same password for multi-users in zend

Question

I have the following scenario in zend framework:

Data Table of students Table of classes, which contain many students each. Table of assignments, each of which is assigned to a class and given a password

I want students to be able to access an assignment given that assignment's id and shared password, but for the application to note which student signed in to the assignment. Zend_Auth however expects one table to contain both the username and the password, but in my situation the username is in the students table, and the password is in the assignments table.

Can anyone suggest a good way of handling the student login where they can all share one password. A way to authenticate with just a username and no password would work, as then I could do the password check in a separate conditional.

Answer 1

Shared passwords are a really bad idea. If you share the password, then another student need only learn an id -- typically not a highly secured piece of information -- to access the resource as the other student. A better solution would be to use a role to control access to assignments and put the students who need access to the assignment in the role. This way each student can still have access to the assignment and retain their own id/password pair. See the Zend documentation for information on roles and how to use them.

Answer 2

I think your best bet would really be to just write your own adapter. Something like this would most likely work:

class MyAuthAdapter implements Zend_Auth_Adapter_Interface
{
    protected $_username;
    protected $_password;
    protected $_assignment_id;

    /**
     * Sets username, password, and assignemnt ID for authentication
     *
     * @return void
     */
    public function __construct($username,$password,$assignment_id)
    {
        $this->_username = $username;
     $this->_password = $password;
     $this->_assignment_id = $assignment_id;
    }

    /**
     * Performs an authentication attempt
     *
     * @throws Zend_Auth_Adapter_Exception If authentication cannot
     *                                     be performed
     * @return Zend_Auth_Result
     */
    public function authenticate()
    {
        // logic here to check everything out and erturn a new Zend_Auth_Result  
    }
}