Page History

...

OpenID is a technology that allows users to use one username/password pair to login to large number of web sites, but to never have to reveal their password to any of those sites. Instead of establishing a username/password pair on each site, a user instead registers with an OpenID provider site (e.g. claimid.com) and receives in return a unique OpenID identifier URL. When logging into a site that supports OpenID logins, known as an OpenID consumer site, the user specifies this URL to the consumer site, is directed to the provider site to login and then back to the consumer site in a logged in state.

This proposal is for adding OpenID support to Roller so that Roller can act as an OpenID consumer.

Requirements

Here are the basic requirements to be satisfied by this proposal:

• Allow new users to register and login via OpenID
• Allow existing users to login via OpenID
• Allow site operators to choose one of three modes of operation:
  • Disabled: no OpenID support and no evidence of OpenID in the Roller web UI
  • Hybrid: allow users to login via either username/password or OpenID identifier
  • Only: require users to login only via OpenID identifier

Issues

Should the user have a choice of which opened_url to use during authentication?
If the user can have multiple opened_urls, there should be some additional functionality on the page where the user can edit its profile details - add or remove certain opened_url from the list - and adjusted database structure should be implemented.

Another issue is the registration of the new user: the user will be asked whether he wants to use openid or not. If not, he will be redirected to the usual registration page. In other case, he will input his openid and redirected to his openIDProvider to authenticate, then, some of the information will be received from user's profile and if necessary, he will be asked to provide some special information. At the same time when the user comes to the website for the first time, he can authenticate using openid and the new account will be automatically created. So, do we need two forms of creating a new user?

Design

...

• OpenID4Java (http://code.google.com/p/openid4java/^{Image Removed})
• XRI (Extensible Resource Identifier)

...

• org.apache.roller.weblogger.User.java - add the list of openids and method of casting openid to the canonical view (so in the database it will be stored in the predefined format)
  • String castToCanonical(String url)
• Create a new POJO class UserAttributes which will represent the userattributes database table.
• Modify class JPAUserManagerImpl.java - add method and methods connected with receiving an username and managing his openIDs, for instance:
  • User getUserByOpenIDUrl (openid_url) - returns instance of user by the verified openid_url
  • GetOpenIDsByUser(user_id) - returns the list of openid's that belong to one user
  • AttachOpenID(openid_url, user_id) - add openid url to the user's profile
  • DetachOpenID(openid_url, user_id) - delete certain openid url from the user's profile
  • DetachOpenIDsByUser(user_id) - delete all openIDs from the user's profile

...

Here are the major issues we discussed during the development of this proposal:

• Allow users to specify more than one OpenID? Decision: no, one is sufficient
• Allow commenting users to login via OpenID? Decision: good idea, but we'll do this later
• Add OpenID specific methods to Roller's User Manager? Decision: no, use generic user attributes to store each user's OpenID identifier instead.

Design

Here is an overview of the design of the OpenID consumer support in Roller:

Use Spring Security's OpenID support

New database table and POJO

New UserManager methods

New startup properties

Changes to registration form

Changes to login form

Changes to user profile form

...

Project Plan

1. Examine the application structure and the features of the existing authorization system, built using the Spring Acegi framework. Understand, what types of security filters are used and how they can be replaced. Outline, what features to change and what to edit in the existing system.
2. Plan the main functionality of the project and install required libraries to the system.
3. Release the main functionality - add necessary classes, scripts, database tables and Spring Security filters.
4. Change the visual interface of the application (add authentication prompt to ask users for their OpenID identifier rather than their username and password).
5. Test the system and write necessary documentation.

...