Weblog Comment Author (force to be login ID from OD)?

Question

Can you force the author of a comment to be the logged in loginID of the person who has authenticated into a secured weblog?
We have successfully set up and installed the weblog piece of the collaboration services on our 10.4.5 OS X Server (a replica on an OD system) and authentications work great, staff can create blogs, students can't but they can read the blogs and supply comments (that's what we want). However, a student who has been required to log into the blog site to read the blogs can still create a comment to an entry and supply ANY name they want in the Author. I'd like to remove the option to type an Author (I've already removed the e-mail and URL boxes) and force the Author field to be the loginID of the user who has logged in to the blog site.
Does anyone know how to do this? I've customized quite a bit on the weblog site so far, and everything is working exactly as we wanted but this is the one deal breaker we may have. We can't have 'anonymous' weblog comments posted by students. Too risky. We need the accountability of their own loginID being the Author. The weblog will be used for classes and is not accessible to guests or anonymous users so security of their name is already in place.

Answer 1

After extensive work with David Czarnecki, the author of Blojsom, we were able to get the userid provided by the logged in user included on the comment page. This required a new plugin by David (loggedinuser) which would store the logged in user's userid (the one they used to authenticate against our OD) and I can then use the variable it's assigned to in the Author field of the comments page, which I also set to read only so that students/staff cannot masquerade as another user in the Author field or submit anonymously.
I would recommend that anyone who would like to have this capability (and I can't imagine a single school that wouldn't) contact David Czarnecki via his site (http://wiki.blojsom.com/wiki/display/blojsom/About+blojsom) about the availability of the loggedinuser plugin and instructions for configuring the plugin (also provided below). If there is interest I can post my instructions for setting the Author field to read only as well so that logged in users can't change the Author on their comment. I also have the .jar file and the .java source file for the plugin and can provide that to Apple engineers if they would like to include this in future distributions, or to any admin who would like to use this plugin.
This will not stop masquerading via a stolen userid and password, but that's a different set of problems.
Plugin Installation and Configuration:
1. Copy the logged-in-user-plugin.jar file to blojsom's /WEB-INF/lib directory.
2. In /WEB-INF/plugin.properties add:
   loggedinuser=org.blojsom.plugin.user.LoggedInUserPlugin
3. In /WEB-INF/(blog-id)/plugin.properties, add " loggedinuser" to the end of the HTML plugin chain.
4. Re-start Tomcat to re-start blojsom. This requires a restart of the server, unfortunatley, unless someone can show me how to restart tomcat and reload the plugins and config files without a full server restart.
In the template (/library/tomcat/blojsom_root/webapps/root/web-inf/templates/html-comments.vm), you can then set the value of the 'author' text field to:
#if ($LOGGED_IN_USER)$LOGGED_IN_USER#end
Now users will see their shortname (userid) in the Author field and can't change it when they go to add a comment to a blog entry. This will only work if the user is required to log into the blog, and probably only with Apple's OD implementation.