[Beaker-devel] Authentication for non-Kerberos Beaker instances
Tim Flink
tflink at redhat.com
Wed Nov 20 05:50:31 UTC 2013
On Wed, 20 Nov 2013 11:59:46 +1000
Nick Coghlan <ncoghlan at redhat.com> wrote:
> Unless/until we fix the storage of passwords for Beaker's native
> password-based auth, I'd like to explicitly warn people away from
> relying on that configuration in the docs.
OK, good to know. Thanks for the heads up.
> However, our own solution to that problem is to let mod_auth_kerb do
> the heavy lifting, which isn't going to be applicable to something
> like beaker.fedoraproject.org
Yeah, beaker.fp.o will eventually need to auth against FAS which
currently supports OpenID and will shortly support Persona [1]. I
haven't gotten around to figuring out the best way to get that done yet.
[1] http://www.mozilla.org/en-US/persona/
> Has anyone tried to use mod_auth_oauth at all? I'm wondering if that
> may be a more upstream-friendly alternative that still avoids relying
> on the
> currently-not-suitable-for-production-use-on-the-big-bad-internet
> password based auth.
I can't speak for anyone else, but mod_auth_oauth wouldn't work
immediately for fedora just because FAS doesn't support it.
I am, however, interested in looking at something like
mod_authnz_persona [2] and may poke at that a bit once FAS has a
persona provider.
[2] https://github.com/mozilla/mod_authnz_persona
Tim
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/beaker-devel/attachments/20131119/c6b862b1/attachment.sig>
More information about the Beaker-devel
mailing list