search

bbangert / velruse

Simplifying third-party authentication for web applications.
http://packages.python.org/velruse/index.html
MIT License
252 stars 86 forks source link

create add_login_from_settings for openid providers #85

Open mmerickel opened 11 years ago

mmerickel commented 11 years ago

Currently there is no add_google_login_from_settings, add_yahoo_login_from_settings or add_openid_login_from_settings because the storage parameter needs to be programmatically defined. What I would propose is a separate API that creates a shared openid store within velruse (because the python-openid package should only require one store for multiple providers).

def add_openid_storage(config, storage, name='default'):
def add_openid_storage_from_settings(config, prefix='openid_storage.'):

The second function would probably support pre-defined python-openid storage mechanisms from https://github.com/openid/python-openid/tree/master/openid/store. This would mean that it'd use openid_storage.type and other openid_storage.* settings to create one of the storage mechanisms.

From here, the OpenIDProvider would be updated to use this storage mechanism.

avanov commented 11 years ago

@mmerickel it seems to me that there's no more need in OpenID machinery in Yahoo provider. Should we refactor the existing module or add an alternative provider?

mmerickel commented 11 years ago

@2nd do you know if Yahoo's new auth machinery is bw-compat with existing applications? For example, if I create an application on Yahoo and use OpenID+OAuth, then we switch to their new OAuth workflow, will that require changes to the keys, etc? If so, then we should create a new yahoo_oauth provider probably.

avanov commented 11 years ago

I'm afraid I don't know it right now. I've tried to find relevant notes on Yahoo's Developer Network, but it lacks that information. And I've never used any hybrid provider before. So, I have either to compare them or to write an OAuth provider from scratch (which is quite simple). The second option is preferable for me, because I don't have any free time to examine OpenID's specs.

I'd like to hear a conclusion from somebody with expertise in OpenID.