Synnefo

Now that we keep around the cookie, give the user the opportunity to use it as the authentication token to get to a file. This way passing around simple file resource URIs is possible, and as long as the user has authenticated with the service in the current browser session, he can access the file. Furthermore, treat such simple browser access as a special case and redirect to login before returning back to the file. Now one can e-mail the file URI to another user and he can click on the link, get prompted to login (or even register for the service) and then get back to the file URI to download it automatically....

Don't allow usernames with spaces.

Fix the check for removed owner permissions.

Set all required objectClass attributes when adding an entry to LDAP. Also consistently encode and decode request parameters on success and errors.

Create user accounts in an LDAP-based IdP server after registration, so that Shibboleth login can work.