A3M - Account Authentication & Authorization Module

[eluser]Peng Kong[/eluser]
Hosted on Google Code
http://code.google.com/p/a3m/

Key Features
1. Sign Up, Sign In (with remember me) and Sign Out
2. Reset Password for native account
3. reCAPTCHA support (optional)
4. SSL support (optional)
5. Language file support
6. Sign In "Fail Attempt Offset" before user has to always solve the captcha (this is google style. Basically you can keep trying over and over... at human speed.)
8. Semantic XHTML views
9. Actively supported by developer

Design Goals
1. User Experience (demo down atm)
2. Create code that is easily re-purposed - loosely coupled and follows CI PHP Style Guide
3. Adhere to security best practices - takes salt hash, sql injection, xss, etc in to consider
4. Proper MVC separation (working with and without Modular extensions... all credit to wiredesignz)
5. Reduce code bloat - by reused CI Core code as far as possible, form_validation, sessions, etc
6. Optimal performance - Minimal autoloading, don't xss_clean for no good reason, etc
7. Configurable via config file - if it’s not in there it’s was likely a design decision, feel free to question
8. Everything is built layer by layer first - CSS and JS optional because it can be stripped away and everything work the same. Degrades gracefully.

Development Roadmap
1. AJAX validation on client side - Will be built using JQuery but since the code is well separated you can throw it away easily if you don't want this
2. Signin/Signup with Facebook, Twitter and OpenID (google, yahoo, etc) (done)
3. Flexible Authorization access control based on roles and permissions
3. Change password, email and username (done)

Caveat: This module uses query strings. This might be controversial but I really honestly think not using GET totally is quite inflexible. I always settle for a mixture of segment based and GET. With that said, if you’re a segment based purist the code should be easily modified to remove GET. The other one is that I’m using CI Sessions, I love it! I did modify its certain short comings but it’s does the Session job well (and secure) imo.

Much work went into this and you free to use it as you please. All I ask is that you contribute back any bugs fixes, improvements and other thoughts you have so that we can keep improving this module. This is still unfinished work and i'm just upload it early to get feedback from the community.

Installation Steps
1. Download, extract, upload the 'a3m' folder
2. Run sql script a3m/a3m.sql
3. Config your database connect
4. In module config, turn on reCAPTCHA (optional)
5. In module config, turn on SSL (optional)


Change Log

v0.3
1. Uses phpass to hash passwords
2. Signin with Google, Yahoo, AOL, MySpace and OpenID
- with support for SREG, AX and PAPE

v0.4
1. Total 'refactor' of codes. Reorganization of codes
2. Sign in with Google, Yahoo!, AOL, Twitter, MySpace, Facebook and any OpenID Provider
3. Not yet done: forget password, verify email, account management. (to do in v0.5)

v0.5
1. Some minor bug fixes. TBH i forgot to log what i changed but the good news is that as of v0.5. my code is under internal version control (subversion)
2. Account pages
- Account Settings - change email, fullname, firstname, lastname, dateofbirth, gender, postcode, country, language, timezone
- Change Password
- My Profile - change username, change profile picture
- Linked Accounts (to do in v0.6)
3. Forgot password

v0.6
1. Linked Accounts
2. OAuth Server (with OAuth Test Client)