Package: pas.plugins.velruse
A PAS plugin for Plone thatauthenticate users from social networksthrough the use ofVelruse.ContentsIntroductionWhy use Velruse instead of RPX service?How to UseInstalling VelruseInstalling pas.plugins.velruseConfiguring pas.plugins.velruseGeneral site settingsPAS plugins configurationData read by Plone from VelruseRequirementsCreditsAuthorsChangelogIntroductionThis Plone plugin let you to enable authentication of social networks users in Plone sites, usingVelruse.Velruse is a Pyramid application so defined:Velruse is a set of authentication routines that provide aunified wayto have a website user authenticate to a
variety of different identity providers and/or a variety of different authentication schemes.It is similar in some ways toJanrain Engagewith the exception of beingopen-source,locally installable,
andeasily pluggablefor custom identity providers and authentication schemes.—from Velruse documentationWhy use Velruse instead of RPX service?Plone ecosystem already have at least one plugin for a general social authentication:plonesocial.auth.rpx. But in some
environments (for example: public company or whatever use case where the user’s privacy follow strict rules) this
kind of service can’t be used.Privacy apart, Velruse isopen source* and **easilly pluggable: you can provide authentication providers for new services
not covered by Janrain.Check also thisVelruse presentationfor more.How to UseInstalling VelruseVelruse is aPyramidapplication so you must follow the properinstallation instructionthe refer to theVelruse setup guide.Velruse can be executed as a separatePyramid serviceand the Plone plugin needs this configuration.
It will talk to Velruse using HTTP requests.TODO: recent Zope version can be executed in the WSGI stack. Maybe future version of the plugin would support
also this alternative way? Who knows.Installing pas.plugins.velruseJust addpas.plugins.velruseto your buildout configuration and re-run it.[instance]recipe=plone.recipe.zope2instance...eggs=...pas.plugins.velruseAfter Plone restart, add “Velruse authentication plugin” product to you Plone site.Configuring pas.plugins.velruseAll configuration are done through the “Velruse integration settings” configuration, from the Plone
control panel.General site settingsThe first section is for configuration that globally controls how Plone talk to Velruse, and other user interface
options.Site login enabledIf you want to keep enabled the standard Plone site login form or not.Authentication services enabledA configuration list of available Velruse backends. See below.Connection timeoutA timeout value for connection to velruse server.The “Authentication services enabled” configuration is composed by a set of triplets:Name(optional) A descriptive name of the remote service. For example: “Facebook”.URL or path(mandatory) URL or path to the running Velruse service. Please note: this must be a public URL the user must
able to access. This is not really mandatory, but if not provided the login method is not displayed in the login form.Icon(optional) URL or path for an icon that can recall the service logo.Default CSS implementation is for 64x64px images.URLs above can be absolute (”http://auth.yourservice.com/login/facebook”) or relative to the portal root URL by
using a starting slash (“/velruse/login/facebook”). The latter will help you keeping Plone and Velruse behind Apache.Those information are used to properly configure the new login form.PAS plugins configurationThe other configuration section is relative the Velruse PAS plugin(s).Velruse server hostThe hostname of the Pyramid Velruse service. For example:127.0.0.1:8080if Velruse run on the same
server of Plone.Velruse auth info pathThe configured Pyramid route for callingauth_info. Default is/velruse/auth_info.Keep in mind this warning taken from official Velruse documentation:The/auth_infoURL should be considered sensitive and only trusted services should be allowed access.
If an attacker intercepts a an authentication token, they could potentially query /auth_info and learn all of
the credentials for the user.User rolesSet of default roles automatically given to users that perform authentication with the Velruse plugin.
Default to “Members” only.Plus, you have two additional forms: “Users management” and “Blacklist management” to manage user’s data
inside the plugin. You can delete data or enableadd the user to theblacklist.
Blacklisted users can’t authenticate anymore.Data read by Plone from VelruseRight now only Twitter, Facebook, Linkedin and Google+ are automatically configured:from Twitter: fullname, location, personal home page and portrait
(no e-mail can be read)from Facebook: fullname, e-mail and portraitfrom Linkedin: fullname, e-mail and portrait
(must properly configure the Linkedin API)from Google: fullname and e-mailBut Velruse supporta lotof additional providers; if you want to enable more
(this is true also for custom providers) you must configure the plugin, setting what data try to read
by changing a configuration variable.frompas.plugins.velruse.configimportPROPERTY_PROVIDERS_INFOPROPERTY_PROVIDERS_INFO['yourmagicnewprovider']=('fullname','email','description')TODO: this will probably change in future, maybe replaced by a blacklist of property youdon’twant to read, or
something configurable TTW.RequirementsTested with:Plone 3.3Plone 4.2Plone 4.3All using Velruse 1.1.CreditsDeveloped with the support ofRegione Emilia Romagna;
Regione Emilia Romagna supports thePloneGov initiative.AuthorsThis product was developed by RedTurtle Technology team.Special thanks toMauro AmicoandBen Bangert(for accepting a couple of mine pull requests).Changelog0.1.0a1 (2014-05-14)Initial release