From: Olivier B. <oli...@it...> - 2010-09-21 07:39:16
|
Le lundi 20 septembre 2010 à 12:41 -0400, John Reese a écrit : > On 09/20/2010 12:20 PM, Olivier Berger wrote: > > OAuth provider : it would help verify credentials of clients of the > > tracker's webservices (SOAP, REST in the future) wrt to Mantis' DB. > > That sounds like a great idea. :) Would love to be able to use OAuth > for things like the IRC bot on #mantishelp. > > > So for instance, any continuous integration tool could login on behalf > > of a user and file bug reports in his/her place. > > > > What would be your use case for Mantis being an OAuth consumer ? > > For a specific use-case, I am working on a project where we have a very > popular, public-facing community site/user database, and are looking to > add an OAuth provider to allow other apps, or 3rd party websites, to > share that user data and credentials. Allowing Mantis to act as an > OAuth consumer would allow those existing users to log in and submit bug > reports. I see. But if the thing is submitting bug reports to mantis, then, I'm not sure Mantis is a consumer. Looks more like a provider to me. > > It sounds to me like it would be useful to implement both an OAuth > provider and an OAuth consumer for Mantis, although we do not yet have > the support in the core for creating new auth consumers in Mantis. That > is one of the long-standing goals for the plugin system, ie, to > modularize the authentication system so that plugins could easily > implement support for authentication against external databases similar > to the existing LDAP support. Of course that would be great. I hope my code can help a little bit in this direction. Basically what is there already is the management of the OAuth protocol, tokens, etc. Then what's left to do, is link those credentials to real Mantis permissions, and be able to offer that auth method to other plugins or APIs, like SOAP, REST, etc. So, there's quite some work to be done, to deliver a fully useful feature, and probably some standardization of apis and such things along the lines you've described. Now, back to contribution of our code : now, it's in my git at http://git.mantisforge.org/w/mantisbt/helios.git?a=tree;f=plugins/OauthAuthz;hb=OauthAuthz , what would be the next steps ? Best regards, -- Olivier BERGER <oli...@it...> http://www-public.it-sudparis.eu/~berger_o/ - OpenPGP-Id: 2048R/5819D7E8 Ingénieur Recherche - Dept INF Institut TELECOM, SudParis (http://www.it-sudparis.eu/), Evry (France) |