search

veritus / veritus-backend

1 stars 0 forks source link

User authentication #55

Open AriHrannar opened 7 years ago

AriHrannar commented 7 years ago

Description

We need a way for our users to authenticate with the platform.

Current status

Right now we have email / password authentication but imo that is not very optimal

What we aspire to be

Use somekind of third party authentication. Suggestions:

  1. Facebook
  2. Íslykill

I am currently leaning towards Facebook right now for simplicity. The benefits are that pretty much everyone has a Facebook account and it will allow us to easier access to some other Facebook actions (share, post, etc).

Ragnar-H commented 7 years ago

+1 to FB

AriHrannar commented 7 years ago

@skabbi @Ragnar-H do either of you have any experience implementing Facebook single sign on? I have done it once but I am sure I did it at least partly wrong

skabbi commented 7 years ago

I do have some experience using OpenID Connect. See my Simple-OIDC-Server repo for a simple example using Google.

AriHrannar commented 7 years ago

I would say we go for Facebook then!

skabbi commented 7 years ago

There seems to be a lot of different libraries we can use, e.g. I found a list of libraries on StackOverflow. And here are some pretty straight forward instructions for a library that's not on that list,

Any preferences on which to use?

Ragnar-H commented 7 years ago

https://github.com/python-social-auth/social-app-django seems to be the one mentioned in the instructions you llinked.

The repo looks active, so it gets a 👍 from me

AriHrannar commented 7 years ago

Dont see anything wrong with it! :)

skabbi commented 7 years ago

I'm a bit unclear on one thing, should the current user/password login be removed?

Ragnar-H commented 7 years ago

If there is no problem servicing both, than I think it's good to have the current authentication.

headsup we're also going to need Authentication Roles (admin, editor, user)

Ragnar-H commented 7 years ago

If you feel like there is going to be any overhead with keeping the current user/password login, then you should remove it.

Then we can add it again at a later stage if we need it