Remote Authentication - Revision history

Tom at 18:20, 11 November 2010

2010-11-11T18:20:14Z

Dirk: added note about USER_uniqueUsername

2009-05-16T17:11:14Z

added note about USER_uniqueUsername

Dirk: added a note about and link to OpenID

2009-05-09T11:28:28Z

added a note about and link to OpenID

Dirk: Updates, corrections, and cosmetics

2008-05-11T19:49:42Z

Updates, corrections, and cosmetics

Dirk: Link to LDAP module description

2008-05-10T09:02:39Z

Link to LDAP module description

Dirk: 1.3.12 -> 1.4.0; Blogger / LDAP modules

2008-05-10T08:14:33Z

1.3.12 -> 1.4.0; Blogger / LDAP modules

THEMike at 09:35, 12 June 2005

2005-06-12T09:35:48Z

THEMike at 09:35, 12 June 2005

2005-06-12T09:35:14Z

New page

New in geeklog 1.3.12 is the Remote Authentication system. With Remote Authentication enabled, users can login to your site via any authorised external service and act as a regular user.

This allows you to disable anonymous comments and make it easier for people to comment (they don't have to sign up on yet another site (yours) they can use a pre-existing central account to make comments).

To enable Remote Authentication:

##Set $_CONF['remoteauthentication'] = true; in config.php
##Set $_CONF['usersubmission'] = 0; in config.php
##Install one or more Authentication classes in /path/to/geeklog/system/classes/authentication (Geeklog ships with a class for Blogger.com and one for LiveJournal.com)

With Remote Authentication enabled, the user is presented with a select box on the login screen to choose the login service. This will default to your site, but allow them to choose an external service. Users are authenticated via their remote username and password, and if they pass authentication a ''local'' account is created on your geeklog site that is slaved to that remote account. These local slave accounts can be banned, have special permissions etc just like any regular site user. The account creation process is the same as for local accounts, so all custom functions and plugin notifications are carried out as normal.

In addition, the user is added to the group 'Remote Users' allowing you to automaticaly grant/deny specific permissions to all remote users.

== Unique Usernames ==
When a new account is created, the local username for that account is set to the remote username. However, if there is already a user in the system with the same username a call is made to custom_uniqueRemoteUsername passing in their remote username and the name of the service used to validate the user. This allows the admin to supply a custom function to ensure unique usernames for all users.

It is not ''necessary'' to have unique usernames. This does not break the security of a local user or remote users login, as the full remote username and service are stored locally to avoid collision and internally users are identified by a unique number. However, if you want to ensure it is clear ''who'' has posted a comment or article by the name displayed, this function allows you to ensure uniqueness.

== Disabling Services ==
To disable a specific service, simply remove the (servicename).auth.class.php file from /path/to/geeklog/system/classes/authentication and that remote service will no longer be available to your users.

== Adding Services ==
Currently authentication modules for LiveJournal and Blogger are available. If you wish to add further services you will have to write custom modules to do so. This can be done by creating a php file named ServiceName.auth.class.php which declares a class called ServiceName with a method called authenticate. Authenticate takes username and password as arguments and should return a boolean. The class should expose an 'email' property and attempt to provide the users valid email address if this can be aquired from the remote server.

← Older revision		Revision as of 18:20, 11 November 2010
Line 44:		Line 44:

	Support for [[OpenID]] 1.1 was added in Geeklog 1.5.0. For technical reasons, it could not be implemented as a Remote Authentication module but instead had to be built into Geeklog's core code.		Support for [[OpenID]] 1.1 was added in Geeklog 1.5.0. For technical reasons, it could not be implemented as a Remote Authentication module but instead had to be built into Geeklog's core code.
		+
		+	=== OAuth ===
		+
		+	Support for [[OAuth]] 1.0 was added in Geeklog 1.8.0.

← Older revision		Revision as of 17:11, 16 May 2009
Line 23:		Line 23:

	It is not ''necessary'' to have unique usernames. This does not break the security of a local user or remote users login, as the full remote username and service are stored locally to avoid collision and internally users are identified by a unique number. However, if you want to ensure it is clear ''who'' has posted a comment or article by the name displayed, this function allows you to ensure uniqueness.		It is not ''necessary'' to have unique usernames. This does not break the security of a local user or remote users login, as the full remote username and service are stored locally to avoid collision and internally users are identified by a unique number. However, if you want to ensure it is clear ''who'' has posted a comment or article by the name displayed, this function allows you to ensure uniqueness.
		+
		+	The default implementation (<code>USER_uniqueUsername</code> in <tt>lib-user.php</tt>) adds a random number with up to for digits to the username. So if the username "john" is already taken, it may come up with "john443" as the username instead.

← Older revision		Revision as of 11:28, 9 May 2009
Line 38:		Line 38:

	If you wish to add further services you will have to write custom modules to do so. This can be done by creating a PHP file named ServiceName.auth.class.php which declares a class called ServiceName with a method called <code>authenticate</code>. Authenticate takes username and password as arguments and should return a boolean. The class should expose an 'email' property and attempt to provide the users valid email address if this can be aquired from the remote server. If that information is available, the class can also provide the user's full name ('fullname' property) and homepage ('homepage' property).		If you wish to add further services you will have to write custom modules to do so. This can be done by creating a PHP file named ServiceName.auth.class.php which declares a class called ServiceName with a method called <code>authenticate</code>. Authenticate takes username and password as arguments and should return a boolean. The class should expose an 'email' property and attempt to provide the users valid email address if this can be aquired from the remote server. If that information is available, the class can also provide the user's full name ('fullname' property) and homepage ('homepage' property).
		+
		+	=== OpenID ===
		+
		+	Support for [[OpenID]] 1.1 was added in Geeklog 1.5.0. For technical reasons, it could not be implemented as a Remote Authentication module but instead had to be built into Geeklog's core code.

@@ Line 24: / Line 24: @@
 Currently authentication modules are available for:
 * LiveJournal
-* LDAP
+* [[LDAP Remote Authentication|LDAP]]
 A module for authentication with Blogger was shipped with Geeklog 1.4.0 and 1.4.1 but has since been removed after Blogger changed their login procedure (the module doesn't work any more).
 If you wish to add further services you will have to write custom modules to do so. This can be done by creating a php file named ServiceName.auth.class.php which declares a class called ServiceName with a method called authenticate. Authenticate takes username and password as arguments and should return a boolean. The class should expose an 'email' property and attempt to provide the users valid email address if this can be aquired from the remote server.

@@ Line 1: / Line 1: @@
-New in geeklog 1.4.0 is the Remote Authentication system. With Remote Authentication enabled, users can login to your site via any authorised external service and act as a regular user.
+New in Geeklog 1.4.0 is the Remote Authentication system. With Remote Authentication enabled, users can login to your site via any authorised external service and act as a regular user.
 This allows you to disable anonymous comments and make it easier for people to comment (they don't have to sign up on yet another site (yours) they can use a pre-existing central account to make comments).
@@ Line 5: / Line 5: @@
 To enable Remote Authentication:
-#Set $_CONF['remoteauthentication'] = true; in config.php
+# Install one or more Authentication classes in <tt>/path/to/geeklog/system/classes/authentication</tt> (Geeklog ships with a class for for LiveJournal.com and an LDAP class)
-#Set $_CONF['usersubmission'] = 0; in config.php
+# In Geeklog 1.5 or later:
-#Install one or more Authentication classes in /path/to/geeklog/system/classes/authentication (Geeklog ships with a class for Blogger.com and one for LiveJournal.com)
+## In the Configuration, go to "Users and Submissions" > "Users" and set "User Login Method[3rdparty]" to "True"
 With Remote Authentication enabled, the user is presented with a select box on the login screen to choose the login service. This will default to your site, but allow them to choose an external service. Users are authenticated via their remote username and password, and if they pass authentication a ''local'' account is created on your geeklog site that is slaved to that remote account. These local slave accounts can be banned, have special permissions etc just like any regular site user. The account creation process is the same as for local accounts, so all custom functions and plugin notifications are carried out as normal.
 In addition, the user is added to the group 'Remote Users' allowing you to automaticaly grant/deny specific permissions to all remote users.
 == Unique Usernames ==
-When a new account is created, the local username for that account is set to the remote username. However, if there is already a user in the system with the same  username a call is made to custom_uniqueRemoteUsername passing in their remote username and the name of the service used to validate the user. This allows the admin to supply a custom function to ensure unique usernames for all users.
 It is not ''necessary'' to have unique usernames. This does not break the security of a local user or remote users login, as the full remote username and service are stored locally to avoid collision and internally users are identified by a unique number. However, if you want to ensure it is clear ''who'' has posted a comment or article by the name displayed, this function allows you to ensure uniqueness.
 == Disabling Services ==
 To disable a specific service, simply remove the (servicename).auth.class.php file from /path/to/geeklog/system/classes/authentication and that remote service will no longer be available to your users.
 == Adding Services ==
 Currently authentication modules are available for:
 * LiveJournal
@@ Line 27: / Line 37: @@
 A module for authentication with Blogger was shipped with Geeklog 1.4.0 and 1.4.1 but has since been removed after Blogger changed their login procedure (the module doesn't work any more).
-If you wish to add further services you will have to write custom modules to do so. This can be done by creating a php file named ServiceName.auth.class.php which declares a class called ServiceName with a method called authenticate. Authenticate takes username and password as arguments and should return a boolean. The class should expose an 'email' property and attempt to provide the users valid email address if this can be aquired from the remote server.
+If you wish to add further services you will have to write custom modules to do so. This can be done by creating a PHP file named ServiceName.auth.class.php which declares a class called ServiceName with a method called <code>authenticate</code>. Authenticate takes username and password as arguments and should return a boolean. The class should expose an 'email' property and attempt to provide the users valid email address if this can be aquired from the remote server. If that information is available, the class can also provide the user's full name ('fullname' property) and homepage ('homepage' property).