User Tools
Add this page to your book 
Remove this page from your book 
Manage book (
Help This is an old revision of the document!
Table of Contents
Integrator Guide
Auth Ticket : Direct access auth
This guide is provided for :
- Integrators and administrators using the auth_ticket as part of other feature
- Developers that want to send self-authenticated notifications
Administrators and integrators
This plugin provides the way to some other plugins to send pre-authenticated tickets to users. This addresses a set of security considerations :
Ticket validity time
Tickets have a validity time that obsoletise the ticket after some delay. If tickets may be used in a non HTTPS secured environment, the timeguard of the tickets should be kept as little as possible. There is a potential risk of stealing a ticket somewhere on the network by misintentionned people that might use it to enter moodle into a user account.
Usually it will be recomended tickets be used in a secured HTTPS context, thus the ticket data sequence is protected all amonth the path from sender to server.
Developers
Ticket pre-authenticated user
The ticket holds the user identity it has been created for. Thus it will be quite a bad idea to send admin pre-authenticated tickets to non desired people. The developpers using the auth_ticket API should care about this risk.
Long, short and persistant tickets
As increasing the ticket validity time enlarges the risky time window, developpers should care sending likely short tickets rather than long tickets. Although persistant tickets has been given as a possibility, this validity time should not be used, or assigned to trashbin fake users with very restricted capabilities.
Ticket API
The ticket API is contained in the lib.php.
function ticket_notify($recipient, $sender, $title, $notification, $notificationhtml, $url, $purpose = '', $term = 'short')
Simple sending to user with return ticket. The return ticket allows auser receiving amail to enter immediately the platform being connected automatically during a hold time.Tthe ticket is catched by a custom auth module that decodes generated ticket and let user through.
Only recipients that have a valid Moodle account can use an access tickets. The ticket is only valid on the given return URL and cannot be used for going to another location, unless user's profile other mention.
- @param object $recipient
- @param object $sender
- @param string $title mail subject
- @param string $notification raw content of the mail
- @param string $notification_html html content of the mail
- @param string $url return url of the ticket
- @param string $purpose some textual comment on what the ticket was for
- @param bool $term the ticket validity duration, may be 'short', 'long' or 'persistant'.
