contao/test — Issue #1375: OpenID Consumer Support
Author: importer
Created: 2011-11-29 07:49:01+00:00
State: open
Labels: Accepted, Feature, frontend

I have recently become acquainted with TYPOlight and have been very pleased with the system - it is an excellent CMS. My only hesitation (keeping me from widely implementing TYPOlight) is it's lack of OpenID support, something which I believe would thoroughly future-proof this fantastic CMS and would make it a leader in it's field.

I believe that if TYPOlight is going to go forward as a CMS then it is going to have to support authentication via. OpenID for FE-users/members. Many other popular CMSs already support OpenID, such as Drupal and Wordpress, and so unless TYPOlight begins to support it then it will likely soon fall behind.

h2. About OpenID

From [[openid.net]]:
"OpenID is a safe, faster, and easier way to log in to web sites."
How OpenID works is that the user has an account with a **provider** website (eg: Google, Facebook, myOpenID.com).
When they want to log onto a **consumer** website (eg: stackoverflow.com, many blogs and over 50,000 other websites, and _proposedly_ any TYPOlight website) they simply type in the URL given to them by their OpenID provider. The user is then directed to their provider's website where they must prove their identity to the provider (eg: password, digital certificates, etc.) and then the provider informs the consumer that the login was successful. The user then proceeds as usual to use the consumer website.

Some key advantages of this system are that:
* the first time login (sign-up) to each consumer website is MUCH quicker (no long signup forms, email verification, etc.), so you have a happy user
* the user needs only remember ONE password, not dozens for all the websites they use
* no email verification is necessary for the consumer site (because it has already been done by the provider)
* the consumer website is able to pull a large variety of data about the user from the provider (preventing long sign-up forms)
* the consumer website can potentially be configured/designed to accept both local accounts (as currently used by TYPOlight) and OpenID accounts
* the consumer website can store user accounts & associated data in a table (as currently done by TYPOlight), simply having some different or additional columns
For more information see [http://openid.net/add-openid/]

h2. Implementation

I propose that OpenID be implemented into the TYPOlight core for the FE (members) as an alternative method for FE-user/member authentication.
TYPOlight could be made an OpenID consumer, allowing users/members to log into the FE using their existing OpenID. The user could be given the choice of either using an OpenID, or using a normal user account and password (as TYPOlight currently uses). This would aid backward-compatibility and would give site administrators the choice of whether to allow OpenID, locally stored passwords, or both methods of authentication on their TYPOlight installation.

Many PHP libraries for implementing OpenID are available:
[http://openid.net/developers/libraries/#php]

I would recommend the PHP OpenID Library:
[http://www.openidenabled.com/php-openid/]
This library is ideal because it's licensing is permissive enough for it to be included in TYPOlight, and because it allows implementation of both the provider and consumer sides of OpenID authentication, which would be useful should it be later desired to enable TYPOlight as an OpenID provider also.

Using this library, implementing OpenID would simply require adding some additional columns to the TYPOlight members table to store the OpenIDs associated with accounts, and extending the existing member signup pages (in both the FE and BE). All other member associated features can remain unchanged, because the members table will also remain otherwise unchanged because OpenID implementation would only affect authentication aspects.

h3. Licensing

The PHP OpenID Library is freely distributed under the Apache v2 license, which does permit redistribution within other/derivative works of a different license, provided that the Apache v2 license is distributed with the library itself. Ie: we could integrate the libraries into TYPOlight and maintain all current licensing conditions, provided that we include the Apache v2 license with the PHP OpenID Library itself.

[Download the attachments](http://www.contao.org/tl_files/tickets/1375.zip "Download the attachments of this ticket")

--- _Originally created by samjetski on January 8th, 2010, at 08:03am (ID 1375)_