School Tools for Online Resource Management

Overview and Login Module

v0.1.0

Contents

Introduction

Project Overview

The User Experience

The ICT Support Team Experience

Design Objectives

Technical Overview

Database

PHP

Apache

Additional Software

Additional Listings

Introduction

This document details the process of logging into the School Tools for Online Resource Management project and using that authentication to navigate through the sections of the project. Also covered in this document are the pages for creating a new user.

Project Overview

The Login pages of the School Tools for Online Resource Management project allow a user to authenticate themselves against the user database. Based on that authentication they will be granted or denied access to modules of the School Tools for Online Resource Management project, and allowed access to simple account management options.

The User Experience

The School Tools for Online Resource Management project should provide the following facilities to the end-user:

Allow the user to authenticate themselves with the School Tools for Online Resource Management system.

Allow the creation of new users.

Reject unsuccessful authentication attempts in a secure way.

Allow the user to recover their password, perhaps by e-mail.

Pass the authentication and security settings to other School Tools for Online Resource Management modules.

Authentication

The method of authentication should require as little effort as possible from the end user. A simple username and password combination is all that is required to enter the School Tools for Online Resource Management system.

School Tools for Online Resource Management Start Page

Following authentication the user should be presented with the option to navigate to a School Tools for Online Resource Management module(s), get help on using the School Tools for Online Resource Management system and a few basic account management tools.

Information On How To Use School Tools for Online Resource Management

Although it is envisaged that the School Tools for Online Resource Management system should be as easy and intuitive to use as possible and that the users will be provided with training in the use of the system as part of their professional development, the School Tools for Online Resource Management web pages should also provide information on how to use the system. This will serve as a useful reminder to users who have used the system previously and will help users who are new to the system but have not received any Professional Development.

Information about School Tools for Online Resource Management and how it works

For users of the system that want to know more about School Tools for Online Resource Management and the technical mechanisms behind its functionality, information about the School Tools for Online Resource Management project will be provided.

The School Tools for Online Resource Management Administrator Experience

The School Tools for Online Resource Management project should provide the following facilities to the School Tools for Online Resource Management Administrator:

Allow only authenticated access.

Allow removal of a School Tools for Online Resource Management user from the system.

Reset the password of a School Tools for Online Resource Management user.

Force a School Tools for Online Resource Management user to change their password at next logon.

Adjust access levels on a “per user” basis.

Edit a user's personal details.

School Tools for Online Resource Management Start Page

Following authentication the user should be presented with the option to navigate to a School Tools for Online Resource Management module(s), get help on using the School Tools for Online Resource Management system and a few basic account management tools.

Information On How To Use School Tools for Online Resource Management

Instructions for use of the functions available to the ICT Support Team should be available through the School Tools for Online Resource Management pages.

Design Objectives

The pages will be designed to be used as an in-line page element, allowing use integrated with an existing intranet. School Tools for Online Resource Management pages should feature a banner identifying it as a School Tools for Online Resource Management page and contain the School Tools for Online Resource Management logo. These elements should be designed simply to reduce page loading times and not to clutter the page with large graphics.

Technical Overview

The School Tools for Online Resource Management Login pages use a web-based interface, and are therefore platform-independent . The "School Tools for Online Resource Management server" will be made up of the Apache HTTP Server, with the PHP programming language and an SQL database back-end accessed through the PEAR::DB module. Due to the greater stability of Apache on Linux over Windows, Linux is suggested as the platform for the School Tools for Online Resource Management server.

Passwords are encrypted using the md5 algorithm before being stored in the database.

SQL

The key to the successful development and use of the School Tools for Online Resource Management login system is the structure of the underlying database.

Database Name: STORM

Table: users

Primary Key: username

Attribute	Data Type	Default Values	Required Field?	Description
username	VARCHAR(30)		Yes	School Tools for Online Resource Management username
userForename	VARCHAR(255)		Yes	User's Forename
userSurname	VARCHAR(255)		Yes	User's Surname
password	CHAR(32)		Yes	MD5 Encrypted password
changepass	INT(1)	0	Yes	Whether password should be changed at next login
email	VARCHAR(255)		Yes	Users e-mail address
date	DATETIME		Yes	Date and Time of user creation
passdate	DATETIME		Yes	Date and Time of last password change.
login	INT(1)	0	Yes	Access right for login module
SATYR	INT(1)	1	Yes	Access rights for SATYR module
CartMan	INT(1)	0	Yes	Access rights for CartMan module
EQuip	INT(1)	1	Yes	Access rights for EQuip module

Account permissions

The “admin” account needs: DELETE, INSERT, UPDATE, SELECT

The “ict” account needs: SELECT, UPDATE, INSERT

The “user” account needs: SELECT, INSERT

The “login” account needs: SELECT, UPDATE, INSERT

Database Name: STORM

Table: settings

Primary Key: function

Attribute	Data Type	Default Values	Required Field?	Description
Function	CHAR(30)		Yes	Setting name
Value	CHAR(30)			Value relating to function

The Function/Value pairs that should be present in the table are:

Function	Default Value
passwordexpiredays	0 (0 value disables this feature)
dayspercycle	10
chunksperday	9 (follow on page includes “mapping” feature)
mailServer	localhost
urgentequipdays	1 (0 value disables this feature)
daysSinceDay	1
daysSinceMon	9
mailFrom	STORM@localhost
passResetMail	1
passResetSATYR	1

Account permissions

The “admin” account needs: DELETE, INSERT, UPDATE, SELECT

The “ict” account needs: SELECT

The “user” account needs: SELECT

Database Name: STORM

Table: timechunk

Primary Key: number

Attribute	Data Type	Default Values	Required Field?	Description
number	IINT(2)		Yes	Internal system name for the time chunk
publicName	VARCHAR(255)			User space name for the time chunk

Account permissions

The “admin” account needs: DELETE, INSERT, UPDATE, SELECT

The “ict” account needs: SELECT

The “user” account needs: SELECT

Database Name: STORM

Table: teamMember

Primary Key: name

Attribute	Data Type	Default Values	Required Field?	Description
name	VARCHAR(30)		Yes	Name of ICT Support Team Member

Account permissions

The “admin” account needs: DELETE, INSERT, UPDATE, SELECT

The “ict” account needs: SELECT

The “user” account does not require access

Database Name: STORM

Table: roomlist

Primary Key: name

Attribute	Data Type	Default Values	Required Field?	Description
name	VARCHAR(30)		Yes	Room

Account permissions

The “admin” account needs: DELETE, INSERT, UPDATE, SELECT

The “ict” account needs: SELECT

The “user” account needs: SELECT

Account permissions

The account structure should take into account the following:

The root user needs to be able to administer MySQL as a whole, including another databases available through the MySQL server. Hence there should be no restrictions on this account. Automatic account name: root

The account for logging and creating new users should be independent of the other authentication methods, as the users are unauthenticated at this point. The account needs to be able to: INSERT, SELECT and UPDATE on the table “users” and SELECT on the table “settings”. Suggested account name: login.

The School Tools for Online Resource Management administrator needs to be able to: DELETE, INSERT, SELECT, UPDATE, ALTER on the table “users” and SELECT and UPDATE on the table “settings”. Suggested account name: admin

The ICT Support Team members need to be able to:

SELECT on all fields for producing tables and search queries.

UPDATE on all fields for evaluating / updating support request details.

INSERT to create new MySQL table entries.

Suggested account name: ict

Users need to be able to:

SELECT on all fields for producing tables

INSERT to create new MySQL table entries.

Suggested account name: users

Module Access Control

All School Tools for Online Resource Management modules have a four levels of access, and each module can be set at a different level from the other. For example, one user could access the admin features of the SATYR module, but have no access at all to the CartMan module. To this end, the four levels of access are defined across the modules as:

0 – No access

1 – “User” Access

2 – “ICT Staff” Access

3 – School Tools for Online Resource Management system administrator access

The exact outcome of what features are available as a result of these settings depends on the code of the individual modules. The install default access level for each module is the level that a normal user is anticipated to need. This level can be adjusted through the administration interface. For example, the default level for the SATYR module is 1, allowing a user to submit a support request, whilst the default level for the CartMan module is 0, not allowing any information on stock levels to be available to normal users. The effect is that users must be explicitly allowed to access a module that has the default access level set to 0. Setting all users access to 0 means that that module is effectively unused.

PHP

A recent version of PHP that supports the inbuilt variables and arrays is essential to the operation of School Tools for Online Resource Management. For security reasons, global variables are disabled.

PHP sessions will be used to prevent the end user from having to re-authenticate at every new page. Transferring session IDs between pages uses cookies by default or internal variables as a fallback option. These methods allow users to continue through the School Tools for Online Resource Management pages without being re-authenticated, and also prevent users from book-marking pages in a session. If a user tries to view a page that was book-marked from a PHP session the user will be returned to the School Tools for Online Resource Management front page.

The following settings need to be adjusted in the file php.ini:

session.auto_start On. This setting tells the PHP engine to include every PHP page in the session. (If necessary this option can be disable and each School Tools for Online Resource Management page amended with a session_start() parameter if the automatic session setting disrupts other PHP pages served by the same web server.

Common Processes and Page Elements

PHP processes and page elements that recurr across pages should be coded in separate "include" files and functions to allow changes to be made to a single file but reflected across the whole School Tools for Online Resource Management site.

Apache

Apache can be set not to display dynamically generated index pages as a security measure. The file httpd.conf will need to be edited to associate files with the extension .php with the PHP processing engine.

Additional Software

Further software needed on the School Tools for Online Resource Management server may include:

cron for scheduling tasks, including automated generation of SQL dump data.

an automated backup solution for the SQL data, most likely a remote service.

An Apache log analyser.

Laura Cowen

1995-11-21T17:41:00