OpenID, a light-weight, decentralized authentication mechanism

Quote from: splittingred at Mar 11, 2010, 08:24 AM

I lean toward merging OpenID into the existing Login component - allowing users to either have an OpenID login or a normal one.

OpenID should be a MODx Extension that includes an extended modUser class and a plugin for authentication. That is all.

Yes, architecturaly using the snippet isn’t great I agree, it mainly proves the library integration works Ok I guess. Ok, so how do we do this at the mo? The default auth scheme seems to be an MD5 password check but there’s no auth plugin for this(that I can see) or extended modUser class, or am I missing something here?

Quote from: shamblett at Mar 11, 2010, 09:13 AM

Yes, architecturaly using the snippet isn’t great I agree, it mainly proves the library integration works Ok I guess. Ok, so how do we do this at the mo? The default auth scheme seems to be an MD5 password check but there’s no auth plugin for this(that I can see) or extended modUser class, or am I missing something here?

Yes, you are missing the reference implementation we did for our Crowd system, which consists of a derivative modUser class (modCrowdUser) and an authentication/syncronization plugin. It basically allows you to use an external user system: it gets users into the MODx database if they do not already exist using the OnUserNotFound event, authenticates with the external system when the core login processor is called (which is used by the generic Login snippet) using the OnMgrAuthentication and OnWebAuthentication (if the external system indicates successful authentication, this overrides the core authentication mechanism), and since it ignores the local password field in the MODx user table, no password synchronization is ever necessary.

There are still some outstanding issues with user management in this area as there is no support yet for these extended user classes per se in the manager UI, but it does work as long as you don’t edit certain aspects of those users in the MODx manager; your external system should be your user manager in those cases anyway.

I’ll see if I can publish the modCrowdUser stuff publicly this weekend (or at least a generic tutorial) for your reference.

Yes thanks, the snippet does the middle bit of what you say, ie calls the login processor where the plugin intercepts the ’onweblogin’ event and verifies the auth data returned by the server. The rest of it just gets the form data and kicks off the authentication. Be interesting to see your Crowd stuff.

I’m also very interested in seeing the Crowd implementation. Any update on this?

Has any one looked at this implementation?

http://extremeswank.com/modx_authopenid.txt

m

Quote from: shamblett at Mar 11, 2010, 08:20 AM

I’ve created a package for Revo that logs webusers in using Open Id. It’s basically a clone of the Login component but rather than user/password you have user/openid url. The heavy lifting for the protocol is done by the JanRain libraries,other than that it just consist of a snippet, two chunks and a plugin. Transport package and zipped build area attached.

...
Ok, I’ve not put this in extra’s yet as I’m not sure where to go next, with it.

It’d be great to see this is the extras, whether Alpha or not. Will this work with the current revo 2.0.4?

Yes it will, its only prob is that its not integrated, it has its own login box etc. so if you wanted to use say this as well as LDAP or active domain or whatever you would need 2 login areas on your page.
I’m not sure we need extra’s for this, its better to have one login component configured to use whatever authentication backend(s) you want.

If I get time I’ll check this out again tomorrow and post the transport package here if it gets you out of a hole.

OK, transport package and zipped code export attached. I’ve just tested this on revo 2.0.4pl with PHP 5.3 and it works OK(now I’ve tweaked it a bit). Just follow the instructions in the README on install which just basically say put the following in a template or content :

[[OpIdLoginProc]]
[[$OpIdLogin]]

Thank you, I’ll give that a go