Plugin to provide OpenId authentication

[mattab]

Build a plugin to provide OpenId authentication.

[Tutorial about OpenId in the Zend_Framework using Zend_Auth_OpenId](http://devzone.zend.com/article/3141-Lifting-the-Skirt-on-Zend-Framework-1.5-Zend_Auth-and-the-OpenId-Adapter)

Refs #5534 Review the Login plugin to make it really modular (refactor the Auth class)

Keywords: interesting

[robocoder]

The Zend folks released ZF 1.7 in November. Should Piwik update its Zend install? (It looks like ZF 1.0.)

[mattab]

vipsoft, I created a new ticket: #497 to update ZF

[robocoder]

For login page, might consider using: http://code.google.com/p/openid-selector/ or http://code.google.com/p/openid-realselector/

(Some might prefer the more compact example at pibb.com.)

[robocoder]

See IDIB Beacon for OpenID discovery. http://code.google.com/p/idib

[anonymous-matomo-user]

Sorry for posting this here and in the forum. I would like to know if you guys have already developed something for this OpenID plugin. I would like to work on that OpenID-Plugin as well. Who can i contact to help with the development?

Best regards,
yato

[mattab]

No work has been done on this plugin, or it would appear in this ticket.

[robocoder]

yato: if you're volunteering, either matt or myself would be able to answer your questions.

This ticket is primarily to add an OpenID consumer using Zend_Auth_OpenId. Hooks to the "login" and "user management" forms would probably be needed (e.g., to associate an OpenID with a Piwik user).

It would be optional to provide an OpenID producer via Piwik.

[mattab]

Maybe adding oAuth authentication would be more useful than adding OpenID... any thoughts?

[robocoder]

oAuth is in #906 -- it would be alternative to (or replacement for) token_auth.

[mattab]

OK so this plugin is about Authenticating users in Piwik with OpenID, but not about changing the token_auth API authentication mechanism at all, correct?

[anonymous-matomo-user]

Replying to matt:

OK so this plugin is about Authenticating users in Piwik with OpenID, but not about changing the token_auth API authentication mechanism at all, correct?

I think that would be good.

Sorry for not posting for a long time. Had a lot of other stuff to do.
My thoughts/questions so far:

• piwik is just a OpenID consumer (as vipsoft wrote)
• the plugin will be an alternative or addition to the standard login
• using the openif-selector seems good as well. But maybe starting with a simple openID-only version and expand that later?

greets,
yato

[robocoder]

(In [3694]) fixes #1765 - updating to Zend Framework 1.11.2 with some modifications:

ZF-10888: loadClass() inconsistencies

• Zend/Http/Client.php
• Zend/Uri.php
• Zend/Validate.php

ZF-10890: include_path dependency and inconsistencies

• Zend/Validate/Hostname.php

refs #5580 - added Zend_OpenId

[robocoder]

In http://forum.piwik.org/read.php?3,71393, we have a suggestion to add Yubikey support (which can augment OpenId). At the moment, the php libraries for Yubikey would require rework before we could consider implementing as a plugin. (php-yubico from the vendor requires PEAR, while the third-party, standalone yubikey-php-webservice-class is license incompatible with Piwik.) That said, John Salter for Yubico has offered a couple of YubiKeys for evaluation/test.

[mattab]

OpenId is not 'cool' anymore? sorry...

[robocoder]

This plugin would really complement the signup plugin #1148. There's anecdotal evidence that OpenID has lower abandonment rates than traditional email for sign-up.

And I think 2 factor authentication may be a nice addon in general.

[mattab]

Definitely agree, it is a great contribution idea if anyone is interested!