Passwords everywhere
I’m getting to old to remember all those passwords sprinkled all over the web! Most embarrassing is that I can’t remember the password to my own private applications, but there is a couple though: local mail server, homeserver user and admin, local wiki and blog, several mail accounts to name a few.
So to remedy this plethora of passwords I have joined the OpenId movement and try to add OpenId login wherever I can. My DasBlog already have it but not my ScrewTurn Wiki wiki. I really like the architecture of ScrewTurn Wiki with dynamically loaded providers and it was fairly simple to write a new user storage provider for OpenId users and adding the DotNetOpenId control to the login page. Unfortunately I have not found a way to avoid changing the application when adding the OpenId login. The alternatives are either to add a new sign-on page with the open id login control or modify the existing login page. If the login page is modified then I have to apply the patch on every update but I get a direct login link from the main page. Any way the application has to be re-compiled and I lose some of the benefit of loading a provider dynamically. But I have not investigated other solutions so there might be a simple fix for this.
Login page modifications:
Download the DotNetOpenId control from http://code.google.com/p/dotnetopenid/ and set up a reference to it from the web application.
Add the assembly import in the login.aspx page:
<%@ Register Assembly="DotNetOpenId" Namespace="DotNetOpenId.RelyingParty" TagPrefix="cc1" %>
Then the actual login control can be added anywhere on the page.
<hr />
<cc1:OpenIdLogin ID="OpenIdLogin1" runat="server" CssClass="openidLogin"
RequestEmail="Require"
RequestNickname="Require"
RequestFullName="Request"
RegisterVisible="false"
RememberMeVisible="True"
PolicyUrl="~/PrivacyPolicy.aspx" TabIndex="1"
onfailed="OpenIdLogin1_Failed"
onloggedin="OpenIdLogin1_LoggedIn"
onsetuprequired="OpenIdLogin1_SetupRequired"
/>
When using auto registration at least email and nick name shall be required and the full name can be requested. Either the nick name or the full name can be used as display name. The ScrewTurn Wiki username will be derived from the identifier as described below.
Provider
The hardest thing was to adapt the way authorization works when using OpenId. The user shall NOT be authorized when logging in to the application. The user is already authorized; the application shall just set the access rights and eventually register the user. User data like user name and email is requested in the call to the authorization service and are used to register the user. I used a trick to get the claimed identifier (http://myuser.name.myopenid.com/) down to the OpenId provider. First attempt was to use the identifier as user name but then the user name regular expression complained. Technically the user should not be edited but the name is verified when the user is brought up for group assignment. Anyway I needed a unique identifier for the user and want to use the claimed identifier.
Well the way I resolved it was to use the password parameter instead. When an OpenId user is created the identifier is modified to construct a new username: the http:// and .com part is removed and the dots replaced by spaces. This will give a user name like ‘myuser name myopenid’ and that is unique enough. I chose to automatically register the user if the login fails. The OpenId provider defines two default groups: OpenId_Users and OpenId_Administrators and can be configured to automatically add a new user to one of those groups. Users will be added to the anonymous group if they are not added to any of the default groups.
Provider configuration:
My primary goal was to enable me to logon as an administrator to my wiki so I added a feature for automatically adding a user to a user group. The provider maintains two predefined groups’ wher users can be added with the following configuration:
addtoadmin=http://myuser.name.myopenid.com
addtouser=http://myuser.name.myopenid.com
Installation:
When the login page have been modified, or a new sign-on page added to the web application it’s time to deploy. Start up the wiki and log on as an administrator to configure the wiki for OpenId access. Upload the OpenIdProvider.dll to add it to the framework and configure the provider if you want the automatic logon feature (see above). Then go to the group administration page and set access rights for the two default OpenId groups. That’s it! Logout and go to the login / sign on page and login via OpenId.
Login problems
Sometimes during the tests I have problem to get the sign in to work and gets Login_Failed. The same thing happens on my DasBlog. Usually it works after a login/logout on myopenid.
Disclaimer
This was not intended to be an industrial grade solution for OpenId implementation on ScrewTurn Wiki but it can be used as a starting point for them who want to add it to their installation. The code is delivered ‘as is’ without any guaranties regarding security etc.
I got rid of another password to forget and can move on with next project
The OpenId source code and dll can (soon) be downloaded from http://minidev/download/Openidprovider.zip