<div dir="ltr">I should give a good warning for any implementation: make the user's ID their local identifier and have usernames delegate to their identifier. Otherwise you run into a security issue with renaming users: fallenpegasus requests a rename, then a new user takes fallenpegasus, thereby stealing their identity on sites registered with <a href="https://id.openstack.org/~fallenpegasus">https://id.openstack.org/~fallenpegasus</a>.<div>
<br></div><div>It's also not a bad idea to version the openid urls, like:</div><div><br></div><div><a href="https://id.openstack.org/v1/">https://id.openstack.org/v1/</a><id><br></div><div><br></div><div>where</div>
<div><br></div><div><a href="https://id.openstack.org/~fallenpegasus">https://id.openstack.org/~fallenpegasus</a> -> <a href="https://id.openstack.org/v1/1">https://id.openstack.org/v1/1</a><br></div><div><br></div><div>
assuming ~fallenpegasus's ID is 1.</div><div><br></div><div>This makes it possible to change URL schemes in the future while still keeping backwards compatibility for older names.</div></div><div class="gmail_extra">
<br>
<br><div class="gmail_quote">On Thu, Sep 26, 2013 at 2:40 PM, Atwood, Mark <span dir="ltr"><<a href="mailto:mark.atwood@hp.com" target="_blank">mark.atwood@hp.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hmm, ok. I am painfully about convinced that a centralized auth solution is<br>
the right choice for us.<br>
<br>
While I'm wishing for a pony:<br>
<br>
First of all and most of all, I want the whole thing to be open source, and<br>
managed via the OpenStack infra review process, just like the rest of the<br>
stuff managed by Monty's team.<br>
<br>
I want it to have a web UI with a URL like<br>
<a href="https://id.openstack.org/~fallenpegasus" target="_blank">https://id.openstack.org/~fallenpegasus</a> so I can see someone's<br>
name,<br>
email addresses,<br>
gravitar photograph,<br>
when did they join the foundation,<br>
are they (board, TC, PTL, Core (of which teams)) and since when,<br>
project participation history,<br>
IRC handles,<br>
XMPP ids,<br>
PGP key fingerprints,<br>
social media URLs,<br>
Launchpad id,<br>
GitHub id,<br>
and Ohloh account.<br>
<br>
I want it to have, via some API, all the employer history tracking that is<br>
currently contained and duplicated in various data files in the gitdm project<br>
and stackalytics project.<br>
<br>
I want it to do LDAP, vCard, and PoCo, and make all that data I wished for the<br>
past few paragraphs available over those APIs.<br>
<br>
I want it to do OpenID and OpenID Connect (for the web apps), and a good<br>
backend to SASL (for the non-web apps).<br>
<br>
And I want it to support standard OATH TOTP 2-factor auth.<br>
<br>
AND<br>
<br>
And I want world peace.<br>
<br>
:)<br>
<br>
..m<br>
<br>
Mark Atwood <<a href="mailto:mark.atwood@hp.com">mark.atwood@hp.com</a>><br>
Director of Open Source Engagement for HP Cloud Services<br>
M <a href="tel:%2B1-206-473-7118" value="+12064737118">+1-206-473-7118</a><br>
<br>
<br>
> -----Original Message-----<br>
> From: Jeremy Stanley [mailto:<a href="mailto:fungi@yuggoth.org">fungi@yuggoth.org</a>]<br>
> Sent: Wednesday, September 25, 2013 7:20 PM<br>
> To: <a href="mailto:openstack-infra@lists.openstack.org">openstack-infra@lists.openstack.org</a><br>
> Subject: Re: [OpenStack-Infra] On being an OpenID consumer instead of an<br>
> OpenID<br>
> producer.<br>
><br>
> On 2013-09-24 16:39:44 -0700 (-0700), Ryan Lane wrote:<br>
> [...]<br>
> > If every application is provider agnostic each one of them will have<br>
> > their own OpenID consumer interface. This means it's necessary to make<br>
> > all of them look the same, which requires modifying a lot of<br>
> > applications. Adding different auth mechanisms (like persona) means<br>
> > adding it to every single application, too.<br>
> [...]<br>
><br>
> This reminds me of yet another point in favor of centralization. We want to<br>
> be able to<br>
> correlate information between a user's account in various distributed<br>
> systems where<br>
> there is currently no cross-system index mapping them to one another. If all<br>
> of them use<br>
> a common OpenID provider then we can key on that, but if they're<br>
> provider-agnostic<br>
> then at least some subset of users will authenticate to systems with more<br>
> than one<br>
> (potentially to different systems with different providers).<br>
><br>
> Also not mentioned yet in these threads, but one the reasons it was<br>
> suggested to run<br>
> our own provider is that we have some services which are not "Web apps" (so<br>
> not well-<br>
> suited to OpenID), and we'd like to be able to tie other auth protocols into<br>
> the same<br>
> backend eventually to support those systems as well.<br>
<span class="HOEnZb"><font color="#888888">> --<br>
> Jeremy Stanley<br>
><br>
> _______________________________________________<br>
> OpenStack-Infra mailing list<br>
> <a href="mailto:OpenStack-Infra@lists.openstack.org">OpenStack-Infra@lists.openstack.org</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-infra" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-infra</a><br>
</font></span><br>_______________________________________________<br>
OpenStack-Infra mailing list<br>
<a href="mailto:OpenStack-Infra@lists.openstack.org">OpenStack-Infra@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-infra" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-infra</a><br>
<br></blockquote></div><br></div>