Editing User:Ckeene/Ideas for future versions of eprints (section)

== Allow users to be authenticated by an external system ==

See my [http://www.eprints.org/tech.php/8842.html email message from April 2008].

At the moment eprints can be configured to use an LDAP server for authentication. Eprints takes the user credentials and then passes them to the LDAP server for authentication.

Perhaps a more generic extension to this is to allow the our sourcing of authentication completely.

E.g. when authentication is needed, the user is redirected to a predefined webpage (probably on the Institutions website) which handles login, and can pass back to eprints a successful login and the username of the user who has logged in.

* ''I think this is already what we do with eprints.ecs, as al authentication is handled by a single login page. I will check with Chris'' [LES CARR]

This is a little similar to what ezproxy can do
http://www.oclc.org/us/en/support/documentation/ezproxy/usr/cgi.htm
and also, in a way, to how shibboleth works.

The advantage is that it would allow a wide variety of campus authentication systems to be used to authenticate eprints, and eprints does not need to worry about handling password (and being secure with them, which is a key issue!).