Michal, it's interesting and I have a few comments.
I don't think we should force to have SignonURL. Let's take an application like Moodle that has its own auth method and keeps credentials available for all its modules. In the interface they would offer a link to phpMyAdmin and now with the new signon auth_type, they only have to set in their session $_SESSION['PMA_single_signon_user'] $_SESSION['PMA_single_signon_password']
then in PMA, configure SignonSession and the auth_type. PMA would not be called directly.
Forcing a SignonURL means that users first start PMA which calls an external URL for auth. I'm talking about the case when another app is started first.
Marc
Michal Čihař a écrit :
Hi all
after I saw two hacks in our patch tracker to achieve this, I turned them into regullar auth method and the result is in patch tracker[1]. If you have time, please share your ideas about it...