text:
SN 47.19 PTS: S v 168CDB ii 1648
Sedaka Sutta
Translated by Bhikkhu Ñanananda
http://www.accesstoinsight.org/lib/auth ... passage-26
On a certain occasion, the Exalted One was dwelling in the Sumbha country, in a township of the Sumbhas, called Sedaka. There the Exalted One addressed the monks:
"Once upon a time, monks, a bamboo-acrobat set up his pole and called to his pupil, Medakathaalika, saying: 'Come, my lad, Medakathaalika, climb the pole and stand on my shoulders!'
"'All right, master,' replied the pupil to the bamboo-acrobat, climbed the pole and stood on his master's shoulder. Then, monks, the bamboo-acrobat said to his pupil: 'Now, Medakathaalika, my lad, you protect me well and I shall protect you. Thus warded and watched by each other, we will show our tricks, get a good fee and come down safe from the bamboo-pole.'
"At these words Medakathaalika the pupil said to the bamboo-acrobat: 'No, no! That won't do, master! You look after yourself, master, and I'll look after myself. Thus warded and watched each by himself, we'll show our tricks, get a good fee and come down safe from the bamboo-pole.'
"Therein that is the right way," — said the Exalted One. "Just as Medakathaalika the pupil said to his master: 'I'll protect myself': so, monks, should the Foundations of Mindfulness be practiced. 'I'll protect others': so should the Foundations of Mindfulness be practiced. Protecting oneself, monks, one protects others; protecting others, one protects oneself. [77]
"And how, monks, does one, in protecting oneself, protect others? By frequent practice, development and making-much-of (the Foundations of Mindfulness). Thus, monks, in protecting oneself one protects others.[78]
"And how, monks, does one, in protecting others, protect oneself? By forbearance, by non-violence, by loving-kindness, by compassion. Thus, monks, in protecting others, one protects oneself.[79]
"'I shall protect myself': with this intention, monks, the Foundations of Mindfulness should be practiced. 'I shall protect others': with this intention the Foundations of Mindfulness should be practiced. Protecting oneself, one protects others: protecting others, one protects oneself."
[77] It is noteworthy that the parable in this sutta has some peculiarity in that it is not on all fours with the doctrinal points discussed in relation to it. The maxims presented in connection with the practice of Mindfulness ("I'll protect myself"; "I'll protect others,") are an improvement on that recommended by the acrobat's pupil ('You look after yourself, master, and I'll look after myself"). This is the significance of the Buddha's remark: "Therein, that is the right way." This point seems to have been overlooked when the P.T.S. edition and translation attribute these words to the acrobat's pupil, breaking up and distributing the sentence between two paragraphs (The sentence should read:'So tattha ~naayoti bhagavaa avoca, yathaa medakathaalika antevaasii aacariya.m avoca'). The sentence thus wrongly broken up, is then taken to mean that the Buddha here recommends the same acrobatic principle to the monks. ('... Then said the Exalted One: "Now, monks, just as Medhakathaalika, the pupil said to his master, "I'll look after myself," so ought ye to observe the station of mindfulness...' etc.) That principle, striking as it is, is less broad-based than the twin-principle recommended by the Buddha himself: "Protecting oneself, one protects others; protecting others, one protects oneself." As clearly expounded in the Ambala.t.thika Raahulovaada sutta (M. I 415ff) [MN 61], the way to purify one's bodily, verbal and mental actions is by constant reflection on their repercussions on oneself as well as on others. Mindfulness, then, is that benign agent of transmutation which preserves the inner consistency and harmony of this twin-principle.
[78] '...in protecting oneself one protects others': The principle indicated here in brief can be appreciated the better with the aid of the following exhortation by the Buddha at S. II 29 SN 12.23:
"Wherefore, monks, you stir up energy that you may reach what is still unreached, that you may attain what is still unattained, that you may realize what is still unrealized. 'Thus will this going-forth of ours not be barren, but fruitful and of consequence. And those offerings of them whose requisites of robes, almsfood, lodgings and medicaments we enjoy, shall, on our part, be of great fruit, of great consequence for them.' Verily, it is thus, monks, that you should train yourselves. For one who discerns his own good, this is enough to call up diligent effort. For one who discerns another's good, this is enough to call up diligent effort. For one who discerns the good of both, this is enough to call up diligent effort."
'The frequent practice, development and making much of mindfulness' recommended by our sutta, is one that is conducive to the good of both oneself and others. As the commentary observes, even the mere appreciation of a monk who, by his diligent practice, attains to arahantship, will be a thought productive of great merit. Besides, one's devotion to the practice and exemplary life can be a source of inspiration to others. Since greed, hatred and delusion are the mainsprings of all evil intentions resulting in harm to oneself and others, in protecting one's mind from them, one is at the same time, protecting others as well.
[79] '...in protecting others, one protects oneself:'
Forbearance, non-violence, loving-kindness and compassion, being positive altruistic attitudes, directly concern one's relations with the outside world. Yet, on the mental side too, they exercise a wholesome influence conducive to one's own spiritual growth. They are all 'object-lessons' in the practice of mindfulness.


text:
Mulino Marino Fine Yellow Corn Meal - 1kg
Country of Origin: Italy
Region: Piedmont
City / Village: Cossano Belbo
Produced by the Marino family in the town of Cossano Belbo, in the Piedmont region of Italy. Mulino Marino uses exclusively organic grains for their flours. For everything but their type 0 and type 00 flours, they use ancient millstones that have been passed down from generation to generation. The stone grinding preserves essential components that add to nutritional value and flavor of the flours.
Their cornmeal is ground from otto file corn or 8 row flint corn which is an heirloom variety prized for its beautiful golden color and wonderfully deep aroma and flavor.
The fine grind of this cornmeal makes a more uniform polenta without the crunch of the coarse meal while maintaining the deep corn flavor. Use this to make the traditional Italian polenta. It can be prepared in as little as 45 minutes but traditionalists will tell you that the best flavor comes from very slow cooking and constant stirring for 90 minutes (open fire and copper pot don't hurt either!). Use 200 g. of corn meal per liter of water. Serve soft with butter and grated Parmigiano Reggiano.
Produced By: Mulino Marino
View All Products from Mulino Marino
Mulino Marino Fine Yellow Corn Meal - 1kg
Product ID: 00410
|$10.95 x
|This product is currently out of stock.
|Login to be notified when this product is back in stock

subset: commoncrawl


text:
Phoenix VII
Destination: Orange Beach
Type: Condo/Villa
Number of Floors: 15
Bedrooms: 1-3
Baths: 1-2
Phoenix VII will wow you with the gorgeous Gulf of Mexico as a backdrop, gentle gulf breezes blowing across beautiful beaches and ample amenities to keep you comfortable and active on your next Orange Beach, Alabama vacation.
Onsite features such as indoor and outdoor pools, hot tubs and saunas provide soothing alternatives to swimming in the Gulf. However, it's the pristine beaches boasting sugar-white sand greeting the aqua water that is the main attraction, whether you are here for relaxation or the picturesque setting for a beach destination wedding—complete with tropical landscaping and gazebos.
Moreover, a lighted tennis court, basketball court, hot tubs and saunas, a fitness center and grilling areas assure that there will never be a dull moment unless you want one. Finally, sliding glass doors leading to balconies overlooking the beach make each of these charming Alabama vacation rentals a perfect place for a memorable getaway.
|Pool/Hot Tub/Sauna
|Complex Features
|Parking Features
|Additional Amenities
|Closest Airport: PNS
|Nearest City: Pensacola
|"Phoenix VII" Check-In Office
|Check-In Information
|Check-In Office Name: Gulf Shores Office
1557 Gulf Shores Parkway
Gulf Shores, AL
Check-In Time: 3:00 PM
Check-Out Time: 10:00 AM
Open: Monday - Sunday 8:00AM - 8:00PM
251-968-6868 (check-in line)
251-968-6868 (office)
After Hours Check-In Procedure:
Pick up telephone next to office door. Telephone automatically rings to after hours call center. Customer service agents assists with check-in via lock box next to telephone.
888-217-1509(after hours phone)
Phoenix VII - by Wyndham Vacation Rentals
Carol S. | 08/21/2013
Ring in 2015 & Save
Start off the New Year with warm weather & a low rate!
Promo Code: CALLINONLY
Travel Start Date: 12/26/2014
Travel End Date: 01/04/2015
Minimum Night Stay: 3
Sunny Spring Savings
Book now and save up to 20%†* on spring travel
Promo Code: SPRING2015
Travel Start Date: 03/04/2015
Travel End Date: 05/13/2015
2015 Hangout Music Fest
Enjoy 20% off†* when you book your Hangout Music Fest lodging!
Promo Code: HMF2015
Travel Start Date: 05/11/2015
Travel End Date: 05/25/2015
Minimum Night Stay: 3
Long Weekend In Winter
Stay for 3 nights, but pay for only 2†* on a weekend stay this winter
Promo Code: WINTER15
Travel Start Date: 01/01/2015
Travel End Date: 03/03/2015
Minimum Night Stay: 3
Bedrooms: 3
Baths: 2 Full
Type: Condo/Villa
Sleeps: 8
Bedrooms: 2
Extra Sleeping Area: Other
Baths: 2 Full
Type: Condo/Villa
Sleeps: 8
Bedrooms: 3
Baths: 2 Full
Type: Condo/Villa
Sleeps: 8
Bedrooms: 1
Extra Sleeping Area: Other
Baths: 1 Full
Type: Condo/Villa
Sleeps: 4
Bedrooms: 2
Baths: 2 Full
Type: Condo/Villa
Sleeps: 6
View: Gulf Front
Proximity: On the Beach
1 - 2 BR | 1 - 2 BA | Sleeps 4 - 8
1 - 3 BR | 1 - 3 BA | Sleeps 4 - 8


text:
NFPA 34: Standard for Dipping and Coating Processes Using Flammable or Combustible Liquids, 2011 Edition
|Item # 3411
|Member *
|Table of Contents
|Quantity Discounts
Promote industrial fire safety with the 2011 NFPA 34: Standard for Dipping, Coating, and Printing Processes Using Flammable or Combustible Liquids.
NFPA 34 addresses dipping, roll coating, flow coating, printing, and similar processes using flammable or combustible liquids. Parallel to the requirements in NFPA 33 for spray application, this document provides rules for:
- Proper location, design, and construction of dipping and coating equipment
- Installation of electrical systems and control of ignition sources
- Ventilation requirements
- Handling of flammable liquids
- Fire protection
- Operations and maintenance
Major changes in the 2011 NFPA 34: Standard for Dipping, Coating, and Printing Processes Using Flammable or Combustible Liquids include:
- Appropriate changes throughout the standard to address basic fire safety for printing operations
- Amendments to the scope to include vapor degreasing processes and to exempt processes using only Class IIIB combustible liquids
- A provision to prevent coating of workpieces whose surface temperature exceeds the boiling point of the coating material
- Provisions to describe the hazardous (classified) areas around printing presses and ink reservoirs
- A requirement for means to dissipate static electricity from nonconductive substrates
- Maximum quantities of flammable and combustible liquids revised for consistency with NFPA 30: Flammable and Combustible Liquids Code.
- Improved requirements for housekeeping and handling of impregnated rags and waste
- A new requirement for solvent recovery systems to meet appropriate provisions of NFPA 30
Protect lives and work-in-progress. Mitigate fire and explosions hazards with the 2011 NFPA 34. (Softbound, 30 pp., 2011)


text:
Vasque is known for its performance enhancing trail running, hiking, and backpacking footwear. By going to great lengths to understand foot anatomy and function, Vasque shoes and boots offer multiple fit options for all men and women.
Thank You to Outdoor USA Magazine for selecting Denali as one of the 2014 Top 100 Outdoor Retailers! Denali is part of the Trailblazer family and has store locations in New Haven, CT and Wakefield, RI. DenaliOutdoor.com offers you top outdoor brands like The North Face, Patagonia, Merrell Footwear, UGG Australia, Marmot, New Balance, Asics, Nike and more plus free shipping on orders over $50!
Questions? Call 866.451.3795 ext. 1 (Weekdays 8:30am - 4pm EST) or email@example.com
Find us on Google+ | Denali Outdoor is Upfront


text: 4 Very good film, maybe buy dvd than blu ray disc?KAV2007 | 15/07/2008 | See all KAV2007's reviews (113)Top 100 Reviewer Top 100 DVD Reviewer First of all the movie, great acting peformance from Brad Pitt, very intense performance. The movie requires a lot of attention to pick up all the talking that goes on and the storys that are told. this film is not an action movie, its a drama, so there are no major gun fights etc.In respect of blu ray, although it looks good, this type of film does not do it justice, nice backgroaunds etc, but nothing that will give you the wow factor.I would recommend this film, but on dvd, then use your dvd upscaler to bring the picture up. for this type of movie it will be cheaper but still effective.i hope this helpsThanks


text:
Pricing & Reservations - se habla Español 800-242-1715
Refine Search:
4750 Scarlet DriveColorado Springs, CO 80920
Phone: 719-282-1000
4 Miles from 80927
As low as
$ 85
per month
Questions? Call 800-242-1715
For Your Convenience:
We've selected our most common size for you: 5x10.
To begin, please select the size you're most interested in.
Save 50% on Next Month's Rent! Special (Learn More)
Get Next Month Free! Special (Learn More)
Free Van/Truck Rental with Move-In (Learn More)
Climate Controlled Storage (Learn More)
Great location, loved the climate controlled environment and the ease to come in before and after hours. That was a plus!Amy from Colorado Springs, CO
June 23, 2014
Norissa and Anthony have done a great job. I was coming to buy boxes right as Norissa was closing up. She was very helpful letting me slide in under the clock to get the packing supplies I needed. Really appreciated that.Sean from Colorado Springs, CO
November 26, 2014
The staff at the Colorado Spring's location was simply fabulous. When searching for a long term unit, I called a number of local places, and while Uncle Bob's price was slightly higher over-all, the assistance I received from Ulysses was so excellent that I decided to go with your company. From the day we moved in, right on up to the day we moved out, your staff was unfailingly polite, friendly, helpful and went above and beyond to make sure that we were well looked after. I'd like to especially thank your manager, Norissa, for being so professional. I'd recommend your company, and in particular this location, to anyone based on our experiences!Kendra from Mesa, AZ
November 23, 2014
I just didn't expect a place called "Uncle Bob's" to be so nice...I was sort of expecting a tiny family owned thing.Alex from Hartland, WI
October 28, 2014
There was a customer ahead of me so I had to wait since there was only one representative at the facility. However, she was awesome!Denise from Peyton, CO
October 28, 2014
I just wish that what is said by mgmt and upper mgmt is honored and I'd like to finally retrieve my things. Furthermore, the manager currently employed at my location should revisit the simple tenets of CUSTOMER SERVICE! This has been a disappointing and souring experience and I just want my belongings and I will never breach the threshold again!!!Julian from Colorado Springs, CO
September 7, 2014
My survey wasn't excellent only because there was a few problems that may not have been Uncle Bob's. I am military and my good have been in the storage facility for a couple years; before Uncle Bob's took over. When I stopped in while driving across the country (one duty station to the next) some of my information and the keys I left to the locks on the unit were not with the new facility manger. My copy of the keys were packed away and my we were forced to cut the locks off. I don't fault the facility manager as I don't know how the hand over went with the last owners. Other then that I had a great experience.Gerald from Lakewood, WA
September 6, 2014
The lady who helped us in the office, showed us to the storage space, and helped me figure out the lock was very gracious. She knew her job and explained it in a warm and encouraging manner.Sandra from Colorado Spring, CO
August 24, 2014
Norissa is so helpful and also there when ever I need help. She know a lot of the customer by name and hasn't even been here very long. It's amazing. The place is very clean again! She's does a awesome jobAmy from Colorado Springs, CO
July 5, 2014
All of the staff (Ulysses and especially Norissa) are friendly, knowledgeable and behave in a very professional manner. This was a tough move for me and the staff made the storage part of the process painless.Mary Jane from Aurora, CO
July 1, 2014


text:
Official Store
Villanova Chosen Unanimously To Win Regular Season in Conference Coaches' Poll
With four starters returning from last year's team that won the BIG EAST regular season and finished 29-5 overall, Villanova has been selected to win the 2014-15 conference crown in the BIG EAST Preseason Coaches' Poll. The Wildcats received all nine possible first-place votes and 81 points. Coaches did not place their own teams in their ballots.
Villanova to Celebrate 30th Anniversary of 1985 Championship on Nov. 4
The Villanova community will welcome home its iconic 1985 NCAA Championship team on Tuesday, Nov. 4,at the Pavilion as the 2014-15 Wildcat host Northwood University in a game to be televised nationally by Fox Sports 1.
Nova Notebook: Bridges' Eyes Have Long Been Locked on Basketball
Mikal Bridges is making the transition from high school standout to college freshman for the Villanova Wildcats.
Nova Notebook: Ochefu Eager to Take Another Step Forward in 2014-15
Daniel Ochefu moved smoothly into the Villanova Wildcats' starting lineup in 2013-14, earning co-Most Improved Player recognition from the BIG EAST. Now, he adds more responsibility as a team leader in his third season at VU.
2014-15 Schedule is Revealed
The 2014-15 Villanova Men's Basketball schedule was announced on Sept. 9 in conjunction with the release of the BIG EAST schedule. The Wildcats, who won 29 games in 2013-14, will make a minimum of 30 regular season appearances on national television.
Funeral Arrangements Set for Legendary Wildcats Coach Jack Kraft
Jack Kraft, who built a .715 winning percentage in 12 seasons as the Wildcats head men's basketball coach, died in New Jersey on Thursday.
"Inside Villanova Basketball" TV Show Nominated for Mid-Atlantic Emmy
"Inside Villanova Basketball with Jay Wright" produced by Wipe Out Productions picked up a Mid-Atlantic Emmy award nomination for its work in 2013-14.
Legends Classic Bracket is Announced
The bracket for the 2014 Legends Classic has been revealed. Villanova will open play at the Pavilion against Maryland Eastern Shore on Nov. 17 before hosting Bucknell on Nov. 20. The Wildcats then meet VCU in Brooklyn on Nov. 24 and either Michigan or Oregon on Nov. 25.


text:
Black Label Geo Print Pant
mouse over photo to zoom click for larger image
Black Label Geo Print Pant
Slim-leg pants split at the cuffs for a modern ankle flare. A chic sensation in the puzzle print with satiny waistband finish.
- Individual style. Clean, modern lines. The exclusive Black Label by Chico's™ collection.
- Our pants sit just below the waist, for a modern fit with maximum comfort.
- Slide clasp-and-zipper closure.
- Welted hand and back pockets.
- 28" inseam.
- 97% cotton, 3% spandex. Unlined.
- Machine wash. Imported.
We're so sorry: this item sold out sooner than expected. For an equally chic substitute, please call our Personal Service Associates at 1.888.855.4986. Or click on Chico's Chat below for immediate assistance.


text:
<ac:macro ac:name="unmigrated-inline-wiki-markup"><ac:plain-text-body><![CDATA[
<ac:macro ac:name="unmigrated-inline-wiki-markup"><ac:plain-text-body><![CDATA[
Zend_Auth provides an API for generalized authentication and includes concrete authentication implementations. Zend_Auth is concerned only with authentication and not authorization. Authentication is loosely defined as determining whether an entity actually is what it purports to be, based on some criteria. Authorization, the process of deciding whether to allow an entity access to, or to perform operations upon, other entities is out of scope with respect to this proposal. It is acknowledged that both authentication and authorization are integral parts of an application that are typically used together. We address authentication and authorization with separate framework components, however, with consideration for maximum flexibility for developers to integrate the concepts in accordance with their varied requirements. For more information about authorization with the Zend Framework, please see Zend_Acl.
Zend Framework: Zend_Auth Component Proposal
Proposed Component Name
Developer Notes
Darby Felton
0.3.1 - 28 November 2006: Updated content post-approval (wiki revision: 21)
Table of Contents
1. Overview
Vote Now for an Authentication Adapter!
In order to get an idea of which concrete authentication adapters are most needed, we have a ballot ready to accept your vote on which authentication adapter you would most like to see included with the framework. Vote Now!
2. References
<ac:macro ac:name="unmigrated-inline-wiki-markup"><ac:plain-text-body><![CDATA[
Zend_Auth provides an API for generalized authentication and includes concrete authentication implementations. Zend_Auth is concerned only with authentication and not authorization. Authentication is loosely defined as determining whether an entity actually is what it purports to be, based on some criteria. Authorization, the process of deciding whether to allow an entity access to, or to perform operations upon, other entities is out of scope with respect to this proposal. It is acknowledged that both authentication and authorization are integral parts of an application that are typically used together. We address authentication and authorization with separate framework components, however, with consideration for maximum flexibility for developers to integrate the concepts in accordance with their varied requirements. For more information about authorization with the Zend Framework, please see Zend_Acl.
Zend_Auth provides an API for generalized authentication and includes concrete authentication implementations.
Zend_Auth is concerned only with authentication and not authorization. Authentication is loosely defined as determining whether an entity actually is what it purports to be, based on some criteria. Authorization, the process of deciding whether to allow an entity access to, or to perform operations upon, other entities is out of scope with respect to this proposal. It is acknowledged that both authentication and authorization are integral parts of an application that are typically used together. We address authentication and authorization with separate framework components, however, with consideration for maximum flexibility for developers to integrate the concepts in accordance with their varied requirements. For more information about authorization with the Zend Framework, please see Zend_Acl.
3. Component Requirements, Constraints, and Acceptance Criteria
- Provide an API to which arbitrary authentication systems can adhere
- Provide common concrete authentication mechanisms
- Encapsulate and make available data obtained during authentication with token interface
- Identity and credentials (e.g., username, e-mail, one-time use keys)
- Date and time
- Other results from authentication back-end
- Facilitate authentication persistence across requests
- This component is only concerned with performing authentication; other operations, including management of authentication back end data stores, are out of scope.
4. Dependencies on Other Framework Components
- Zend_Exception
- Zend_Session (optional, on by default)
5. Theory of Operation
For the purposes of this proposal,
- An identity is a piece of information used to represent the identity of the requester. For example, an authentication scheme might use a username or e-mail address for the purposes of identification, or perhaps the identity is an integer that maps to a database table.
- A credential is a piece of information used to authenticate the requester against the reported identity. For example, a password is often used as a credential in web applications. Similarly, security questions and answers (e.g., What was your first pet's name?) may be used as authentication credentials. In many cases, credentials include identifying information. For example, a fingerprint might be used alone as an authentication credential that indicates identity inherently.
- An authentication token refers to, represents, or encapsulates the results of an authentication attempt. For example, if a user logs in with a username and password, an application might use an object to refer to this authentication attempt, and this object would be an authentication token. An authentication token need not necessarily include the authentication credentials presented by the authentication attempt. The token would very likely contain the authenticated identity, and it may contain other information that is important to the application, such as the date and time of login, the number of failed login attempts, and other information from the authentication back-end.
Operation Details
Since authentication methods vary widely depending on the specific needs of an application, Zend_Auth imposes no particular back end authentication mechanism, though it is intended that it provides a set of concrete authentication adapters for the most common use cases.
We have an abstract class, Zend_Auth_Adapter, from which concrete authentication adapter classes inherit.
Zend_Auth_Adapter defines an authenticate() method that should be overridden by child classes, but this is not enforced by PHP because it is not designated as an abstract method. This, in turn, is because abstract method signatures must match their implemented counterparts (in PHP 5.1.4), and we cannot know what the magic number of parameters would be for an authenticate() method, since actual authentication implementations are expected to vary widely. Thus, we resort to throwing an exception if the authenticate() method is called on an object inheriting from the abstract class that does not override authenticate().
The authenticate() method of authentication adapter classes is intended to return an instance of a class that implements the Zend_Authentication_Token_Interface. Again, we're not enforcing the return type, but this intent is documented in the docblock for Zend_Auth_Adapter::authenticate().
For some authentication backends and in certain circumstances (perhaps even in the most common use case), it may make sense to simply call a single static method upon the adapter class, providing authentication credentials, and returning authentication results as a token. The staticAuthenticate() method of the adapter class would be used when the credentials are known and the application is concerned only with the results of the authentication for a particular request.
Zend_Auth_Digest is included as an example concrete authentication adapter class (credit to Gavin).
6. Milestones / Tasks
- Finish proposal revisions for review, based on feedback and collaboration - DONE
- Arrive on approvable proposal through iterative review and updates - DONE
- Implement approved design with inline API documentation - IN PROGRESS
- Drive development with unit tests
- Write manual documentation
7. Class Index
- Zend_Auth
- Zend_Auth_Exception
- Zend_Auth_Adapter (abstract)
- Zend_Auth_Adapter_Exception
- Zend_Auth_Token_Interface (interface)
Digest authentication Adapter
- Zend_Auth_Digest_Adapter
- Zend_Auth_Digest_Token
- Zend_Auth_Digest_Exception
8. Use Cases
Website Login with E-mail Address and Password
Perhaps the most common use case for web applications is password-based authentication. In order to authenticate with a password, the user purports an identity, in this case, using an e-mail address to which the user has access. The user supplies the e-mail address to establish the identity against which the system challenges the user to authenticate using a password that only the person having access to the e-mail address is supposed to know.
Fallback Authentication with Security Question and Answer
It is often the case that users forget their passwords. Some applications may allow sending an e-mail to the identity that the user claims to be, so that the password may be reset to something the user will hopefully remember in the future. If the user is not who she claims to be, then the person that truly is the purported identity would receive the mailing and would simply opt not to change the password.
Other applications, however, may need to provide an alternative means of authentication, such as a security question and answer. To illustrate, suppose we have a user who forgets her password. If she had entered in her profile a security question and answer, then the application can simply ask the question, and the user would provide the correct answer in order to authenticate successfully.
"What was the name of your first pet," "on what street were you born," and "what was your high school mascot" are all examples of security questions that may be asked by an application. Though it may be important for application security not to let authentication hinge upon questions to which answers may be guessable or discoverable by entities other than the identity holder, these decisions are for application developers to make and are outside of the scope of this proposal.
Securing Sensitive Operations
In certain situations it makes sense to require authentication credentials to be presented, regardless of the presence of an authentication token representing a previously successful authentication attempt.
For example, a user might log into a website with an e-mail address and password. The user clicks around various areas in the website, and her actions are performed with the identity which with she logged in, since an authentication token exists in her session and is recognized by the application. For extra security on sensitive operations, however, the website demands that the user enter her password again before being allowed to perform sensitive operations such as editing her profile or changing her password or e-mail address.
Arbitrary Credentials
In many instances, a simple username and password scheme is sufficiently secure for the purposes of the application. Other applications, however, may require more than a trivial set of credentials in order to consider a requester genuinely authenticated.
Consider the case of an application for credit or a loan, where the applicant must provide a series of information that is checked against existing records. There may be complicated sets of rules that must be fulfilled in order to completely authenticate a person.
An applicant would no doubt be required to provide a set of data that must be correct, such as her social security number (SSN), current address and phone number, and current bank information.
There may be other criteria, however, that provide some flexibility when the user cannot provide certain credentials required for authentication. For example, the applicant may have to answer 3 correct questions about her credit history, though some of the information may not be immediately available to the applicant. In this situation, the applicant may choose which of perhaps 10 questions to answer based on the information she does have at hand.
Credentials that Include the Identity
Authentication is often performed by first purporting an identity and then presenting credentials that are checked against the purported identity. But there are cases where separation of the identity from credentials may not be practical. Biometric and security card scanners are a couple of examples in which the credentials may inherently represent the identity of the requester, and the concepts of identity and credentials are not mutually exclusive.
9. Class Skeletons
Aug 27, 2006

I have been pondering PHP authentication recently. The problem is that there are many different authentication schemes. However they are all essentially validation. So I was thinking – what if we provided a common Authentication "manager" like both Darby and Gavin are showing, but instead of having the factors built into the Authentication class, we pushed them out into classes for each type of Authentication scheme. You really need a pair of classes for the Authentication class to do its job – first is a Credential that contains the factors, and second is an Authorizor that validates the Credential.

I should add the note that for common Authentication schemes like username/password could be encapsulated into a single class to provide a simpler interface over these building block classes.

So for example if you wanted to implement a database username/password scheme you would have a Username/Password Credential (Two Factor) and a Database Username/Password Authorizor. The code might look something like this:

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
$credential = new Zend_Auth_Credential_UsernamePassword($request);
$authorizor = new Zend_Auth_Authorizor_UsernamePassword($db);
$authenticator = new Zend_Authicator($credential, $authorizor);
$result = $authenticator->authenticate()

But you could also do Three Factor with something like the following where a Capcha class generates the third factor and saves/retrieves it from the session. Notice that the Zend_Authicator does not change and provides a common framework for many(any?) authentication schemes.

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
$credential = new Zend_Auth_Credential_UserPassCaptcha($request, $captcha);
$authorizor = new Zend_Auth_Authorizor_UserPassCaptcha($db, $captcha);
$authenticator = new Zend_Authicator($credential, $authorizor);
$result = $authenticator->authenticate()

I think it is interesting that Darby called his class "Authentication", Gavie "Authenticate" and I Authenticator". This shows the subtle differences in how the problem of authentication can be thought of – which is part of the problem in discussing the design of these systems.

Sep 13, 2006

This psuedocode prototype had a couple bugs and combined the ideas of a general-purpose authentication component with a more specialized example that cached intermediate results. I have split the code above into two classes, and added the resulting code to the proposal above under "Alternative Proposal". Note that session validation remains a separate step from user authentication. Session validation is handled by Zend_Session.

Nov 20, 2006

Just for reference, I've posted the old prototype example that demonstrated an extremely simple integratiion of an abstract authentication mechanism with Zend_Session.

Specific adapters for authenticating using LDAP, RDBMS, htdigest, etc. would be created by subclassing Zend_Authenticate or Zend_Authenticate_Cache. The use of and support for "domain" is not needed in many situations.

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
// $identity could be anything from a username to an application specific authentication token object.
abstract class Zend_Authenticate
protected $_config = array(
'domain' => null, # domain to authenticate against - optional, arbitrary (e.g. namespace or LDAP/DB/etc.)
'useCache' => false, # e.g. cache <$username, sha1($password), $domain> using Zend_Cache
'session' => null # optional, an instance of Zend_Session
public function __construct($config = array())
- we could store values directly into properties, but this is only prototype
foreach(array_keys($this->_config) as $key)Unknown macro: { if (isset($config[$key]))Unknown macro: { $this->_config[$key] = $config[$key]; unset($config[$key]); }}
if (is_null($this->_config['session']))Unknown macro: { $this->_config['session'] = new Zend_Session('Zend_Authenticate'); }
if (count($config))Unknown macro: { throw new Zend_Exception('Unkown configuration option(s)}
- Should be overloaded, with subclass first calling the parent's method below.
- Alternatively, this could be simply an abstract method with no implementation:
public function exists($identity, $authenticationData) {}
public function domainExists($domain=null) {}
- attempts to perform an authentication
public function authenticate($identity, $authenticationData = null)Unknown macro: { if (!isset($authenticationData['domain'] === null)Unknown macro: { $domain = $this->_config['domain']; }$this->_config['session']->expire(null); # expire everything in this "namespace" }
elseUnknown macro: { $domain = $authenticationData['domain']; }
- if $password is null, then other information will be used (e.g. $_SERVER['REMOTE_ADDR']
if (($this->authenticator($identity, $authenticationData)))Unknown macro: { $this->authenticated($identity, $authenticationData); return true; }
$this->logAuthenticateFailure($identity, $authenticationData);
return false;
- records a successful authentication
protected function authenticated($identity, $authenticationData)Unknown macro: { $this->_config['session']->IP = $_SERVER['REMOTE_ADDR']; $this->_config['session']->identity = $identity; $this->_config['session']->domain = (isset($authenticationData['domain'] ? $authenticationData['domain']}
- adapter-specific authentication logic, invoked by public wrapper "authenticate()"
- implement in a subclass using DB, LDAP, htdigest, whatever anyone wants
abstract protected function authenticator($identity, $authenticationData);
protected function logAuthenticateFailure($identity, $authenticationData) {}
- delete session authentication information, thus making the session anonymous
public function unauthenticate($identity, $domain=null) {
if ($domain === null)
- transform $identity to convention/case/format expected by backend (e.g. LDAP, MySQL)
- e.g. $username=strtolower(str_replace(' ', '_', trim($identity)));
public function filter($identity)Unknown macro: { return $identity; }
- Example designed to support authenticating against a remote system,
- with a "high" cost, and infrequent changes to authentication data,
- such as a wiki authenticating usernames against an external system.
abstract class Zend_Authenticate_Cache extends Zend_Authenticate
- If using Zend_Cache for a local copy of authenticated <user, password, domain>'s,
- then must call this function, if the user changes their password.
- Should be overloaded, with subclass first calling the parent's method below:
public function cache($identity, $authenticationData) {
if (!isset($authenticationData['domain'] === null)Unknown macro: { $domain = $this->_config['domain']; }
elseUnknown macro: { $domain = $authenticationData['domain']; }
if ($this->_config['useCache'])Unknown macro: { #TODO}
- Should be overloaded, with subclass first calling the parent's method below:
public function exists($identity, $authenticationData) {
if (!isset($authenticationData['domain'] === null)
elseUnknown macro: { $domain = $authenticationData['domain']; }
if ($this->_config['useCache'])Unknown macro: { #look for user in our cache using Zend_Cache #if found return true }
return false;
abstract public function domainExists($domain=null);
public function authenticate($identity, $authenticationData) {
if (!isset($authenticationData['domain'] === null)Unknown macro: { $domain = $this->_config['domain']; }
- Should be overloaded, with subclass first calling the parent's method below:
- if $password is null, then other information will be used (e.g. $_SERVER['REMOTE_ADDR']
if ($this->useCache && $this->authenticateWithCache($identity, $authenticationData))Unknown macro: { $this->authenticated($identity, $authenticationData); return true; }
else if (($this->authenticator($identity, $authenticationData))) {
$this->authenticated($identity, $authenticationData);
if ($this->useCache)Unknown macro: { $this->cache($identity, $authenticationData); }
return true;
$this->logAuthenticateFailure($identity, $authenticationData);
return false;
protected function authenticateWithCache($identity, $authenticationData)Unknown macro: { # TODO}
- we could store values directly into properties, but this is only prototype
Sep 14, 2006

Just to add to the requirements...

It should be possible to attach a key for password-encryption/-verification.

Example:

We store username and password in database. In database the password is encrypted with sha1

In client/browser we encrypt the entered password once with sha1 and additionally with the session_id.

Checking if the user has permission would only give true when the users password is equal to the db-pwd sha'ed with the sessionid.

So it should be possible to attach a encryption key or method to both sides of the verification.

Sep 14, 2006

The use case provides an example authentication class by the application developer called MyAuth. This class contains a login() method, which arbitrarily is specified as requiring a username and password.

In order to support your example, one need only modify the login() method implementation to use encryption verification against the session_id and the database backend as you suggest.

Since Zend_Authentication (I cannot speak for Gavin's alternative approach) supports PHP callbacks in general, you could implement various authentication approaches with a regular function (e.g., function foo()), a method of an object instance (e.g., $obj->foo()), or a static method of a class (e.g., Class::foo()).

Sep 14, 2006

Perhaps better examples:

function authenticate($username, $password)

$authenticator->login($username, $password)

Authentication::login($username, $password)

Sep 18, 2006

I think both of these proposals are a bit too simplistic, in that they maybe require too much of the developer. The whole point of a framework being to support the developer in simplifying tasks. I think an interface structure would be more useful (notice that I helpfully assume a Zend_Ldap class <ac:emoticon ac:name="smile" />):

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
interface Zend_Authentication_Interface
public function authenticate();
class Zend_Authentication_Ldap implements Zend_Authentication_Interface
public function __construct(Zend_Ldap $ldap) {}
public function setDomain($domain) {}
// etc...
public function authenticate($username, $password) {}
class Zend_Authentication_Db implements Zend_Authentication_Interface
public function __construct(Zend_Db $db) {}
// etc...
public function authenticate($username, $password) {}
class Zend_Authentication_Apache implements Zend_Authentication_Interface {}

You could then load an authentication module like this:

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
public function login($username, $password)
$ldap = Zend::registry('ldap');
$auth = new Zend_Authentication('ldap', $ldap);
// etc... (set various options)
if ($auth->authenticate($username, $password))Unknown macro: { return true; }
return false;

Any unusual/custom authentication methods could then be implemented through the interface.

Oct 13, 2006

Implemented methods must match the interface method declaration in PHP, and though I understand the semantics of your example, the above code would result in a fatal error.

Sep 21, 2006

Authentication is any process by which you verify that someone is who they claim they are. This usually involves a username and a password, but can include any other method of demonstrating identity.

Access control hower, is a much more general way of talking about controlling access to a web resource (very abstract). Access can be granted or denied based on a very wide variety of criteria, such as the network address of the client, username, password, the time of day, the phase of the moon, or the browser which the visitor is using.

These techniques are so closely related in most real applications, it is difficult to talk about them separate from one another. However I think that it is a pretty big design decision that has to be made. Do we make a difference between these two, or do we wrap them in one class?

I would like to ask for brainstorm time, where we can openly consider all ideas to help synthesize a final proposal, before further decisions are made.

Sep 21, 2006

Thank you for your astute observations, which I believe succinctly describe the problem model quite well.

Though Zend_Acl, which provides an authorization mechanism or access controls, has been approved for incubator development for good reasons, I also suspect that more research is needed toward defining the framework approach to authentication and authorization. As indicated in this proposal, the initially suggested approach is little more than a wrapper to whatever authentication mechanisms developers wish to employ (or may already be employing).

I look forward to hearing more about what you and others might suggest for a good solution to this pervasive problem.

Sep 21, 2006

I agree with Andries that they are closely related, but I feel that they are still separate problems to be solved. IMO you are asking who (Auth) before what/where (Acl) and the scope of both of these will vary dramatically depending on the application. To allow greater freedom I would still encourage that these processes remain as separate components, but be addressed more clearly in documentation, tutorials and examples to complete the picture for the community.

One of the prime motivators for me to tackle the Acl component in the first place was that I could find no 'simple' implementation of an Acl manager that didn't also require me to install an overly-elaborate SQL storage container and a custom-written ACL admin screen by which to administer it. This didn't suit me - it wasn't plug'n'play and it limited my ability to customise the administration without breaking future support. For these reasons, too, I could see that if Auth and Acl were too closely related they may introduce dependencies that could otherwise be avoided.

There's a lot of scope for Zend_Acl to be improved and for how it is implemented. You may end up having 5 completely unrelated Acl's - one for access management to a site, one for authoring permissions, one for specific forum permissions, etc... It would not be practical, however, to have 5 authentication instances.

I can see areas of similarity - I.P. access for one. I don't believe Zend_Acl is well equipped to deal with this at the moment, and I have had a brief discussion with a community member who believes extra callbacks can be added to Zend_Acl to handle 'plugin'like behaviour, providing further checks like:

IP/Hostname access to the whole Acl or only defined areas

Time of day (as you mention above)

Status of site services

Mny others, I'm sure!

I, too, look forward to hearing how others look to solve their own access requirements using Auth/Acl to see where we can make improvements on the current implementation.

Oct 13, 2006

Indeed, though authentication and authorization are related, we have opted to strive for as little coupling as possible between authentication and authorization framework components to allow for greatest flexibility.

As we finalize an authentication component design (Zend_Acl is already usable), we can show sample ways in which the two may be used together.

Sep 22, 2006

I think we also need to look at Access Control and Authentication from the practical point of view of where the code are used from within the framework. Access Control authorization code is often called on every request (or group of requests), so performance is important. Access Control needs to efficiently check to see if access is allowed.

If access is denied then there needs to be some scheme to then call some sort of Authentication code. This could be as simple as a redirect to a login page. Or it could be a cookie based Remember Me scheme. Or it could be as complex as defining points of priviledge escalation as requiring re-authentication under various criteria.

The Authentication system also needs to be able to deal with multiple factors that can be related or not, and that have different data sourcse. An example is login with captcha where the username/password datasource is a database, LDAP, etc., but the capcha is generated on the fly and the datasource is the session.

Finally there is often an Audit capablity to these system. Again, this can be as simple as timestamping the last login date, to complex tracking of what the user did.

Sep 23, 2006

I think Zend_Acl and Zend_Authentication should be separate classes. They are related, but they each address different areas. One could use Acl without Authentication (IP-based access control, for example).

As for efficient access control, I think Zend_Acl should build on Zend_Bitfield when it's completed, and that's why I think Zend_Bitfield should have a non-static interface. That way, one could store groups of Bitfield objects in an array in Acl. That would be a very flexible, fast access control model.

CAPTCHAs should be handled separately. They could extend Zend_Authentication_Db (referring to my idea above), redefine the constructor, and add a CAPTCHA validation method--a total of two new methods. Alternately, it might be easier to just perform the extra check in the login action, prior to calling authenticate(). I do think there's value in a Zend_Captcha class on its own (dependent on Zend_Session), but it would have to have an extensible interface design and not be limited to strictly visual CAPTCHAs.

If a table update for last login is necessary, it should also be handled separately. Time spent generalizing code like that would, I feel, be better spent elsewhere, since someone might not just want to update login times but also this other table, that other column, etc., and they could probably do it more quickly with their own specific query than figuring out the class's interface. In a similar vein, I think user tracking should be handled through a custom controller plugin (in the current MVC model). That's what I do in one of my production ZF applications.

In general, I think it would be best to stay away from adding in all kinds of periphereal functionality to the class--it will result in an unfocused class with a difficult-to-use API that tries to be all things to all people, in contrast to the clarity of Zend's 80/20 guideline for the framework.

Sep 24, 2006

This discussion probably belongs in the Zend_Acl proposal, but why do you suggest that Zend_Acl is built on top of Zend_Bitfield? Isn't the fact that a Bitfield by definition can only support a limited amount of ACOs?

Sep 25, 2006

Each instance of Zend_Bitfield (stored in an internal Zend_Acl array) would be a user type, defined using methods: administrator, moderator, etc. Each would have a list of access rights, stored as bits. The bits would be defined in Zend_Acl and then added to each user type so that the bits are universal. You would check access requirement(s) against user type(s) to determine access.

So, you're right, it would be limited to 64 types of access, but I think that would be more than sufficient to satisfy the 80/20 guideline. It would also be very simple to understand.

Sep 24, 2006

I think bitfield is just a type of system like ACL is a system. We could also have an ultra-simple Level based system that just checks to see if a prescribed value is greater than or equal to a given access level. That would be helpful for many simple sites and very fast. You can also store delimited strings which work the same as bitfields but don't necessarily have size limits and are self documenting rather than requiring a lookup table for the bit values. There are many options. I think the important thing is that they all sit upon the same base. That's why I proposed a looser Authentication and Access Control managers above.

Oct 11, 2006

I have also given this problem some thought and in thinking thought it best to further describe the actual problem model here in one post (rehashing other comments), then perhaps some pseudo code in another tomorrow.

The problem is one of Application Security, most specifically Access Control

This can further be broken down into 3 logically related yet distinct sub parts: Authentication, Authorization, and Audit.

1. Authentication is simply a process by which when given an Identity (in any number of forms) and a set (0 or more) of Credentials a system can determine that someone is who they claim they are. A typical example of an Authentication Scheme is a username and password stored in a database, but can include any other methods of demonstrating identity (fingerprints, smart card) or other methods of supplying credentials (fingerprint, rolling code, spoken password, etc.)

In terms of ZF

No state information is saved across requests, authentication is simply a process that answers a question "Is this person authentic?"

Hooks should be implemented to allow the developer to use either a stock authentication scheme, or write their own scheme.. These schemes should conform to an interface defined by Zend_Authenticate

2. Authorization is the process of finding out if a person, once identified, is permitted to have a given resource. Authorization, like authentication, can have a wide variety of implementations. Some might choose to deploy an authentication scheme based around an Access Control List, while others might decide to deploy a scheme based around capability (perhaps by principal of least authority).

In terms of ZF

Zend_Authorization is stateful.. Which means it has a dependence on Zend_Session so that across page requests, previous authorization information can be retained.

Currently, Zend_ACL has been approved and should be underway.. there should be some integration with Zend_Authorization and Zend_Session here.

3. Audit trail is a chronological sequence of audit records, each of which contains evidence directly pertaining to and resulting from the execution of a business process or system function. Typically a log would include the identity (someone who was authenticated) attempting executing a specific task which they were (or were'nt) authorized to do.

In Terms of ZF

ACL and/or Capability auth schemes should be implemented in such a way that if a developer wants to log (perhaps a dependence on Zend_Log) a specific threshold of ACL/Capability checks, the system can do such.

More on this later.

I propose one of the following namespaces to contain this barrage of classes:

Zend_AccessControl_Authentication

Zend_AccessControl_Authorization

Zend_AccessControl_Authorization_ACL

Zend_AccessControl_Audit or Zend_AccessControl_Authorization_Audit

or by removing the AccessControl umbrella:

Zend_Authentication

Zend_Authorization

Zend_Authorization_ACL

Zend_Audit or Zend_Authorization_Audit

all these ideas float around the net in one place or another, a good staring place is wikipedia, followed by some apache docs.

Oct 11, 2006

Pseudo Code supporting interface idea

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
– ./controllers/loginController.php
tryUnknown macro: { Zend}
catch (Zend_Authentication_Exception $e)
echo $e->getMessage();
– ./lib/RS/Authenticator.php - users custom authentication routine
class RS_Authenticator extends(implmements) Zend_Authentication_AuthenticatorInterface
// user defined
public function processAuthentication()
tryUnknown macro: { $user = new User(array('username' => $this->getIdentity())); }
catch (Model_Exception $e)Unknown macro: { // user doesnt exist if the model returned an exception throw new Zend_Authentication_Exception("Username / Password incorrect"); }
$this->_auth_instance->setValidCredential('username', $username);
$this->_auth_instance->setValidCredential('password', $user->getPassword());
– ./Zend/Authentication.php
class Zend_Authentication
protected $_authenticator = null;
public function __construct($auth_class)Unknown macro: { $this->_authenticator = new $auth_class; if ($this->_authenticator instanceof Zend_Authentication_AuthenticatorInterface) throw new Zend_Authentication_Exception( ... ); }
public function setIdentity(mixed $thing)Unknown macro: { ... }
public function getIdentity()
public function setCredential($name, $value)Unknown macro: { ... }
public function getCredential($name)
public function setValidCredential($name, $value)Unknown macro: { ... }
public function authenticate()Unknown macro: { $this->_authenticator->processAuthentication(); /** * At this point we check to make sure all required credentials * have been passed, and that their value matches what the user * has provided as a "valid" credential. * */ }
– ./Zend/Authenitcation/AuthenticatorInterface.php
class Zend_Authentication_AuthenticatorInterface
public $_authentication_instance = null
public function __construct($zend_auth_instance)Unknown macro: { $this->_auth_instance = $zend_auth_instance; }
Oct 13, 2006

In this example we have:

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
$auth = new Zend_Authentication('RS_Authenticator');

By examination I see that this would create a new instance of Zend_Authentication, passing 'RS_Authenticator' to Zend_Authentication::__construct(). Indeed, the constructor accepts the string and creates an instance of RS_Authenticator:

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
// in Zend_Authentication::__construct()
$this->_authenticator = new $auth_class;

Note that this instantiation does not pass any parameters to the RS_Authenticator constructor. But because RS_Authenticator extends Zend_Authentication_AuthenticatorInterface, which is not actually an interface but a class, and Zend_Authentication_AuthenticatorInterface::__construct() has a required parameter, we result in fatal error.

What purposes is Zend_Authentication_AuthenticatorInterface supposed to serve? I thought Zend_Authentication was long enough to type! <ac:emoticon ac:name="wink" />

I think we would be well served by additional illustration of:

what setIdentity() would do

how setCredential() and setValidCredential() would work, what their purposes are

how identities and credentials are validated against an authentication backend or data store

Zend_Authentication::authenticate() calls $this->_authenticator->processAuthentication(), thereby imposing that classes passed to this constructor implement this method. This is where the idea of the interface makes some sense.

These things said, I like this approach in that it separates the authentication identity from the authentication credentials. I know you intended this to be pseudocode and probably put it together rather quickly. I would be interested to see another version of this with additional code commenting and a working example use (e.g., against an authentication backend, even if just a PHP array) attached to this proposal (rather than adding much more code to the already long list of comments).

Oct 16, 2006

Darby,

Yes, that would produce a fatal error, .. really there would be no constructor in the abstract.. the only coded out method would be registerAuthenitication(), this would give the Authenticator access to the identity and credentials that were passed to Zend_Authenticate.

I have a working class right now, let me get this to you for review so you can see how this all would play out.

Notes:

Zend_Authentication should take either a string of the class name or an instance of the class that extended Zend_Authentication_Authenticator. This allows for maximum flexiblity

Also, its worth noting that concrete stock authenticators should be included with Zend_Authenticate.. for example authenticate off passwd format, based off htpasswd file, or even based off a php array.

more later,

Nov 16, 2006

Some notes:

Auth ctor could take full adapter object, then we can use code completion when writing 'new My_Auth_Adapter(params)'. If we use factory, code completion won't work.

I think the should be no distinction between identity and credentials when calling authentication adapter, and I think we can just pass opaque array there, and let the user and the adapter know what exactly means what there. Credentials may even not include identity, but identity would be derived from it - e.g. you can login with multiple credentials (e.g. imagine site where you can login with username, email or internal ID or phone number or SSN) but you would always have same ID - which can be some internal database key, for instance.

I don't think we need an interface for authenticate() parameter, only array.

Zend_Auth_Token_Interface - we need to provide example tokens. I propose:

Simple username token - i.e. something storing just username

Expiring username token (one can set expiration on ctor - adapter could do it) which maybe also keeps additional info

For authenticator main class, I see we need following public functions:

ctor of course

check if we already have valid auth token

check auth data and create token (using concrete token & backend classes)

erase auth state (logout)

set session parameters (or replace session handler with another class?)

Static auth method looks like a good idea to me.

Nov 20, 2006
<ac:macro ac:name="note"><ac:parameter ac:name="title">Zend Comments</ac:parameter><ac:rich-text-body>

This proposal has been reviewed by the Zend Framework Core Team, and approved for the Incubator.

We would like to make the following comments and suggestions:

Provide example classes that implements the token interface

Simple username token - i.e. something storing just username

Expiring username token (one can set expiration on ctor - adapter

could do it) which maybe also keeps additional info

Zend_Auth::__construct() accepts concrete adapter object

Zend_Auth provides access to adapter object as needed

Zend_Auth provides session persistence capabilities (on by default)

Authentication against adapters is in scope, but robust management of

authentication adapter back-ends is out of scope with respect to

Nov 21, 2006

I have taken a shot at implementing Zend_Auth starting from the class skeletons in the proposal However, on the way, I have done some things differently.

I believe that Zend_Auth_Token should act as a container for Zend_Auth_Identity and Zend_Auth_Credentials. The token is valid if the Identity claimed matches the presented credentials.

This is the flow of the auth process as I see it:

1. Initialisation

a. A Zend_Auth object is instantiated for the authentication method required (LDAP, DB Table, Unix .passwd file). A factory is used, with the params for the specified auth method passwd as array

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
require_once 'Zend/Auth.php'; class UsersTable extends Zend_Db_Table { protected function _setup()Unknown macro: { $this->_name = 'users'; $this->_primary = 'user_id'; parent}
} $users_table = new UsersTable(); $dbtable_params = array( 'dbtable' => $users_table, 'username_column' => 'user_email', 'password_column' => 'user_pass', 'hash_function' => 'md5', ); $dbtable_auth = Zend_Auth::factory( 'dbtable', $dbtable_params ); Zend::register('auth', $dbtable_auth);

B. Authentication (presenting Identity and/or Credentials)

a. Retrieve identity and/or credentials from user (html login form, biometric reader API, etc.)

b. Create a token that contains them

c. Authenticate the token, using Zend_Auth::authenticate( ). If the token is valid, mark it as such

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
function VerifyLogin( $user_email, $user_pass )Unknown macro: { $sess= Zend}

C. Page/resource request

a. A Zend_Token is retrieved from storage (maybe Zend_Session), if one is present

b. Try to validate the token we have. This may or may not use the underlying validation system (i.e. use caching; we don't want to access LDAP every page refresh, but only once, at login)

c. If the token is valid, check the enclosed identity against the Zend_Acl to determine whether the user has access to the requested page/resource

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
$auth = Zend::registry('auth'); $sess = Zend::registry('sess'); if (!STATIC_AUTH) $sess->token = $auth->authenticate($sess->token); if ($token->isValid())Unknown macro: { //do smth }
Nov 24, 2006

On the basis an implementation might of some limited use... I needed to add a simple authentication system to an application. Since I was using the ZF, I grabbed the class skeletons from the proposal and implemented one. The namespace differs, but any Exception/Abstract classes or Interfaces are exactly as noted in the proposal body.

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
class Astrum_Auth_Adapter_Simple extends Zend_Auth_Adapter
public function authenticate(Quantum_Db_Row $credentials, Quantum_Db_Row $user, Zend_Session $session)
$user->name = $credentials->name;
$result = $user->getRow();
if($result === false)Unknown macro: { $token = new Astrum_Auth_Token_Simple; $token->setIdentity( array('user'=>$user, 'valid'=>0, 'message'=>'Username does not exist') ); return $token; }
if($credentials->password !== $user->password)Unknown macro: { $token = new Astrum_Auth_Token_Simple; $token->setIdentity( array('user'=>$user, 'valid'=>0, 'message'=>'Password for this Username incorrect') ); return $token; }
- User details and password have been verified.
$session->authenticated = 1;
- Return token for validation
$token = new Astrum_Auth_Token_Simple;
array('user'=>$user, 'valid'=>1, 'message'=>'')
return $token;
class Astrum_Auth_Token_Simple implements Zend_Auth_Token_Interface
protected $identity = array();
public function isValid()
if(!isset($this->identity['valid']) || empty($this->identity['valid']))Unknown macro: { return false; }
return true;
public function getMessage()Unknown macro: { return $this->identity['message']; }
public function getIdentity()Unknown macro: { return $this->identity['user']; }
public function setIdentity($identity)Unknown macro: { $this->identity = $identity; }
public function __toString()

Usage was a simple matter:

<ac:macro ac:name="code"><ac:plain-text-body><![CDATA[
// LoginController
$credentials = new Astrum_User;
$credentials->name = $this->_post->getRaw('astrum_form_login_user');
$credentials->password = sha1($this->_post->getRaw('astrum_form_login_pass'));
$authenticator = new Astrum_Auth_Adapter_Simple;
$token = $authenticator->authenticate($credentials, new Astrum_User, $this->_session);
'' . $token->getMessage() . ''
$this->_forward('index', 'index');
$user = $token->getIdentity(); //we have an authenticated user

A few of the stickly points is passing in the Session object as an extra parameter - would be nice if this could be set elsewhere, or accessed from within the object. I completely agree with the design implementation-unaware and leaving scope for varying parameters.

Look forward to the incubator version...

- User details and password have been verified.
Nov 27, 2006

Updated attachment link for Sorin, original post by Sorin Alin Stoiana at Nov 24, 2006 10:05:

In reply to a mail from Stanislav Malyshev on the Zend_Auth mailing list about the classes I submitted (see attachment <ac:link><ri:attachment ri:filename="Sorin_Alin_Stoiana.zip" /></ac:link>):

I do not see why we need identity class. We can't possibly know what each app considers to be identity and we don't provide any services with this class.

Same for credentials class - I don't see which services we can provide, since we don't know anything about what credentials application could use. Thus, I propose to have both as values opaque for base classes and known only to implementations.

The Identity and Credentials classes are simple containers for data. The token acts as a container for the two. You will see that the way i planned the Dbtable adapter for example, that the Auth class is configurable to read whatever data is necesary from the table, so the app writer doesn't need to modifiy the Dbtable class in any way for a simple "login from db" scenario. On the other hand, if the app needs to load more complex data about the Identity used to login (say, for example, First Name, Last Name, Website, an array of prefferences data, etc), the Identity object is the ideal place to do so. Same for the credentials.

Another possible scenario is one where part of the user base is located in a db table another part in a ldap directory. Authentication then needs to be done against both Dbtable and Ldap adapters. In such a case, both adapters would be configured to use the 'user_email" detail from the Identity object and the 'user_password' from the Credentials object.

The Token object could be stored in Zend_Session, and Zend_Token::isValid could be used to quickly check if the token is valid, without going through the auth adapter layer to do so (think about checking hundreds or even thousands of tokens per second against Ldap).

This implementation proposes to pass token to the concrete auth class.

I think it is not good since concrete token class might be implementation dependent and creating it by authenticator client would mean that it should know details about currently used authenticator adapter and concrete token it needs to use. My opinion that it would be unnecessary abstraction breach.

The Token object is, as i've said, a container for the Identity and Credentials, but also states wether the combination is valid (authentic). It's a general class. The only place where configuration takes place in my proposal is when the auth adapter is instantiated.

Changing the auth adapter for a whole app would then imply simply changing the adapter and it's parameters. Those parameters state what details the adapter uses from the identity and the credentials, and how it interfaces with the back end (db tablename hash functions, passwd file name, ldap directory, etc). This is why I opted for this implementation.

I am open to suggestions about this.

Nov 28, 2006

The Identity and Credentials classes are simple containers for data. The token acts as a container for the two.

I think this is not right - token does not have to contain credentials, actually it may be even a security risk to keep credentials around for time much longer than we need them for verification of the identity. The token to the client is a sign that the identity X is verified by the system and currently logged in - or alternatively (for invalid token) that login did not work for so and so reason. No credentials are needed for that.

Also, token does not have to be simple container - it may contain function. For example, expiring tokens.

Now about the classes. There is a point in creating base classes for that when we can define some structure (interface) or supply some base function (base class) or both (abstract base class). However we know nothing of the nature of the concrete classes, thus base classes would necessarily be empty - so why we need them at all? And - what if I do not want my identity to be an object (majority of apps would use DB key as identity which would be either string or a number)?

 The only place where configuration takes place in my proposal is when the auth adapter is instantiated.

I must be missing something - your implementation requires authenticate() to receive token. Who is to create the concrete token for passing to the authenticate() in that setup?

Nov 28, 2006

I refer to the following section:

Zend_Auth_Digest_Exception

I would say the namespace is incorrect. It should be Zend_Auth_Adapter_Digest, Zend_Auth_Adapter_Digest_Token and Zend_Auth_Adapter_Digest_Exception to be compliant with Zend_Log_Adapter etc. pp.

Nov 28, 2006

I agree that it may be inconsistent with other components, but I think it's nice to bundle the classes for a given authentication adapter in their own respective directories. What would we gain other than consistency by doing as you suggest? I see it as a disadvantage to have files for a single adapter scattered throughout sibling directories.

Nov 28, 2006

On second thought, I think you're right - the specific way you suggest is better than I had originally interpreted it to mean. But it does add some typing...

Nov 30, 2006

It may add a bit of additional typing, but with all those IDEs with autocompletion make the issue irrelevant. On the other hand consistency is just that, consistency - you don't have to think what the class's full name is, you just intuitively know that by remembering the common naming scheme.

I'm saying hi as I'm new to this community and am actually interested in the ATN and ATZ components for ZF so if there's any additional help needed, I'd love to be able provide it. <ac:emoticon ac:name="smile" />

Jan 23, 2007

Proposed Design Improvements

Below is a list I have compiled based on my conversations with <ac:link><ri:user ri:username="ralph" /></ac:link> and the proof-of-concept code he has provided. Many details have been omitted for brevity, and this summary highlights some potentially important design decisions that we can consider for Zend_Auth.

Access SVN versions of Ralph's:

Modified Zend_Auth source

Usage examples

Implement Singleton Pattern

If we restrict Zend_Auth to providing for authenticating HTTP requests to the application, then we need only one instance of the authentication object per PHP execution space. It is best for the component design that Zend_Auth focus on supporting the generalized use case of authenticating the HTTP request against the web application. All things considered, Zend_Auth is a good candidate for implementing the Singleton pattern, since only one instance is needed per request. Of course, the one instance could bind to any of various authentication adapters included with Zend_Auth or to a custom adapter written by the user.

Storage Integration and Zend_Session

In the current Zend_Auth design, authentication tokens are stored in the PHP session by default using Zend_Session. If this behavior is not desired (e.g., a user wishes to store the authentication token elsewhere or using a different approach than Zend_Session), then the user must disable session storage of authentication tokens explicitly by providing false as the value for the useSession option.

Authentication token storage is not otherwise addressed by the current design. If we have a storage interface for the authentication tokens, then various storage mechanisms could be developed by users, and some might even make their way into the framework. Zend_Auth could then be storage agnostic. This is a bit of an implementation detail and would not need to be known by many users, but those who would store authentication tokens other than via Zend_Session would certainly benefit from abstracting the storage mechanism.

Identity Revisited

In the current implementation of Zend_Auth, the concept of identity is specific to the adapter type. The identity is returned by Zend_Auth_Token_Interface::getIdentity(), and the types of data returned are expected to vary, depending on the authentication adapter used. For example, Zend_Auth_Digest_Token returns an array comprised of both the realm and the username used during authentication.

Of course, in the context of an application, the identity may be expressed differently. For example, assume that Zend_Auth_Digest_Adapter is used to authenticate the user. Further assume that a database table will be used to hold extended profile information for each user. The table has a foreign key that is matched to the realm and username of an authenticated request, and its primary key is a positive integer incremented for each record in the table. In the context of the authentication adapter, the username and realm comprise the identity. In the context of the application, however, the primary key of the user profile information table might be used for identifying the user, where a value of zero could represent an unauthenticated user. It is currently the responsibility of the application developer to implement identities in the application context that differ from what the authentication adapter already provides as identity information.

The concept of identity, however, may be represented by a class. The proposed Zend_Auth_Identity class seems to provide little apparent value, though I am likely overlooking some possible reasons for providing this in the framework.

Credentials Revisited and Arbitrary Authentication Conditions

In general, users may require the ability to authenticate under arbitrary conditions. For example, assume that a user is only allowed to authenticate between the hours of 8:00am and 5:00pm. An authentication attempt must be denied if it were to occur at 1:23am. As another example, it is known that a particular user is only allowed to login from a particular workstation having a static IP address. An authentication attempt must be denied if it occurs from a different IP address. Zend_Auth does not currently support such arbitrary conditions to be plugged into its authentication mechanism. By providing a proper API for credentials, users should be able to supply such common business rules to the authenticator in a simple and concise manner.

Change isLoggedIn() to hasIdentity()

In keeping with the idea that Zend_Auth is used to authenticate, or identify, the requester, the name of the isLoggedIn() method is suggested to change to hasIdentity(), which may be more clear. If a requester has not been identified through authentication, then hasIdentity() returns false. Only if a requester has successfully authenticated would hasIdentity() return true.

Authentication Failure Messages

Because a single authentication attempt may possibly result in multiple reasons why the attempt failed, the authentication attempt should make available these messages. In the context of the current Zend_Auth_Token_Interface, the getMessage() method could be changed to getMessages(), where the method returns an array of string messages that explain why the authentication failed. For example, an authentication attempt may result in an array of messages such as "user may only log in between 8:00am and 5:00pm" and "user may not log in from 10.0.0.1". This change would support receiving failure messages from validator chains, as from Zend_Validate, currently in the incubator.

Integration with Controllers

<ac:link><ri:user ri:username="gearhead" /></ac:link> is reportedly working on an adapter that would implement RFC 2617 - HTTP Authentication: Basic and Digest Access Authentication. In order to provide for complete support for these authentication protocols, the adapter must be capable of generating and processing the related HTTP headers.

If an authentication adapter is generating and processing HTTP headers, then we must consider the consequent implications. For example, HTTP headers cannot be generated from PHP if output has already started unless output buffering is enabled.

Because the use of HTTP headers may be related to framework Request and Response objects, we should continue to think about and discuss how we might achieve integration with the controllers to provide a smooth experience for framework consumers.

Jan 23, 2007

isAuthenticated() would probably be more clear than hasIdentity().

About credentials, I'm unclear how restricting to certain time periods or IPs (or whatever) would be handled in the API.

Jan 23, 2007

By changing hasIdentity() to isAuthenticated() you are implying that an identity can exist within Zend_Auth that has not been authenticated. Essentially, the only way to have an identity attached to the Zend_Auth object would be to have it put there (hence hasIdentity()) by a Zend_Auth_Adapter...

I am interested to hear your thoughts if you are willing to go over the proof of concept and usage examples as to the Zend_Auth frame of mind that it presents.

As for the credentials, I imagine that for something like that usage case, a developer would either start anew with Zend_Auth_Adapter_Abstract or extend an existing adapter. It would then perhaps import rules from somewhere, then set them as the expected value of a credential. After the authenticator prepares itself, it would then check to make sure those credentials have been satisfied (by time of day).

The overall idea here is that adapters deal with identities and credentials, and concrete adapters implement concepts such as setPassword() or setUsername() as they are adapters specific concepts.

Zend_Auth will provide basic adapters to guide users in creating the concrete api they so desire, or these adapters will serve as a jumping off point into writing their own adapter.

Jan 24, 2007

I think " restricting to certain time periods or IP " should be done by Zend_Acl. For some situations, Zend_auth and Zend_Acl should work together.

I am also wondering why Darby put it into Zend_Auth which Zend_Acl has already implemented.

---------------------------------------------------------------------------------------------

To Ralph,

I agree with Matthew that isAuthenticated() is better than hasIdentity() because Zend_Auth is supposed to implement identity authentication. Let's compare them as follow:

isAuthenticated() implies "Is it authenticated ?", that exactly what Zend_Auth needs to answer;

hasIdentity() sounds like "Does it have identity ?", it could be always ture no matter it is authenticated or not.

Jan 24, 2007

In Zend_Acl, assertion classes may be used to indicate that an "allow" or "deny" rule only applies if the assertion attached to it returns true. For example, access to the "conference room" may only be allowed between the hours of 8:00am and 5:00pm. This is not necessarily related to authentication, however, since I've said nothing about whether an accessor must be authenticated. Perhaps even unauthenticated users can access the "conference room," but only during the allowed hours.

In Zend_Auth, it may be useful to enable developers to apply arbitrary conditions (or credentials) to authentication adapters. A credential, as we're using the term here, is some condition on which successful authentication is dependent. For example, the password supplied must match the password on file for the purported identity.

Assume that Johnny is uses our framework-powered application, and further assume that Johnny only logs in from his workstation each day, which has a static IP address. Finally, if someone attempts to authenticate as Johnny from a different IP address, we should consider this a fraudulent authentication attempt, since we know that Johnny doesn't any other workstation. How else would you nicely support this use case, except by providing the ability through the authentication component API?

Jan 24, 2007

Thanks Darby,

I see what you mean.Then I'd like to implement Arbitrary Conditions Authentication(ACA for short) in Zend_Acl and call them from Zend_Auth. Otherwise, there are would be a lot of redundant code because the behavior of ACA is way similar with the rule in Zend_Acl.

For your last question, there were actually two tasks:

1 Identify Johnny with usename and password ( or whatever is equivalent to password)

2 Access control (or ACA as you mentioned)

If there is no ACA in Zend_Auth, the developer will combine 1 & 2 above into loginAction(); if there are is an ACA with Zend_Auth, the developer will probably only instantiate Zend_Auth in the loginAction().

Anyway, I can accept either one of them.

Jan 24, 2007

I agree that from a very high-level perspective, isAuthenticated() makes more sense and would perform the same function as hasIdentity(), currently named isLoggedIn().

In my mind, the main reason that hasIdentity() would make sense over other choices is because getIdentity() is already in use at the token level to provide the identity when it exists. In this way, the two method names illustrate their relation to each other.

Sorry I failed to mention this bit in the comment, and I don't know if this is enough to change your opinion on the matter, but I thought to make this point in any case, since I noticed that I hadn't before.


text:
Napping man run over by combine
Published On: Nov 09 2012 10:07:38 AM EST
Updated On: Nov 11 2012 09:28:00 AM EST
Updated On: Nov 11 2012 09:28:00 AM EST
A man napping in a cornfield in Montana got quite the rude awakening when he was run over by a combine.
The 57-year-old man had been traveling the country by bus and decided to take a rest three rows deep in a field on the outskirts of Billings, sheriff's Lt. Kent O'Donnell told The Associated Press.
The farmer turned off his combine while harvesting the field Wednesday when he felt it hit something.
He heard screaming when he opened the door and called 911, the AP reported.
The man, whose clothes were sucked up into the machine, suffered cuts that required stitches and may need skin grafts but is "incredibly lucky," O'Donnell said.
Distributed by Internet Broadcasting. This material may not be published, broadcast, rewritten or redistributed.
The views expressed are not those of clickorlando.com, WKMG or its affiliated companies. This is a community moderated forum (Please note the 'Flag' button). By posting your comments you agree to accept our Terms Of serviceblog comments powered by Disqus


text:
The Mnemonist of Dutchess County star Aaron Costa Ganis suits up to chat about Josh Koenigsberg's funny and touching new play, audience participation, memory tricks and more!
Disney's Newsies is hawking papers across the country, and we've got a sneak peek at those dancing newsboys in action! Click below to get a first look at the national tour of this inspiring tale!November 20, 2014
The nekkid guys come back to the New York stage.April 5, 2012
Lindsay Mendez is one of our most-clicked stars of 2013! Watch her look back on the year that was.December 23, 2013
The Lion King Character Study series kicks off with Patrick R. Brown. Watch how he describes Scar's evil actions, and how his costume and makeup design work to make Scar sharp and unlovable.November 8, 2012
See scenes from the new Broadway musical version of the beloved holiday movie Elf.November 12, 2010
Take a video sneak peek at Broadway hot ticket This Is Our Youth, starring Michael Cera, Kieran Culkin and Tavi Gevinson, at the Cort Theatre.September 11, 2014
Bradley Cooper, Patricia Clarkson, Alessandro Nivola and more on bringing the popular play The Elephant Man back to Broadway.October 21, 2014
In Brynn O'Malley's first vlog episode, she interviews her Honeymoon in Vegas co-stars about their weird love stories and gives us a taste of what performing at a press preview is like.October 30, 2014
Ashley Brown, the leading lady of Broadway's Mary Poppins, answers her Ask a Star questions, submitted by Broadway.com readers.September 17, 2008
Learn how to do the rip-roaring Newsies paper dance on Broadway Balances America.November 2, 2014
The Rockettes are kicking off the holiday season in style! See the leggy ladies rehearse a brand new musical number for the legendary Radio City Christmas Spectacular.October 10, 2013
On this week's episode, If/Then's James Snyder sings karaoke, fixes a few things backstage and he runs into Paul Wontorek and the Broadway.com video department. What are the chances?October 27, 2014


text:
DrObvious wrote:I would say talk to the group OOC. Bring up your concern, and see if it is a problem for them. Hopefully you can have an adult conversation with your group.
palehorse wrote:Oh, and you can have some great squirming-in-their-seat moments when they're split up too...
"You hear a gunshot! Someone screams! A woman runs by howling at the top of her lungs, 'It's here! God save us, its here!'...
Meanwhile on the other side of town, you guys were hacking into Crime King's computer, yes?"
They HATE it when I do that, but in a good way.
mxyzplk wrote:3) Let the other PCs play the bad guys. This works very well and will provide the split group more of a challenge than they are generally prepared for - even a group of gun-toting bank robbers becomes a significant threat if there's a player's mind behind them.
That is true. This is not D&D. The Superheroes shupoldn't feel that the wholed is "too dangerous" to walk around on their own.mxyzplk wrote:In my M&M game, the PCs are part of a "team" but they still split up a great deal - and frankly, that's extremely genre appropriate. In how many X-Men or Avengers comics does the whole grotty group of them go everywhere and do the same thing at the same time?
mgg wrote:That sounds just like how it runs in cyberpunk novels.
I have played in a fantasy/politics game that worked something like that, except the characters never came together in the first place, and the campaign ended before the game came to an end. I don't really know how the GM managed it, but it was a lot of fun.
It has much less appeal to me in a superhero game, though. I like the idea of a superhero team. Of course it is easier to create city threatening or world threatening events to bring superheroes together, at least temporarily.
Well, I think that's . The world shouldn't be this safe.mgg wrote:It is one thing if a groups splits up from time to time to take care of personal business or during an investigation, it is another thing entirely if a group of characters take off in different directions right from the get go and never become a group at all.
Strand0 wrote:
Return to Mutants & Masterminds Archives
Users browsing this forum: Google [Bot], Yahoo [Bot] and 1 guest


text:
Thursday, November 21 @ 10amWe offer group and one-on-one instruction on computers, whether you need to learn the basics or need help with something specific. Call 827-6970 to enroll in a class or schedule an appointment.
Thursday, November 21 @ 10amIn the 1940's, stories presented from the police perspective were gritty and realistic. Inevitably, crime fiction made the transition to television. Pulitzer Prize winner Sidney Kingsley wrote the Broadway Play Detective Story, considered a benchmark in the development of the genre. Hillary Waugh, John Creasy, and Ed McBain, considered the most successful of the early police procedurals authors, virtually define the form.
Thursday, November 21 @ 1pmWould you like to learn to knit or crochet, or are you stuck on a project and need some help? Whether you are a beginner or more advanced, join us.
Thursday, November 21 @ 6:45pm
"Marriage can be a real killer." New York Times bestselling author, Gillian Flynn, takes that statement to its darkest place in this unputdownable masterpiece about a marriage gone terribly, terribly wrong. New members are always welcome.


text:
Jenson Button says he is "massively, massively motivated" for the season ahead, his first as McLaren's unofficial lead driver...
Q: The last time we saw you was atop the podium in Sao Paulo, what have you been doing over the winter?
JB: "Yeah, winning at Sao Paulo was a really fantastic way to bring the curtain down on the season. It was such a demanding race - the conditions were always changing and you could never relax - and it was great to bring a great era of Vodafone McLaren Mercedes to a really satisfying end. Now I'm busy preparing for the start of a new one.
"It's been a fairly typical winter for me: lots of training, but in a relaxed way, and lots of outdoors work, too, which always makes it more fun. I was in Hawaii for part of the break - I managed to fit in running a marathon, doing a lot of miles on my new bike, as well as seeing friends, relaxing and eating well. I feel absolutely refreshed and ready to go!
"It's funny, but the start of the winter break always feels so long and open-ended, but, before you know it, you're looking at the calendar and making plans to get back to MTC and start working again. I have to say, I always look forward to the start of a new year - I've never lost that enthusiasm throughout my entire career - and I think we have a lot to look forward to during the year ahead."
Q: You're teamed up with Sergio 'Checo' Perez at Vodafone McLaren Mercedes for 2013, will it feel strange having a new team-mate?
JB: "I had three fantastic seasons racing alongside Lewis, but nothing stays the same in Formula 1 and people move on. It's always interesting to have a new team-mate - there's that inevitable getting-to-know-you period when you're settling in, but I'm really pleased to have Checo at Vodafone McLaren Mercedes. We all saw what he was capable of doing behind the wheel of a Sauber last year and I think he's a very good addition to this team.
"The most important thing is that you have a good working relationship, that you can share ideas and information freely and that you're working together with the engineers for the good of the team. That's never been an issue at Vodafone McLaren Mercedes and I think we're going to work well together - Checo may only be 22, but he's very sensible and he knows what's needed to get the most from the car, so I predict it'll be a very strong partnership."
Q: There's a greater degree of continuity in the rules from 2012 to 2013, how do you expect to see that play out on the track this season?
JB: "I think all the teams will go into this season feeling more assured about the Pirelli tyres. As you know, last year was a bit of an unknown as we all got to grips with the new rubber, but that's less likely to happen this time around, so there's more stability there. There are differences to the tyres - the shape and the compounds, but I don't think they'll be as fundamental to the overall car performance as they were last year.
"In terms of regulations, yes there is some stability, so I expect most teams will have continued to refine their car package over the winter. It's always really interesting to see how the cars develop during a period of rules stability, because you watch the progress from year to year as the engineers refine and improve their thinking and ideas. You can literally see how the car has improved from season to season. It's crazy.
"I hope there's stability for another reason, too: I won the last race of 2012 so it would be perfect to win the first race of 2013!"
Q: How eager are you to get behind the wheel of your new car?
JB: "Always massively, massively motivated. As I said, I've never, ever lost that feeling of excitement and anticipation ahead of a new season. And testing the new car is always such an adventure, because it's such a dense and complicated procedure; in fact, testing a new car is very much in keeping with the Bruce McLaren ideal. Back in the 1960s, I heard about Bruce endlessly testing his cars, chasing improvements and stamping out problems and reliability issues.
"Testing is where you see a racing driver at the opposite end of the spectrum to when we're in a grand prix - it's never really about raw speed; it's about process, repetition, repeatability, about following your instincts but backing it up with good engineering.
"It's an absolutely fascinating process, and you can see the fruits of your labour unfolding before your eyes, day after day. It's a part of the job that I really enjoy. Can't wait!"
Any reproduction, publication or redistribution of this material without the written agreement of 365 Media Group is strictly forbidden.


text:
- Product Description
- Customer Reviews (1)
Product Description
The Nolan N20 helmet includes the following features:
- Stylish jet helmet, with exceptional finish and features for the scooter, vintage, or cruiser rider
- Innovative removable and washable liner is antibacterial, antifungal, and wicking
- Removable leather-like neck curtain
- Pilot style quick-change shield is optically correct and fitted with modern metalized side plates
- Microlock (adjustable quick release) retention system
- Super light at 2.5 lbs.
- DOT approved
Customer Reviews (1)
Average Customer Rating:
Write a review and share your thoughts with others.
Reviewer: Cindy Shumate (virginia beach, VA) 6.1.2013
Great Buy
The Nolan Outlaw Helmet was a hit with my boyfriend. He loves the comfort, the fit and how it blocks out sound to the ears and the comfort strap slide was an added luxury.


text:
Gay marriage around the world
POSTED: 11:18 AM MDT Apr 17, 2013 UPDATED: 08:20 AM MDT Mar 28, 2014
The first legal same-sex weddings will be held in Great Britain on Saturday, which is when a new law allowing gay marriages goes into effect. Find out which countries allow same-sex marriage and where it can get you killed.
The views expressed are not those of this company or its affiliated companies. Please note by clicking on "Post" you acknowledge that you have read the Terms Of Service and the comment you are posting is in compliance with such terms.blog comments powered by Disqus