seansaleh/Orthus — pull request #6 by gerow (2014-06-06 05:02:12+00:00)
Title: Added Persona Support

Added ability to authenticate using Persona. The way it does it now is kinda hacky since it essentially turns what we get from Persona (an email that we are guaranteed that the user owns) into a unique identifier that looks like Orthus expects. We do this by just passing the identifier "persona:#{email}" with the email interpolated in.

Either way it works.

Might want to also look at f7ca9bf. I removed a check that claimed to be making sure that a user couldn't submit multiple access requests since it was making the Persona implementation fail (since the auth already happened at that point and req.user was filled out with the email we got from persona). I removed it after checking to see if it even blocked multiple access requests and determining that even using the current Google OpenID it doesn't actually prevent a user from submitting multiple access requests. It doesn't make multiple entries in the persist store, but it does replace the information the user last submitted with what the just submitted.

I suppose this could create a timing attack in the way of a user changing the name associated with an account, but it doesn't really seem like that big of a deal since the actual unique value authenticated (email) cannot be affected.