[
https://issues.apache.org/roller/browse/ROL-1733?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14406#action_14406
]
David Johnson commented on ROL-1733:
------------------------------------
I've been reviewing Tatyan's latest patch. It works, but it needs some work
before it can be committed to trunk. Here are the problems/issues found and my
proposed solutions for some. The ones with numbers are fixed in my workspace.
Once I work through these issues I'll create a new patch and try to get
consensus to commit it.
1) Problem: Requires modified version of Spring Security XSD file which won't
be available until Spring Security 2.0.4 is due out. The 2.0.1 schema files
did not have OPENID_PROCESSING_FILTER.
See this - http://jira.springframework.org/browse/SEC-927
Solution: Use the file src/META-INF/spring.schemas to override
the XSD included in the Spring Security jar with the one in
web/WEB-INF/classes/spring-security-2.0.1-openidfix.xsd.
2) Problem: URL with "/" at end vs. those without
Solution: always strip trailing slash before storing or comparing OpenID URLs
*) Problem: Requires Spring Security 2.1, which is not due out for a long time
See this - http://jira.springframework.org/browse/SEC-935
Solution: We only need to wait for the Attribute Exchange stuff, which can
pre-populate the new user registration form. So for now we can use Spring
Security 2.0.3 (the latest) and comment out the attribute exchange code.
*) Problem: Login page does not explain the OpenID user name field.
Solution: add text to explain that user can login with either
username/password OR OpenID. Also, add OpenID icon to OpenID field.
*) Problem: Login page. After initial login, when you return to login page some
how the username field is being populated with your OpenID URL, which should
go in the OpenID username field.
Solution: UNKNOWN. Could be caused by the browser?
*) Problem: User attributes are stashed in hashtable in UserManager interface.
Solution: UNKNOWN. Store in session instead?
*) Problem: New user registration, if you choose to register using your OpenID
then you should not have to enter a password.
Solution: UNKNOWN. Allow both password and OpenID?
*) Locale/TZ should be populated by browser or server information and should
not default to Albanian/ACT.
Solution: UNKNOWN, but probably an easy fix.
*) Configuration does not allow enough options for OpenID. I would like to make
it possible to support these three configurations:
- OpenID disabled: completely turn off OpenID
- OpenID hybrid: allow username/password and OpenID logins
- OpenID only: allow login via OpenID only.
> Implement OpenID for Roller
> ---------------------------
>
> Key: ROL-1733
> URL: https://issues.apache.org/roller/browse/ROL-1733
> Project: Roller
> Issue Type: New Feature
> Components: User Management
> Reporter: David Johnson
> Assignee: Roller Unassigned
> Attachments: apache-xml-security.jar, dom3-xercesImpl.jar,
> dom3-xml-apis.jar, ehcache-1.4.1.jar, java-openid-sxip.jar, nekohtml.jar,
> openxri-client.jar, openxri-syntax.jar, ROL-1733.patch, ROL-1733_v2.patch,
> ROL-1733_v3.patch, rol-1733_v4.patch, spring-security-core-2.0.1.jar,
> spring-security-openid-2.0.2-regext.jar,
> spring-security-openid-2.0.2-regext.jar,
> spring-security-openid-2.0.2-regext.jar, spring-security-openid-regext.patch
>
>
> Represents this proposal:
> http://cwiki.apache.org/confluence/display/ROLLER/Proposal+OpenID+Support
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
