[Beaker-devel] Authentication for non-Kerberos Beaker instances

Tim Flink tflink at redhat.com
Wed Nov 20 05:50:31 UTC 2013


On Wed, 20 Nov 2013 11:59:46 +1000
Nick Coghlan <ncoghlan at redhat.com> wrote:

> Unless/until we fix the storage of passwords for Beaker's native
> password-based auth, I'd like to explicitly warn people away from
> relying on that configuration in the docs.

OK, good to know. Thanks for the heads up.

> However, our own solution to that problem is to let mod_auth_kerb do
> the heavy lifting, which isn't going to be applicable to something
> like beaker.fedoraproject.org

Yeah, beaker.fp.o will eventually need to auth against FAS which
currently supports OpenID and will shortly support Persona [1]. I
haven't gotten around to figuring out the best way to get that done yet.

[1] http://www.mozilla.org/en-US/persona/

> Has anyone tried to use mod_auth_oauth at all? I'm wondering if that
> may be a more upstream-friendly alternative that still avoids relying
> on the
> currently-not-suitable-for-production-use-on-the-big-bad-internet
> password based auth.

I can't speak for anyone else, but mod_auth_oauth wouldn't work
immediately for fedora just because FAS doesn't support it.

I am, however, interested in looking at something like
mod_authnz_persona [2] and may poke at that a bit once FAS has a
persona provider.

[2] https://github.com/mozilla/mod_authnz_persona

Tim
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/beaker-devel/attachments/20131119/c6b862b1/attachment.sig>


More information about the Beaker-devel mailing list