Table of Contents

OpenId Authentication Requirements

Introduction

Allow users to Authenticate themselves using an OpenId provider.

Allow users to signup for an account using an OpenId and prepopulate
the signup page with a userid, name and email address supplied by their OpenId profile.

Login Flow

  1. Show New Form with Text Box and Sign-in button for OpenIds on login_page.
  2. Process form with new page openid_login.
    • Check openid entered exists on database (and is not blocked).
    • use OpenId library to check authorisation (return to page openid_complete).
    • any errors go back to login_page with error message.
  3. User authenticates on OpenId server.
  4. Process response from the OpenId server.
    • If the user cancelled signin or some error occurred then go back to login_page with error message.
    • Retrieve the user_id associated with this OpenId from the database.
    • Login user to mantis, if fail then back to login-page (NB api change needed as we have no password).
  5. Display the page user started login process from or the default home page.
    • Complication - need to save the login success page while authorisation is checked.

Signup Flow

  1. Show New link on login_page for signup using OpenId.
  2. Click link to get openid_signup_page. This is a form for the user to enter their OpenId.
  3. Process form with new page openid_login.
    • Check openid entered does not exist on database.
    • use OpenId library to check authorisation (return to page openid_complete).
    • request that openid returns nickname, fullname and email. (and avatar ?)
    • any errors go back to openid_signup_page with error message.
  4. User authenticates on OpenId server and (possibly specifies which field values to send back).
  5. Process response from the OpenId server.
    • If the user cancelled signin or some error occurred then go back to openid_signup_page with error message.
    • Display signup_page with nickname and email values; add extra fields fullname and openid (read-only).
  6. Process signup_page as normal checking that username (nickname) and email (?) are not already in use.
    • Any errors - reshow signup_page with appropriate message.
    • Add user to database - api change needed to supply fullname and add an mantis_openid_table record.

Reauthentication Flow

  1. Allow the user to enter an OpenId (if they have one)
  2. Process openid in reauthentication code (change core?)
    • get and post parameters need to be saved.
  3. User authenticates on OpenId server.
  4. Process response from the OpenId server.
    • Any errors show reauthenication page with message to let them use userid/password if they wish.
  5. Dispay page that required authentication.

Implementation Notes

Database Changes

    create table user_openids (
    openid_url varchar(255) not null,
    primary key (openid_url),
    user_id int not null,
    index (user_id)
    );

Configuration

Implementation Log

Other Changes

Notes

Is the JanRain library the best one to use?
JanRain libraries seem popular in the php and python communities,
but in the java world the Acegi Spring security project developers have replaced JanRain with
OpenId4Java (see http://raykrueger.blogspot.com/2007/05/update-acegi-and-openid.html).

Feedback