4clojure/4clojure — pull request #194 by chrismgray (2011-12-14 01:11:39+00:00)
Title: OpenID Implementation

This branch implements OpenID for 4clojure, affecting issue #33. The
OpenID library used is Stephen Lindsay's clj-openid, which is
available [here](https://github.com/stephenalindsay/clj-openid), but
unfortunately is not yet on clojars.

I tried to keep things as backwards-compatible as possible, so the
code adds a bit of complexity.

There are two ways that OpenIDs can be used: most simply, a user can
log in with an OpenID. In this case, the only thing identifying the
user is the OpenID URL (i.e., there is no email or username).
Alternatively, a user with an existing username can associate an
OpenID with the username. In that case, the user can log in using the
OpenID, but in all other respects should have the same experience as
if he or she had logged in the normal way.

There are a few known issues with this code. First, I have not
thought a lot about the implications of what happens if two users have
access to the same OpenID. This might allow the second user to
"steal" the first user's account and solutions. It seems to me that
this problem is on par with a user giving his or her password away
(i.e., it's more the user's problem than ours). The second issue is
that OpenID has methods for requesting users' information (such as
avatar, email, etc.), but those do not seem to be exposed by
clj-openid, so can not be used by us. One final known issue is that I
got tired of trying to figure out how to use destructuring on the
request parameters in the openid-callback route (at the end of
login.clj) and just got the needed parameters "by hand". This could
be cleaned up by someone who uses destructuring more than I do.

This code has been tested to an extent -- both logging in only with an
OpenID and by associating an OpenID with a normal account -- but
should obviously be tested at a larger scale before being put into
production.