OpenID Authentication

I've finished a first draft of an add-on to support OpenID Authentication. This requires no code changes and only one template change. The caveat however, is that it does require two third party libraries to handle the OpenID and Yadis protocols. I've only tested it on 3.5.4, but I'm pretty sure it should work in 3.6 (RC1) as well.

Right now, this add-on allows existing users to populate a custom profile field with their OpenID URL, and then use that for subsequent logins. This does NOT allow new users to register with their OpenID... they will still need to create an initial password and such as normal. I'd like to change that in a future release.

If you're not familiar with OpenID, check out http://openid.net/

[cheesegrits]

Yup, only I'm using class.openid.v2.php. I'm still in two minds as to whether to stick with it, or use the no doubt more mainstream JanRain stuff.

Yes, I'm doing registration. I just re-organized the regular registration page a little to put the CAPTCHA at the top, as we want to process that regardless, then an either / or for OpenID or specifying the regular details as normal.

Then one plugin one the start hook that just handles the referering and response from OpenID, grabbing the response data, creating a random password, and finagling the $_POST variables for 'addmember' appropriately. And one on the stop hook to associate the OpenID identity with the new user.

The one thing I don't like about wnorris's code is that it relies on using a standard login with blank password, and catching the authentication failure. I much prefer having an explicit OpenID field in the login form, and taking a separate route through the code. No disrespect to wnorris, his is a perfectly workable way of doing it. I just prefer to stick to the OpenID standard UI, and making it a separate, clearly labeled option.

Have you seen this page:

http://www.plaxo.com/api/openid_recipe

... which suggests allowing the users to attach multiple openid's to their account. I'm assuming this is as a fallback in case their primary povider is down for some reason? I can't think of any other reason for needing more than one OpenID associated with a given bb account?

-- hugh

[tcviper]

Can you share the plugin so we can let people either register or connect their already existing vb account with their openid one?

[cheesegrits]

I think szpak's version is the one that should be released, as he's building on the existing wnorris code which uses the more "official" JanRain libraries. Mine was more of a personal experiment, I just wanted to play with openid. But I would be more than willing to help support and continue development with szpak, if he would like. There's lots of goodies coming down the pike with OpenID, and I'm very interested in keeping up with developments.

So I guess the main issue is we need to try and get hold of wnorris, and get permission to re-use his code, and re-release as a new version with the registration and openid account attaching / detaching.

-- hugh

[thompson]

any news about that ?

[cheesegrits]

Nope. The author of this particular hack doesn't seem to have logged in to vborg for over year.

I'd be willing to re-release and maintain an updated version of the hack, but I'd really need to get hold of wnorris first to get his permission.

-- hugh

[GoldenChaos]

I completely support somebody taking this over and releasing it as a vB 3.7-compatible hack. I would love for my users to have the ability to login either with OpenID or with their existing vBulletin account, or effectively link the two together.

Which brings me to a good question: How does this effect the number of "registered users"? For example, if a forum has 50,000 users, and someone logs in with their OpenID, does the number of members increase to 50,001? If not, that's a serious deterrent from using an OpenID system.

[mangel.ajo]

Originally Posted by cheesegrits

Nope. The author of this particular hack doesn't seem to have logged in to vborg for over year.

I'd be willing to re-release and maintain an updated version of the hack, but I'd really need to get hold of wnorris first to get his permission.

-- hugh

Did you try using private messages?

Good luck, and thanks

[cheesegrits]

Originally Posted by GoldenChaos

I completely support somebody taking this over and releasing it as a vB 3.7-compatible hack. I would love for my users to have the ability to login either with OpenID or with their existing vBulletin account, or effectively link the two together.

Which brings me to a good question: How does this effect the number of "registered users"? For example, if a forum has 50,000 users, and someone logs in with their OpenID, does the number of members increase to 50,001? If not, that's a serious deterrent from using an OpenID system.

Yes, the user gets added to your users database. It just doesn't store a password, and authentication happens differently.

Originally Posted by mangel.ajo

Did you try using private messages?

Yup.

-- hugh

[jmar]

Originally Posted by cheesegrits

Nope. The author of this particular hack doesn't seem to have logged in to vborg for over year.

I'd be willing to re-release and maintain an updated version of the hack, but I'd really need to get hold of wnorris first to get his permission.

-- hugh

https://vborg.vbsupport.ru/showpost....1&postcount=13
Maybe that's statement enough?

[cheesegrits]

Originally Posted by jmar

https://vborg.vbsupport.ru/showpost....1&postcount=13
Maybe that's statement enough?

For some reason I managed to miss that post.

Well yes, I guess that is pretty much statement enough. Next time I get a few spare minutes, I'll re-release this under a new thread, so I can start making changes.

I just need to check with the vborg godz to make sure this is kosher.

-- hugh