New Module: OpenID

I needed an easy way for friends and family to log into my gallery, without me having to provision users for everyone.

This is the first draft of a plugin for Gallery 3 which provides just such a capability. Note that this should absolutely, without a question not be used yet for production sites. This is very beta software. However, I wanted to start the ball rolling. I’ve only tested with Google as the OpenID provider. Currently, the plugin:

* Provides a form for normal gallery log in and for OpenID login & registration
* Automatically provisions user accounts using as much information as it got from the OpenID provider
* Ties the OpenID identifier to the Gallery3 user through a separate table, allowing gallery users and openid users to coexist.
* Provides debugging info into the log by default. (Changeable in the admin options)

Some deficiencies, and things that this module doesn’t do:

* It doesn’t tie in perfectly into themes (such as the ajax login). Currently you must manually type in the login page (see below).
* It probably doesn’t work perfectly for both gallery and openid users
* There might be security issues I am not aware of

Some hopes and dreams for future versions:

* Allow an admin to choose which OpenID buttons are large (currently they must be made by hand, through a helper script).
* Work with both the ajax login and html logins from gallery.
* Work with the register module when provisioning users so that the admin has more control.
* Tie into some OAuth frameworks, such as Facebook.
* Be as secure as possible against CSRF, etc.
* Never interfere with normal gallery usage and users
* Graceful error handling

Documentation and download: http://kott.fm/tomek/plugins-extensions/openid/. PLEASE PLEASE read through the documentation: some files need to be changed.

Support: either post here, or at http://kott.fm/tomek/forums/forum/openid/

I welcome patches, improvements, comments etc. If you give me a couple patches and I agree with them, I'll give you access to the fossil repository where I keep my source code: http://kott.fm/cgi-bin/fossil/openid/.

Tomek
----
Publish on Gallery 3 (WLPG Plugin) | XMP Module | OpenID Module

Dave,

Thanks for the feedback!

Yes, that's the simplicity I was looking for. I just didn't get around to fixing this -- I wanted a first pass plugin to get feedback on . I've opened a ticket for myself with your suggested change: http://kott.fm/cgi-bin/fossil/openid/tktview?name=9f7cc99b0c.

That's a problematic one, and one which I forgot to document (oops!). It's in the openid/js/openid-jquery.js I believe. Yes, search for img_path and change that. I'm not a great JS person, but clearly that needs to be consistent. Maybe abs_url() can be used in this case as well, with changing it in the "openid_login.html.php" file...I'll look into that. I guess I could just use item::root()->url() and then tack on /modules/openid/images, to get the same relative url? Ticket tracked here: http://kott.fm/cgi-bin/fossil/openid/tktview?name=de4f5b9c1e

Are you talking about that ajaxified dialog page? If so, then yes, that was one of the things I need to find a way to fix or just automatically go to the html page. Ticket for that here: http://kott.fm/cgi-bin/fossil/openid/tktview?name=31916ee2f4.

Thanks for looking it over and suggesting the abs_url.

Tomek

----
Publish on Gallery 3 (WLPG Plugin) | XMP Module | OpenID Plugin

I think that getting the csrf# from a forge and then using it as a hidden form field is the way to go if this does not work:
$csrf = access::csrf_token();
or using it in a view; your controller could have:
$view->content->csrf = access::csrf_token();
then your view would just need:
<?= $csrf; ?>

Dave

_____________________________________________
Blog & G2 || floridave - Gallery Team

Now you are over my head. I will get Bharat or others to comment.

Dave
_____________________________________________
Blog & G2 || floridave - Gallery Team

James,

Thanks, one of those two did it! Woohoo, another ticket fixed!

Tomek

----
Publish on Gallery 3 (WLPG) | Modules: XMP, OpenID

Hi,

I installed this but I have a small problem which I believe to be a bug and a small suggestion.

I have gallery installed under a top level domain name as a virtual server. So my address is like gallery.x.y, i.e., I don't have it under a gallery folder or alias. I changed the base url as in the docs to gallery.x.y, but I still can not get provider icons image file as it seems to try for http://gallery.x.y/gallery/modules/openid/images/openid-providers-en.png. I don't know where /gallery/ comes from? I don't have it in any configuration...

My suggestion is about connecting the usual gallery accounts and openid accounts as in wordpress. It should be possible to add unlimited number of openids under an account and unify the experience.

Best.

Now it tries to find:

http://gallery.x.y/index.php//modules/openid/images/openid-providers-en.png

and it can't find. Manually trying at the browser address bar, this address seems to work:

http://gallery.x.y/modules/openid/images/openid-providers-en.png

Yes, it worked. Thanks.

Other than that I have one more problem. It takes ages for google openid logins to perform. On the same server with wordpress openid login much faster. With this plugin, firefox stays at "connecting..." for at least 3-4 minutes. Interestingly using yahoo login it is equally fast with wordpress sw. Where do you keep debug logs?

I haven't had that problem when using google (in fact the only one I've tested). It always returns quickly for me. Sorry!

Mostly. You would also need to refactor the logic that checks the table. Currently I believe it just looks for one row in the table, but you would either need a list of id's in one row, or many rows with one userid and many openids.

Yes, that is a google shortcoming. I googled around for a bit trying to find a solution, but it appears that google does not easily hand out that information. If you find a solution or workaround, let me know!

Let me know if you want to fork the code, and be able to push back to the repository any changes. I'm very open to collaboration, since the module does pretty much everything that I *need*, so I haven't focused on it recently.

Tomek

----
Publish on Gallery 3 (WLPG) | Modules: XMP, OpenID

@memgir

Thanks for the further testing. I had completely forgotten about the reauthentication piece of the puzzle. Do you happen to know if this is only relevant for admins or for users as well? I can't promise anything faster than a week or two right now, sorry.

Did you happen to work on combining openid's for normal users?

Tomek

----
Publish on Gallery 3 (WLPG) | Modules: XMP, OpenID

@memgir,

I think I've figured out how to get the reauthentication working. It turns out the reauth is only for admins. Everyone else simply has to log in again. It's a bit late here now, but sometime this week I'll try to finish up some of the changes. If you feel like living on the edge, go to http://kott.fm/cgi-bin/fossil/openid/timeline, click on the most recent check-in, and download the zip file after logging in anonymously (top right hand side of the page).

You'll need to run the upgrader (I needed to change a table), and probably delete & recreate any users that were created by the openid plugin. The key is that the openid_ids table should have actual urls for the "provider" column. If that is not the case, then you will need to either delete/recreate as mentioned, OR take the urls from the modules/openid/js/openid-en.js files for the appropriate entry and update manually. For example, if you had a user_id = 47 that corresponded to id = 7 in the openid_ids table and that user was created by using the google openid provider, you would need to update the provider column for that openid_ids table entry to "https://www.google.com/accounts/o8/id" as listed in the javascript file.

Let me know if you have any questions / bug reports. I tested this by setting the advanced setting "admin_timeout" (or something similar) to 30 seconds. If the URL is set properly, you should not even see the 'reauthenticate' form. It should automatically forward to the provider for validation, and if you are still logged in there, you should seamlessly be forwarded to the admin page requested.

Tomek

----
Publish on Gallery 3 (WLPG) | Modules: XMP, OpenID