A3M Account Authentication and Authorization

A3M, is an Account, Authentication and Authorization library for Code Igniter, that allows your users to login, register and use social networking account information to populate your system with.

http://www.sirwan.me/a3m

Key Features

1. Sign Up, Sign In (with remember me) and Sign Out
2. Reset Password for native account
3. reCAPTCHA support (optional)
4. SSL support (optional)
5. Language file support
6. Sign In “Fail Attempt Offset” before user has to always solve the captcha (this is google style. Basically you can keep trying over and over… at human speed.)
7. Semantic XHTML views
8. Actively supported by developer

Design Goals

1. User Experience (See demo here)
2. Create code that is easily re-purposed - loosely coupled and follows CI PHP Style Guide
3. Adhere to security best practices - takes salt hash, sql injection, xss, etc in to consider
4. Proper MVC separation (working with and without Modular extensions… all credit to wiredesignz)
5. Reduce code bloat - by reused CI Core code as far as possible, form_validation, sessions, etc
6. Optimal performance - Minimal autoloading, don’t xss_clean for no good reason, etc
7. Configurable via config file - if it’s not in there it’s was likely a design decision, feel free to question
8. Everything is built layer by layer first - CSS and JS optional because it can be stripped away and everything work the same. Degrades gracefully.

Development Roadmap

1. AJAX validation on client side - Will be built using JQuery but since the code is well separated you can throw it away easily if you don’t want this
2. Signin/Signup with Facebook, Twitter and OpenID (google, yahoo, etc) (done)
3. Flexible Authorization access control based on roles and permissions
4. Change password, email and username (done)

Caveat: This module uses query strings. This might be controversial but I really honestly think not using GET totally is quite inflexible. I always settle for a mixture of segment based and GET. With that said, if you’re a segment based purist the code should be easily modified to remove GET. The other one is that I’m using CI Sessions, I love it! I did modify its certain short comings but it’s does the Session job well (and secure) imo.

Much work went into this and you free to use it as you please. All I ask is that you contribute back any bugs fixes, improvements and other thoughts you have so that we can keep improving this module. This is still unfinished work and i’m just upload it early to get feedback from the community.