Get rid of Mako and persona page (ref #136, #122)

spiral-project / daybed

Form validation and data storage API

http://daybed.rtfd.org/

BSD 3-Clause "New" or "Revised" License

53 stars 8 forks source link

Get rid of Mako and persona page (ref #136, #122) #138

Closed leplatrem closed 10 years ago

leplatrem commented 10 years ago

rationale :

daybed is an API
there should be no mention of authentication method outside application init
the persona page was buggy #136
the persona page is useless for remote authentication, like pretended for a storage as a service #122

Instead we should allow login and logout pages to be opened to the world :) cf. #103

almet commented 10 years ago

We need to check if Hawk can be an alternative for users, if persona isn't alright; I'm not sure persona won't work, actually, but this need some time from us to identify how we could integrate with this service. I think we should do that before removing any authentication page we have for now.

— Alexis

leplatrem commented 10 years ago

How does a login html page make sense on a Web API ? It's not a rhetorical question, I am wondering for real :)

I find Persona very convenient in our case ! Once CORS will be enable on /login, and once there is a way to obtain csrf before posting credentials, the implementation of Persona in Daybed will be just fine !

Natim commented 10 years ago

I guess as an example of JS persona implementation. As an easy backend to get started faster. I used this template for persona authentication in my JS example apps.

leplatrem commented 10 years ago

After a rather long discussion with @ametaireau yesterday. This page is relevant because :

When prompting credentials, Persona associates authentication to a specific website
A client application would ask its users to visit this daybed page in order to authenticate (with possible redirect on success)
Further calls on daybed API from client application will be authenticated using cookies set on daybed domain.

We can imagine removing this page, only if we confirm the following assomption :

When prompting for Persona credentials on the client application (using Persona JS lib), the assertion obtained can be posted on daybed /login view to authenticated the user. This may depend on the audience value to '*' specified on daybed.

Once this confirmed, we can update #103 and rethink about this one :)

almet commented 10 years ago

Since we last discussed that in january, things have evolved a bit. Persona is not developed actively at Mozilla and its relevance for Daybed is not really clear.

One reasonable course of action seem to ditch persona out and implement a "normal" accounts system with a way to authenticate with hawk.