Allow checking credentials without logging in

[midahp]

There currently seems to be no (easy) way of checking credentials without actually logging in a user.

There is a $login parameter in the Horde_Core_Auth_Application::authenticate method which is then passed to the authenticate method of the base/parent auth class, but it is not used anywhere in the Horde_Auth_Base::authenticate method.

If there is already a way to just check credentials, please let me know.

Maybe this issue would be better in the horde/auth repo, but issues are not enabled there.

[ralflang]

We are reworking the rampage and middleware stack right now to support all sorts of scenarios in which we want to make sure some token matches an existing, still valid session or some auth credentials are valid without actually initializing "authenticated state".

@midahp Key question for you: Would caching be acceptable? Some backend auths are unreasonably slow if done twice in a pattern of "now we only want to know" - "now we really want the session".

[midahp]

We are reworking the rampage and middleware stack right now to support all sorts of scenarios in which we want to make sure some token matches an existing, still valid session or some auth credentials are valid without actually initializing "authenticated state".

@midahp Key question for you: Would caching be acceptable? Some backend auths are unreasonably slow if done twice in a pattern of "now we only want to know" - "now we really want the session".

@ralflang Sounds interesting. Are you talking about the caching driver? You probably don't want to have any passwords in some cache files for example, right? Or are you talking about caching in the current php process only?

In general I am not opposed to caching, as long as there are no security issues and as long as the check does not actually login the user.

[ralflang]

I am talking about in-process, not in a cache driver. However your credentials usually end up in a backend session (most likely file or sql)

because backends such as imap traditionally need them for THEIR authentication. I am currently designing a truely session-less flow for APIs. Previously the rampage.php would always initialize a session even where it didn't make sense.

The new flow will require an active opt-in first (don't want to break anything relying on the old behaviour)

[ralflang]

@midahp please close as resolved once you got around to checking #94 if it implements what you needs.