Transition Technology: Ticket #153: Add a single sign on feature for TN.org

milestone set

ed — Mon, 29 Nov 2010 15:21:44 GMT

milestone set to Phase 3

further to meet Jim/Ed?, oAuth looked at and requested (also as standard for other sites).

priority changed

ed — Thu, 02 Dec 2010 16:12:43 GMT

priority changed from major to critical

hours, totalhours changed

jim — Wed, 08 Dec 2010 21:56:00 GMT

hours changed from 0.0 to 0.2
totalhours changed from 0.0 to 0.2

Hmmm....

Hitch 1 We must EITHER: use an obsolete Drupal module version of oAuth (oAuth Common, no longer being worked on since oAuth 3 does its job) and existing good services (v2.4) OR: we use an experimental version of Services (3.x alpha1) and a have a future-proof design. With bugs.

I reckon we have to go with the future proof version and help fix the bugs...

See http://drupal.org/project/oauth and http://drupal.org/project/services

ed — Wed, 08 Dec 2010 22:27:47 GMT

Future proofing is the way forward naturally - the services node makes it explicit that it's only for those prepared to tinker.

i can't see any reference to oAuth on services node (while regularly referred to in social networks etc.)
anything wrong with oAuth3?

hours, totalhours changed

jim — Thu, 09 Dec 2010 19:46:12 GMT

hours changed from 0.0 to 1.0
totalhours changed from 0.2 to 1.2

BIG CAN OF WORMS... Still researching but from http://stackoverflow.com/questions/2033026/sso-with-cas-or-oauth:

So, OAuth is not about Single Sign-On (nor a substitute for the CAS protocol). It is not about you controlling what the user can access. It is about letting the user to control how their resources may be accessed by third-parties. Two very different use-cases.

In other words, no one-size fits all. Plus there are a bunch of oAuth-related modules and piss-poor documentation on Drupal.org.

Going to come back to this with a clear head...

ed — Fri, 10 Dec 2010 08:50:23 GMT

suggest leaving oAuth and re-focusing on the first use case for this, which is to enable a single sign on that works between workspaces and the main site then. could file this under a classic case of user suggesting unsuitable answer to simple use case for now? workspaces and main site seamless login utterly vital...

hours, totalhours changed

jim — Mon, 13 Dec 2010 23:38:33 GMT

hours changed from 0.0 to 2.0
totalhours changed from 1.2 to 3.2

Went with CAS as per email...

It's kind of working on DEV - if you go to http://workspaces.dev.transitionnetwork.org.webarch.net/ and try to log in (notice the new block) then you're taken to the main dev site, then you log in, but then though you're logged in there's an access denied error... Logged in though. Hmm...

BUT importantly the SSO is working, even though it's not that user friendly with the access error.

Will continue to play/debug/cry...

SERVER note

Had to install Curl and phpCAS to get his working on DEV:

sudo apt-get install curl php5-curl
sudo pear install http://downloads.jasig.org/cas-clients/php/1.2.0/CAS-1.2.0.tgz
sudo /etc/init.d/apache2 restart

status changed

jim — Thu, 06 Jan 2011 17:39:41 GMT

status changed from new to accepted

Modules coming to LIVE tonight... will play in DEV further.

ed — Mon, 10 Jan 2011 14:56:41 GMT

Working - a bit ugly - needs a few more hours on LIVE - and changing button text and re-directing users to the correct page.

hours, totalhours changed

jim — Fri, 14 Jan 2011 15:53:54 GMT

hours changed from 0.0 to 0.15
totalhours changed from 3.2 to 3.35

CAS module updated on DEV, still getting this 'Access denied' BS...

See: http://drupal.org/node/420982 and http://drupal.org/project/issues/cas?text=access+denied&status=Open&priorities=All&categories=All&version=All&component=All

Will weigh in on CAS issues list.

status, priority, totalhours, type, hours, milestone changed; resolution set

jim — Thu, 27 Jan 2011 19:30:20 GMT

status changed from accepted to closed
priority changed from critical to major
totalhours changed from 3.35 to 3.5
type changed from enhancement to task
hours changed from 0.0 to 0.15
milestone changed from Phase 3 to Phase 4
resolution set to fixed

As discussed with Ed: Ed will see what the deal is with users being kicked out...

Sit Rep: Same as above, module WORKS but redirects to a 'access denied' page, thus falling at the last hurdle. Logins work, everything is groovy, user experience BAD...

Will add my voice to the issues list at http://drupal.org/project/issues/cas

If time, will debug the module, but can't easily because of the need for SSL that's not present on my machine.

Pushing to Phase 4 - apols Ed if this isn't what you meant earlier...

status changed; resolution deleted

jim — Thu, 27 Jan 2011 19:57:52 GMT

status changed from closed to reopened
resolution fixed deleted

didn't mean to close.

ed — Fri, 17 Jun 2011 12:11:04 GMT

is this going to be related in some way to #262?

jim — Wed, 22 Jun 2011 18:17:45 GMT

#263 (updates) and #224 (varnish) will remove Secure Pages and might make this work better... Will revisit at the end.

Might well be handy for TUS stuff.

status changed; resolution set

ed — Tue, 13 Sep 2011 15:28:09 GMT

status changed from reopened to closed
resolution set to wontfix

closing for now as likelihood will be to use third party authentication service from FB, Google to get PSE off the ground...