Add a single sign on feature for TN.org

[ed]

we need a single sign on (/ multi-site API) feature for TN.org for phase 3:

1. coherent links with the workspaces on workspaces.tn.org
2. coherent links with other Transition sites - e.g. the incoming Transition drupal, other national hubs and possibly others
3. some form of API sharing with things like facebook (not sure if this is the same thing but trying to capture some needs here)

things looked at or recommended:
Openauth: ​http://oauth.net/
CAS: ​http://drupal.org/project/cas
SSO: ​http://drupal.org/project/sso

[ed]

further to meet Jim/Ed?, oAuth looked at and requested (also as standard for other sites).

[jim]

Hmmm....

Hitch 1
We must
EITHER: use an obsolete Drupal module version of oAuth (oAuth Common, no longer being worked on since oAuth 3 does its job) and existing good services (v2.4)
OR: we use an experimental version of Services (3.x alpha1) and a have a future-proof design. With bugs.

I reckon we have to go with the future proof version and help fix the bugs...

See ​http://drupal.org/project/oauth and ​http://drupal.org/project/services

[ed]

Future proofing is the way forward naturally - the services node makes it explicit that it's only for those prepared to tinker.

1. i can't see any reference to oAuth on services node (while regularly referred to in social networks etc.)
2. anything wrong with oAuth3?

[jim]

BIG CAN OF WORMS... Still researching but from ​http://stackoverflow.com/questions/2033026/sso-with-cas-or-oauth:

So, OAuth is not about Single Sign-On (nor a substitute for the CAS protocol). It is not about you controlling what the user can access. It is about letting the user to control how their resources may be accessed by third-parties. Two very different use-cases.

In other words, no one-size fits all. Plus there are a bunch of oAuth-related modules and piss-poor documentation on Drupal.org.

• ​http://drupal.org/project/oauth
• ​http://drupal.org/project/oauthconnector
• ​http://drupal.org/project/connector
• ​http://drupal.org/project/oauthloginprovider
• ​http://drupal.org/project/services

Going to come back to this with a clear head...

[ed]

suggest leaving oAuth and re-focusing on the first use case for this, which is to enable a single sign on that works between workspaces and the main site then. could file this under a classic case of user suggesting unsuitable answer to simple use case for now? workspaces and main site seamless login utterly vital...

[jim]

Went with CAS as per email...

It's kind of working on DEV - if you go to ​http://workspaces.dev.transitionnetwork.org.webarch.net/ and try to log in (notice the new block) then you're taken to the main dev site, then you log in, but then though you're logged in there's an access denied error... Logged in though. Hmm...

BUT importantly the SSO is working, even though it's not that user friendly with the access error.

Will continue to play/debug/cry...

SERVER note

Had to install Curl and phpCAS to get his working on DEV:

• sudo apt-get install curl php5-curl
• sudo pear install ​http://downloads.jasig.org/cas-clients/php/1.2.0/CAS-1.2.0.tgz
• sudo /etc/init.d/apache2 restart

[jim]

Modules coming to LIVE tonight... will play in DEV further.

[ed]

Working - a bit ugly - needs a few more hours on LIVE - and changing button text and re-directing users to the correct page.

[jim]

CAS module updated on DEV, still getting this 'Access denied' BS...

See: ​http://drupal.org/node/420982 and ​http://drupal.org/project/issues/cas?text=access+denied&status=Open&priorities=All&categories=All&version=All&component=All

Will weigh in on CAS issues list.

[jim]

As discussed with Ed: Ed will see what the deal is with users being kicked out...

Sit Rep: Same as above, module WORKS but redirects to a 'access denied' page, thus falling at the last hurdle. Logins work, everything is groovy, user experience BAD...

Will add my voice to the issues list at ​http://drupal.org/project/issues/cas

If time, will debug the module, but can't easily because of the need for SSL that's not present on my machine.

Pushing to Phase 4 - apols Ed if this isn't what you meant earlier...

[jim]

didn't mean to close.

[ed]

is this going to be related in some way to #262?

[jim]

#263 (updates) and #224 (varnish) will remove Secure Pages and might make this work better... Will revisit at the end.

Might well be handy for TUS stuff.

[ed]

closing for now as likelihood will be to use third party authentication service from FB, Google to get PSE off the ground...