[Opensim-dev] Anonymous access

[Mystical Demina]

There has been a lot of talk about security lately so wanted to share one
use case I see and that is anonymous access and to get your thoughts on how
it could be implemented.

An example of my use case is a furniture store that wants to display their
products using a virtual world.  Like in the real world, and most ecommerce
sites, the user initially has anonymous access to the site and is free to
browse.  To make access to this virtual store as easy as possible I can see
the furniture store owner allowing people to access the virtual world with
out having to present any kind of credentials and making an account.  If
this customer decides to buy something he will of course need to make an
account.

So from a technical standpoint on how to implement this I am thinking of the
following.

1. I can see implementing a user login that makes a agent against some
pre-setup accounts.  But what I think would be nicer is to have one
anonymous account like we do with websites.  The anonymous account could
have multiple agents logged in against is.  This would make is easier to
manage than many accounts.  Any thoughts about the feasibility of a single
anonymous user account?

2. In this use case I may allow the person to pick a male or female image
from a webpage that they use to initiate the log in.  If I have multiple
user accounts that should be easy, but if I have one anonymous account is it
possible to cache the user appearance in the simulator and never commit any
changes?

3. Can the same user exist multiple times in the simulator or will this
cause a problem?  Is the simulator more tied to the circuit of the user or
to the user UUID.

4. I can see having a way to IM a sales person.  Not sure I would allow
customer to customer IMing.  In fact not sure I would even let users see
other users.  Only allow them to see sales people and talk to sales people.
Any thoughts on this?  Seems I just need to filter the IM messages and only
allow them to specific avatars.  And I can turn off sharing avatar presence
to only specific avatars.

So technically speaking, what may be the simplest way to accomplish this?
Have you guys talked about this before?  

Kevin Tweedy
IRC: Mystical