|
4
|
1 #summary Enables Prosody to act as an OpenID provider |
|
|
2 = Introduction = |
|
|
3 |
|
|
4 [http://openid.net/ OpenID] is an decentralized authentication mechanism for the Web. mod_openid turns Prosody into an OpenID _provider_, allowing users to use their Prosody credentials to authenticate with various third party websites. |
|
|
5 |
|
|
6 = Caveats = |
|
|
7 |
|
|
8 mod_openid can best be described as a *proof-of-concept*, it has known deficiencies and should *not* be used in the wild as a legitimate OpenID provider. mod_openid was developed using the Prosody 0.4.x series, it has not been tested with the 0.5.x or later series. |
|
|
9 |
|
|
10 = Details = |
|
|
11 |
|
|
12 OpenID works on the basis of a user proving to a third-party they wish to authenticate with, an OpenID _relaying party_, that they have claim or ownership over a URL, known as an OpenID _identifier_. mod_openid uses Prosody's built in HTTP server to provide every user with an OpenID identifier of the form `http://host.domain.tld[:port]/openid/user`, which would be the OpenID identifier of the user with a Jabber ID of `user@host.domain.tld`. |
|
|
13 |
|
|
14 = Usage = |
|
|
15 |
|
|
16 Simply add "mod_openid" to your modules_enabled list. You may then use the OpenID identifier form as described above as your OpenID identifier. The port Prosody's HTTP server will listen on is currently set as 5280, meaning the full OpenID identifier of the user `romeo@montague.lit` would be `http://montague.lit:5280/openid/romeo`. |
|
|
17 |
|
|
18 = Configuration = |
|
|
19 |
|
|
20 mod_openid has no configuration options as of this time. |
|
|
21 |
|
|
22 = TODO = |
|
|
23 |
|
|
24 The following is a list of the pending tasks which would have to be done to make mod_openid fully featured. They are generally ranked in order of most importance with an estimated degree of difficulty. |
|
|
25 |
|
|
26 # Support Prosody 0.5.x series (<font color="blue">_Medium_</font>) |
|
|
27 # Refactor code (<font color="blue">_Medium_</font>) |
|
|
28 * The code is pretty messy at the moment, it should be refactored to be more easily understood. |
|
|
29 # Disable use of "user@domain" OpenID identifier form (<font color="green">_Easy_</font>) |
|
|
30 * This is a vestigial feature from the early design, allowing explicit specification of the JID. However the JID can be inferred from the simpler OpenID identifier form. |
|
|
31 # Use a cryptographically secure Pseudo Random Number Generator (PRNG) (<font color="blue">_Medium_</font>) |
|
|
32 * This would likely be accomplished using luacrypto which provides a Lua binding to the OpenSSL PRNG. |
|
|
33 # Make sure OpenID key-value pairs get signed in the right order (<font color="red">_Hard_</font>) |
|
|
34 * It is important that the OpenID key-value responses be signed in the proper order so that the signature can be properly verified by the receiving party. This may be complicated by the fact that the iterative ordering of keys in a Lua table is not guaranteed for non-integer keys. |
|
|
35 # Do an actual match on the OpenID realm (<font color="blue">_Medium_</font>) |
|
|
36 * The code currently always returns true for matches against an OpenID realm, posing a security risk. |
|
|
37 # Don't use plain text authentication over HTTP (<font color="red">_Hard_</font>) |
|
|
38 * This would require some JavaScript to perform a digest. |
|
|
39 # Return meaningful error responses (<font color="blue">_Medium_</font>) |
|
|
40 * Most error responses are an HTTP 404 File Not Found, obviously something more meaningful could be returned. |
|
|
41 # Enable Association (<font color="red">_Hard_</font>) |
|
|
42 * Association is a feature of the OpenID specification which reduces the number of round-trips needed to perform authentication. |
|
|
43 # Support HTTPS (<font color="blue">_Medium_</font>) |
|
|
44 * With option to only allow authentication through HTTPS |
|
|
45 # Check specification compliance (<font color="blue">_Medium_</font>) |
|
|
46 * Walk through the code and make sure it complies with the OpenID specification. Comment code as necessary with the relevant sections in the specification. |
|
|
47 |
|
|
48 Once all these steps are done, mod_openid could be considered to have reached "beta" status and ready to real world use. The following are features that would be nice to have in a stable release: |
|
|
49 |
|
|
50 # Allow users to always trust realms (<font color="red">_Hard_</font>) |
|
|
51 # Allow users to remain logged in with a cookie (<font color="red">_Hard_</font>) |
|
|
52 # Enable simple registration using a user's vCard (<font color="blue">_Medium_</font>) |
|
|
53 # More useful user identity page (<font color="red">_Hard_</font>) |
|
|
54 * Allow users to alter what realms they trust and what simple registration information gets sent to relaying parties by default. |
|
|
55 # OpenID Bot (<font color="red">_Hard_</font>) |
|
|
56 * Offers all functionality of the user identity page management |
|
|
57 # Better designed pages (<font color="green">Easy</font>) |
|
|
58 * Use semantic XHTML and CSS to allow for custom styling. |
|
|
59 * Use the Prosody favicon. |
