Unless/until we fix the storage of passwords for Beaker's native password-based auth, I'd like to explicitly warn people away from relying on that configuration in the docs.
However, our own solution to that problem is to let mod_auth_kerb do the heavy lifting, which isn't going to be applicable to something like beaker.fedoraproject.org
Has anyone tried to use mod_auth_oauth at all? I'm wondering if that may be a more upstream-friendly alternative that still avoids relying on the currently-not-suitable-for-production-use-on-the-big-bad-internet password based auth.
Cheers, Nick.
On Wed, 20 Nov 2013 11:59:46 +1000 Nick Coghlan ncoghlan@redhat.com wrote:
Unless/until we fix the storage of passwords for Beaker's native password-based auth, I'd like to explicitly warn people away from relying on that configuration in the docs.
OK, good to know. Thanks for the heads up.
However, our own solution to that problem is to let mod_auth_kerb do the heavy lifting, which isn't going to be applicable to something like beaker.fedoraproject.org
Yeah, beaker.fp.o will eventually need to auth against FAS which currently supports OpenID and will shortly support Persona [1]. I haven't gotten around to figuring out the best way to get that done yet.
[1] http://www.mozilla.org/en-US/persona/
Has anyone tried to use mod_auth_oauth at all? I'm wondering if that may be a more upstream-friendly alternative that still avoids relying on the currently-not-suitable-for-production-use-on-the-big-bad-internet password based auth.
I can't speak for anyone else, but mod_auth_oauth wouldn't work immediately for fedora just because FAS doesn't support it.
I am, however, interested in looking at something like mod_authnz_persona [2] and may poke at that a bit once FAS has a persona provider.
[2] https://github.com/mozilla/mod_authnz_persona
Tim
Excerpts from Nick Coghlan's message of 2013-11-20 11:59:46 +1000:
Unless/until we fix the storage of passwords for Beaker's native password-based auth, I'd like to explicitly warn people away from relying on that configuration in the docs.
Inspired by this ugly warning in our docs, I had a crack at implementing salted password hashes. The passlib library [1] made it very easy, including a nice upgrade path for existing sites. I finished off a patch for it this afternoon [2] so it should be in Beaker 0.16.
Of course that doesn't help with FAS integration though, to which mod_authnz_persona is probably the right solution.
[1] http://pythonhosted.org/passlib/ [2] http://gerrit.beaker-project.org/2562
beaker-devel@lists.fedorahosted.org
-
Dan Callaghan -
Nick Coghlan -
Tim Flink