Reviewing merge request #1702: Added a simple whitelist for OpenID providers

Added a simple whitelist for OpenID providers based on domain names. It's not the most brilliant domain-matching code, but it works for the cases mentioned in the README. Suggestions welcomed.

Also, if the whitelist only has one entry, then it's used to prefill the OpenID fields.

I haven't tried merging this into 0.9.x, but I don't expect any major conflicts (aside from moved files). Let me know if I should test it against 0.9.x.

Commits that would be merged:

Version 1
  • Version 1
  • d1a5a49
  • fe2faf0
  • Added a simple whitelist for OpenID providers based on domain names

  • 256218e
  • If the OpenID whitelist contains only one entry, then use it to prefill OpenID fields

Showing d1a5a49-fe2faf0

Comments

I really don’t like this… it makes some OpenID providers “preferred” which goes against the whole idea of OpenID being decentralized, anyone-can-make-an-OpenID idea.

I suggest you read this article http://netmesh.info/jernst/digital_identity/is-openid-still-user-centric and reconsider if StatusNet should be participating in the loss of user-centric-ness of OpenID.

(I'm definitely biased, as I have my own OpenID provider, and am very annoyed when I encounter site that claims to support OpenID, but then only supports yahoo or google identities)

I wrote this to support my use case (I want my private StatusNet site to only recognize my private OpenID provider), not to undermine, nor for StatusNet to undermine, the user-centric-ness of OpenID.

I'm sharing this in the spirit of contributing to the community. If you feel this change is wrong, that’s okay. Please accept or reject this merge request as you see fit.

(As it stands now, I’ll probably have to drop OpenID entirely and authenticate against LDAP, meaning I’ll be working on an LDAP plugin soon. And I’ll share that with the community as well.)

I definitely appreciate your contributions – I'm just a contributor, too, stating my opinions and doing whatever I think is useful.

In this case, I disagree with the merge request – but not for a technical reason, so I'm not going to reject it, but I won’t merge it either. But, one of the other committers might – I’ll ask around and see what others think.

Thanks again for your contribution!

Looks like the other committers agree with you (or just apathetic on this). Oh well – not the first time I've submitted something disagreeable :–)

Thanks for reviewing and (mostly) merging my patches. I do appreciate your help.

Add a new comment:

Login or create an account to post a comment

How to apply this merge request to your repository