CKAN: Ticket #787: Auth API

pudo — Tue, 09 Nov 2010 09:33:27 GMT

Alternative:

The Drupal system will expose a resource at data.gov.uk/profile which wil contain the reqesting user's nickname, fullname, email etc. in JSON (or XML) form.
The Drupal system will also run an OAuth server (and provide /request_token, /access_token, /authorize).
CKAN's login form will be rewired to initiate a client OAuth request on the /profile resource.
Recognizing CKAN's callback URL at catalogue.data.gov.uk, Drupal will automatically grant the request if a user is signed in.
Upon return, a user is created, optionally using the OAuth access token as the users API key, thus making it known both to Drupal and CKAN.
The authorizer will be extended to check access to the /profile resource for OAuth accounts (slow but safe).

Advantages:

Well-known protocol, does not depend on cookies (which are strange and never behave as defined, or even the same in multiple browsers)
Python code is available: http://oauth.googlecode.com/svn/code/python/oauth/example
Drupal seems to have very complete support: http://drupal.org/node/296205
Can be fully implemented as a plugin, using an OAuthClientController for callback and adding hooks to the Authorizer (perhaps need to reconfigure who.ini)

sprint changed

johnbywater — Mon, 15 Nov 2010 10:07:38 GMT

sprint changed from 1.3.3 to 1.3.4

Moved from sprint 1.3.3

milestone changed; priority, component set

thejimmyg — Fri, 07 Jan 2011 16:32:46 GMT

priority set to major
component set to dgu
milestone changed from ckan-v1.3 to longterm

milestone changed; repo, theme set

thejimmyg — Mon, 28 Mar 2011 09:47:47 GMT

repo set to ckan
theme set to none
milestone changed from longterm to ckan-v1.4-sprint-5

thejimmyg — Mon, 18 Apr 2011 09:14:14 GMT

The AuthAPI now exists as an IMiddleware plugin, we really need the permission system moved into CKAN before it is useful though and this depends on a refactor of the Auth system. See #1094

milestone changed

thejimmyg — Mon, 18 Apr 2011 09:14:43 GMT

milestone changed from ckan-v1.4-sprint-5 to ckan-v1.4-sprint-6

milestone changed

shevski — Fri, 08 Jul 2011 12:00:48 GMT

milestone changed from ckan-v1.5 to ckan-current-sprint

keywords set

kindly — Mon, 15 Aug 2011 09:23:03 GMT

keywords dgu added

status, milestone changed; resolution set

thejimmyg — Mon, 12 Sep 2011 09:51:58 GMT

status changed from new to closed
resolution set to fixed
milestone changed from ckan-current-sprint to ckan-sprint-2011-09-12

The joint authentication was implemented a long time ago and is deployed on catalogue.data.gov.uk. We'll build the authorisation layer in ticket #1326 so marking this as fixed.