopBar? that somehow changed state. If the user appearted to be "TwikiGuest" it appeared as a "Login" button. Upon login the user gets returned to the page wih the entry changed to a meaningful "You are %WIKIUSERNAME%"

We then need some kind of "logout", perhaps. Something more pleasant for the user than the kludge at ExampleLogoutPage (HowToMakeATWikiLogoutPage).

Right now I just see a problem and possibilities. I don't have a single solution to propose. Part of it is that I am well aware that TWiki can be configured in many ways, with and without many plugins, with and without many settings.

-- AntonAylward - 23 Oct 2004

1. If you use the latest SessionPlugin there is a macro called %LOGIN_OR_WELCOME%
2. The notion of TWikiGuest? is confusing: this is a guest account with a known password. IMO its different to an unauthenticated user.

-- MartinCleaver - 23 Oct 2004

Right. They are diffenent. And its also used as a flag in the metadata, where its actually recorded as TWikiGuest when it means "there is no author metadata information".

Strategically, though, its more fundamental than that.

There are really three components to a security process:

• Identification
• Authentication
• Authorization

The problem is that Twiki has not seaprated identification and authentication. Its munged them together. That's why TwikiGuest can mean both

• "I didn't log in and I'm acting as TWikiGuest? , the anonymus user"

• Absense of identification.

My point isn't that there is a plugin, part of my point is that I have to use a plugin becuase of this "gap". The other part of my point is the use of "TwikiGuest in place of a logical void.

To be fair, most programmers get it the other way round. They think authentication and authoriztion are the same thing.

-- AntonAylward - 23 Oct 2004