Core Auth Library

[eluser]Circuitbomb[/eluser]
[quote author="Rick Jolly" date="1250290144"]A core auth library must be totally generic, making no assumptions. A few lines of code, and something every developer can do in a couple minutes. That's why there isn't auth in the core. ACL is a different story.

thody, your attempt is already too specific. Username, id, and email could all be the same thing. Don't store a user in the session, just their id. Reason being, if an admin changes any user credentials, they won't update for a logged-in user until their session expires. Don't use a get_attr() method when php magic methods will accomplish the same thing. Also, don't dismiss the dozens of existing auth libraries. At the very least, you could learn something from them.[/quote]

I would think that the point of id/username/email combinations would be that they are different, but unique to only the individual member. Of course one of any of those variables could be used to identify a member, but why use one, when one of the other two may have a specific usefulness in any multi-user system.

I think that in any user system those three forms need to be present, and are the generic values that need met at the least. How does storing the id update changes for a logged in user while the session is still alive compared to if you used the username? I would think that the session would still need to die or be regenerated in order to see the changes regardless of which one you used.

The only difference I see would be the number of characters used.